Phone Activity privacy

What you authorize

The app requests your Google email identity to verify that you own the configured backup folder, and full Google Drive access to read and permanently delete eligible backup files. This Google permission is broad. Our code restricts operations to the configured folder and expected backup files; the restriction is not enforced by Google’s permission system.

A separate Android backup app collects and uploads phone data under its own permissions and privacy terms. Its backups may include message contents, phone numbers, contact names, attachments and call logs, including personal communications. This app does not collect WhatsApp communications.

What we process and retain

The server downloads full backup files into bounded memory to extract activity metadata. Message contents therefore pass through the server during processing, even though our retained phone history does not store message bodies, subjects, contact names or the other party’s phone number.

Retained history includes dates, direction, activity type, connected call seconds and keyed pseudonymous identifiers used to prevent duplicates and associate activity with client projects. These identifiers are not anonymous. Setup records retain your enrolled phone number, Google email, folder identifier, encrypted Google refresh credential and project mappings. Import receipts and controlled error codes support operation and troubleshooting.

The phone importer does not send backup content to a generative AI model. The separate work-report system may use AI for other approved sources; that does not authorize AI processing of your phone backup contents.

Providers and access

Google Drive stores the uploaded backups. Vercel hosts the processing service, and Neon stores retained metadata and encrypted connection credentials. When report delivery is enabled, Resend processes the report email for the recipients agreed during setup. GitHub Actions triggers the server worker but does not receive raw backups or Google credentials.

J2J operators use access-controlled tools to configure and support the connection and review retained activity. We will not read raw communication content without your specific affirmative agreement, except where necessary for security, legal compliance or another use permitted by Google’s Limited Use requirements. Google access tokens are used for the connection; refresh credentials are encrypted before database storage, and service connections use HTTPS.

Deletion and retention

After a successful import, the worker permanently deletes the processed Drive backup and checks that it is absent. Failed recent imports remain for retry; the worker attempts to remove expired unprocessed backups after 24 hours and records a gap. Deletion is best effort: outages, revoked access, changed files or insufficient permissions can leave files in Drive longer. This is not a guaranteed 24-hour maximum.

Deleting a cloud backup does not remove the original messages or call history from your phone. Later backups can contain the same older conversations again. Local phone backups and the backup app’s settings need separate management.

Historical metadata retention, report recipients and any applicable legal retention requirements must be agreed before ongoing customer processing is enabled. Contact us to request deletion of your retained phone records or connection credential. Existing delivered reports and provider recovery copies may need separate handling; we will explain what can be removed and any required retention.

Your choices

You can revoke Google access at any time and ask J2J to disable the source. Revocation stops future Google access but does not automatically erase previously retained metadata or stop the separate backup app uploading. Disable that app’s schedule or cloud connection separately if you want uploads to stop.

Google Limited Use

LC3 Phone Activity’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data and derived phone activity are used only to provide and support the authorized feature, not sold, used for advertising or used to train general-purpose AI models. Transfers are limited to the consented feature, security needs, legal requirements or other transfers expressly permitted by that policy.