Privacy
Last updated 31 August 2026
This site is about phone numbers, not about people. The short version: we publish how many people reported a number and what they said the call was. We do not publish who reported it, we do not try to work out who a number belongs to, and if a number is yours you can remove it yourself.
"We" is OncillaAI LLC, the company that operates whocalledyou.dev, including the text message sent when someone removes their own number.
What we publish
For a phone number, a page here can show:
- how many reports we hold, and how many separate people they came from;
- what those people said the call was — telemarketing, a robocall, and so on;
- the dates of the first and last report, to the day.
That is the whole list. We never publish the free-text note a reporter can leave, anything identifying a reporter, or anything at all about who holds a number. We do not hold names, addresses, or account records for the numbers on this site, because we never collect them.
Looking up a number
Searching does not add the number to our database, and we never ask who you are. The result page carries the number in its web address, so our analytics counts it as a page visit. That analytics sets no cookie and does not fingerprint your browser, so those visits cannot be strung together into one person's history of searches — and none of it is connected to a name, because we hold no names.
Reporting a number
We ask for as little as we can:
- the number that called you, and what the call was;
- optionally, a short note about what happened.
We do not ask for your name, your email, your own phone number, or anything about the caller's identity — not optionally, not at all.
We do not store your IP address with your report. To stop one person filing the same report repeatedly, we store a one-way hash of it, computed with a random salt that we generate fresh each day. After 30 days the salt is deleted, which makes those hashes impossible to reproduce — including by us, and including if someone knew the original address.
The optional note is kept for moderation and is never shown publicly. People sometimes write other people's names and addresses into free-text boxes, and publishing that would be the opposite of what this site is for.
Removing your number
If a number is yours, you can remove it from public results yourself. We text a six-digit code to it and remove the number once you enter the code. We use the number to send that code and to record that it should not be listed. Codes are stored hashed, expire within minutes, and can be used once.
After removal, anyone who looks the number up sees exactly what they would see for a number nobody has ever reported. The underlying reports are kept internally rather than deleted, so that a removal can be undone if the mechanism is abused — for example, by the operator of a number trying to hide their own activity.
The removal code is a single, one-time text — not a subscription, and not part of any recurring campaign. Message and data rates may apply. There is nothing to opt out of: after that one message, nothing more is sent to the number unless removal is requested again. Questions about this text can go to [email protected].
Sending a correction
A correction form asks what is wrong and, optionally, an email address if you want a reply. That address is deleted when the correction is closed. We ask you not to include other people's details.
Where our data comes from
Reports come from people using this site, and from the United States Federal Trade Commission's Do Not Call reported-calls dataset, which the FTC publishes as public domain data. FTC complaints are unverified by the FTC and unverified by us. We import only the reported number, the date of the call, and the subject the consumer chose. We deliberately do not import the city, state, or area code of the person who complained.
How long we keep things
| Your IP address | Not stored with your report; kept 30 days in error reports |
|---|---|
| Salted hash of it | 30 days, then erased with its salt |
| Report category and date | Kept while the report is shown |
| Optional note on a report | 12 months, never public |
| Imported FTC complaints | 12 months |
| Verification codes | Hashed, minutes |
| Correction contact email | Deleted when the correction closes |
| Analytics records of page visits | About 6 months, held by Cloudflare |
Reports also lose weight as they age: a report counts for half as much after 90 days. US phone numbers are commonly reassigned to a new person about 45 days after a line is disconnected, so old reports increasingly describe somebody who no longer has the number. When a number has no reports left, we delete our record of it entirely.
Who else is involved
- Cloudflare — carries every request to this site, so it already sees the pages you visit. It also protects the site, runs the "are you a person?" check on the report form, and provides the analytics we use to count visits.
- Twilio — delivers the verification text when you remove a number.
- Google Cloud — runs the servers and the database, and may keep short-lived operational logs.
- Sentry — records what went wrong when the site hits an error, including the address of the page you were on and your IP address, so the fault can be found and fixed. Kept for 30 days.
We do not sell or share your personal information. The analytics we use is cookieless and does not follow you between sites, so there is no advertising profile of you here to sell — and we added no company to the list above to get it, because Cloudflare already carries every request.
Cookies
The public site sets no cookies. Our analytics deliberately uses none, which is most of why we chose it. A single session cookie is used only when an administrator signs in.
Your choices
The fastest way to have a number removed is to remove it yourself. If that is not possible — for example, you cannot receive texts on the number — write to [email protected] and we will handle it by hand. If you are in a place with statutory data rights, such as California or the EU, use the same address and we will treat your message as a request under whichever law applies to you — including a request that we stop selling or sharing your personal information.
If the site changes hands
If whoCalledYou is sold, merged, or otherwise transferred, the data described here moves with it. Whoever runs the site then is bound by this policy until they publish a replacement. Removing a number stays available either way.
Children
This site is not directed at children and we do not knowingly collect their information.
Changes
If this policy changes materially, the date at the top changes with it.