Privacy Policy

When you create a host account, GoCall collects your email address and payout details through Stripe Connect. Hosts can also add optional profile details in account settings (display name, profile photo, short bio, LinkedIn URL, personal website, and timezone), which are shown to guests on the join page. Hosts who link Telegram or enable web push notifications also save the identifiers needed to deliver those notifications. For guests, GoCall collects the email used to join the call. Card details are handled by Stripe; GoCall does not store them.

GoCall uses your information to operate the service, process payments, and send account, call, and billing communications, including invitations and receipts.

GoCall applies industry-standard security measures. Payment information is handled through Stripe's PCI-compliant infrastructure; GoCall never stores card numbers, CVVs, or other sensitive payment credentials.

GoCall stores call metadata, duration, participants, timestamps, and billing records, to support receipts, settlement, and dispute handling. Live video and audio are transported by Daily and are not recorded by GoCall.

GoCall relies on a small set of service providers. The main providers are named below so hosts and guests can understand where data flows.

• Stripe: Payment processing and payouts. Stripe holds full card details, bank account information for hosts, and transaction records. See Stripe's privacy policy.
• Daily: Transports live audio and video during calls. Streams are not recorded or stored by GoCall.
• Clerk: Handles host account sign-in and session management. Processes host email addresses and login credentials.
• Resend: Delivers transactional emails such as call invitations, receipts, cancellation notices, and dispute notices.
• PostHog: Server-side product analytics for funnel and retention analysis. Sends structured event properties (call IDs, host IDs, event names), not page URLs. No client-side tracker is loaded in the browser.
• Vercel Analytics: Page-view analytics. URL paths are scrubbed of tokens and identifiers before transmission, and cross-site tracking is not used.
• Sentry: Error monitoring, sampled performance traces, and error-triggered session replay. Routine sessions are not recorded; replay is sampled when an error occurs. Guest tokens and session identifiers are scrubbed before transmission where GoCall controls the event payload.
• Vercel, Neon, Upstash, and QStash: Hosting, database, rate-limiting, and scheduled-job infrastructure. These providers hold data only as needed to run the service.
• Telegram: Optional host notifications when a host links Telegram in account settings.
• Web Push services: When a host opts in to push notifications, the browser delivers notifications through the operating system's push provider (Apple APNs, Google FCM, Mozilla autopush, or Microsoft WNS). GoCall's VAPID identity uses mailto:support@gocall.io. Push payloads are encrypted in transit.

GoCall's hosting and database providers operate primarily in the United States. If you are located outside the United States, your information will be transferred to and processed in the United States and other countries where GoCall's service providers operate. Where transfers from the EEA, UK, or Switzerland occur, GoCall relies on the safeguards each provider offers, which typically include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and certifications under the EU-US Data Privacy Framework where applicable.

Providers change from time to time as GoCall picks the best tool for the job. Material changes that affect how your data is handled will be reflected here.

Account profile data is retained while your account is active. When a host account is deleted, personal information (email, name) is anonymized and pending calls are cancelled. Financial records, completed calls, billing segments, and payment transactions, are retained as required by applicable law for tax and dispute resolution.

Specific retention windows GoCall applies:

• Operational audit logs: 365 days, after which they are pruned by a scheduled cleanup job.
• Push notification subscriptions: until you unsubscribe, the endpoint returns a permanent error, or your account is deleted.
• Telegram link tokens: single-use; expire 10 minutes after issuance.
• Telegram chat ID: until you unlink Telegram or your account is deleted.
• Email delivery records: retained with the associated call for idempotency and delivery audit.
• Stripe-held data(card details, KYC, payouts): retained per Stripe's policies.

Guests do not create a GoCall account. Card details are held by Stripe. GoCall stores the email used to join the call along with call metadata (billing segments, timestamps). The guest email is also used to send transactional notices tied to the call: invitations, receipts, cancellation notices, and dispute-related communications.

Hosts can update profile information in account settings. Hosts and guests can contact GoCall to request access, correction, deletion, or portability of personal information. Some financial and dispute records must be retained for tax, compliance, fraud prevention, and chargeback handling.

GoCall is not directed to children under 13. If you believe a child provided personal information to GoCall, contact GoCall so it can be reviewed and removed where required.

GoCall may update this policy as the service changes. Material updates will be reflected on this page with a new last-updated date, and additional notice will be provided when required by law.

If you need help with account deletion, guest receipts, or a privacy-related question, contact support@gocall.io.

For billing holds, fees, disputes, and refund responsibility, read the Terms of Service.