Who we are
Before You Pick Up (beforeyoupickup.com) is run by a small independent team in Florida, United States. We're the controller for the data described here, which is a legal way of saying we decide what's collected and why. Reach us at privacy@beforeyoupickup.com.
What we collect
Everything below comes from you or from other people using the site. We don't buy data from anyone.
| What | Details |
|---|---|
| Reported phone numbers | The number someone reports. Stored encrypted at rest (AES-256-GCM) and looked up by a hash of the number. This is personal data about whoever has that number, who is usually not the person reporting. |
| Reports | Where it happened (dating app, marketplace, text or call, and so on), what stage things were at, roughly when, which patterns from a fixed list, an optional note of up to 500 characters, and the date. Notes are scanned for names, contact details, addresses, and links before they're saved, and refused if they contain any. |
| Who reported | A keyed hash of the IP address the report came from (a one-way hash with a server-side secret, so it can't be turned back into the address without that secret). If you're signed in, the link to your account. We use these to count how many different people reported a number and to enforce one report per number per person per month. |
| Flags and disputes | The reason, any details you type, and for disputes your email address and message. Dispute messages may include identifying details, since only moderators read them. |
| Account (optional) | Your email, a hashed password (bcrypt), whether 2-step sign-in is on, short-lived sign-in codes and reset links, and the numbers you choose to watch. If you subscribe to Pro: your plan, the customer id Stripe gives us, and the date the paid period ends. We never see or store your card. |
| Lookups | Each search or number lookup logs a hashed IP, whether it was a search or a direct visit, and whether the number was found. Used to spot scraping and floods. |
| Rate limits | Counters keyed by hashed IP, email, or account, so nobody can send hundreds of reports or sign-in attempts. Cleared when the window ends. |
| Analytics and logs | Vercel Analytics counts page views in aggregate and doesn't use cookies. Our host keeps standard request logs briefly. Neither is tied to your reports. |
Phone numbers are personal data
A phone number is about someone, and the someone is usually not the person reporting it. We want to be plain about how we treat it.
- We store it so people can look it up. That's the whole point of the site.
- Everywhere it appears on a public page, including the page title, it's partly hidden (212-5**-**34). The page's address is a keyed hash of the number, not the number itself. Nothing on the site shows a number you could dial, other than echoing back one you typed yourself; people find the page by searching the full number here.
- We don't attach names, addresses, or owner lookups to a number, and reports can't include them.
- When a number's page is taken down, it's hidden everywhere and marked so search engines drop it.
- If it's your number, you can dispute the reports or ask for removal. It's free and doesn't need an account.
How we use it
- To run the site: show reports on a number's page, count how many different people reported it, and work out the signal level.
- To stop abuse: rate limits, floods, bots, duplicate reports, and scraping.
- To email you what you asked for: dispute receipts and outcomes, alerts on numbers you watch, sign-in codes, password resets.
- To keep a record of moderation decisions so we can explain them later.
If you're in the EU or UK, the legal bases are our legitimate interest in running a public safety resource and keeping it from being abused, performance of a contract for accounts, and legal obligations where they apply.
Paid links
Some pages carry one sponsored link, to Optery, a service that removes personal details from data broker sites. It is always labelled “Sponsored” where it appears. We earn a commission if you sign up through it, at no extra cost to you, and it does not change what we recommend or what any report says.
The link tells Optery which page it was clicked from, and nothing else. It carries no phone number, no number-page address, and nothing that identifies you or what you looked up. We do not share your searches, your reports or your account with them or with anyone else.
What's public and what isn't
Public: the reported phone number, always partly hidden (212-5**-**34) and never dialable, and each visible report: platform, stage, time window, categories, the note, the status label, and the date. The number itself is stored encrypted; what identifies a page publicly is a one-way hash of the number, not the number.
Never public: who reported. Not your name, email, IP, IP hash, or account. Dispute messages, flag details, moderation notes, and the numbers you watch are also private.
Number pages with reports can be indexed by search engines. Pages for numbers that have been taken down are hidden and marked not to be indexed.
How long we keep it
| What | How long |
|---|---|
| Reports | While they're live. Removed reports stay in the database marked removed, as a moderation record, and are never shown again. |
| Numbers | While a number has reports, or while someone is watching it. Watching a number creates a row for it even if nobody has reported it. |
| Watched numbers | Until you stop watching the number, or delete your account. |
| IP hash on a report | Cleared after 180 days. |
| Lookup log | 90 days. |
| Rate limit counters | Until the window ends: minutes to a day. |
| Sign-in codes and reset links | Expire within an hour and are deleted after. |
| Account | Until you delete it. Your reports stay but are detached from you and become anonymous, unless you remove them first. |
| Disputes | Kept as a record of what we decided. Email us to have yours deleted once it's closed. |
| Analytics | Aggregate only, on Vercel's standard schedule. |
Your choices and rights
- Your number is listed: send a dispute. Free, no account needed. While we look we may mark the reports disputed; then we remove them, keep them, or take the page down, and tell you which.
- Remove your own report: if you were signed in, go to Account and remove it. If you weren't, email privacy@beforeyoupickup.com with the number and roughly when you reported.
- Delete your account: from Account. Your reports become anonymous but stay, unless you remove them first.
- Access, correction, deletion, objection: email privacy@beforeyoupickup.com. We answer within 30 days, and don't charge. We may need to check it's really you: for an account, a reply from that email address; for a number, a code sent to it or a call back.
- Complaints: if you're in the EU or UK and you think we've handled your data wrongly, you can complain to your data protection authority. We'd rather hear from you first.
- Do Not Track: we don't respond to the signal, because we don't track you across sites in the first place.
Security
- Everything travels over HTTPS.
- Phone numbers are encrypted at rest. Passwords are hashed with bcrypt. IPs are hashed with a server-side key.
- Rate limits, a bot check, and holds on suspicious bursts of reports.
- Moderator actions are logged. Accounts can turn on 2-step sign-in.
No system is perfect. If a breach affects you in a way the law requires us to disclose, we'll tell you.
Children
Before You Pick Up is for people 18 and over. We don't knowingly collect data from anyone younger. If you think someone under 18 has given us data, email privacy@beforeyoupickup.com and we'll delete it.
Where data lives
On servers in the United States, with the providers listed above. If you use the site from somewhere else, your data is processed in the US.
Changes
The effective date at the top tells you when this was last changed. If we change something that matters, we'll say so on the site before it takes effect. Using the site after that means you accept the new version.
Contact
Anything about your data: privacy@beforeyoupickup.com. Everything else: hello@beforeyoupickup.com. There's also the terms and the community guidelines.