Who we are
Before You Pick Up (beforeyoupickup.com) is run by a small independent team in Florida, United States. We're the controller for the data described here, which is a legal way of saying we decide what's collected and why. Reach us at privacy@beforeyoupickup.com.
What we collect
Everything below comes from you or from other people using the site. We don't buy data from anyone.
| What | Details |
|---|---|
| Reported phone numbers | The number someone reports. Stored encrypted at rest (AES-256-GCM) and looked up by a hash of the number. This is personal data about whoever has that number, who is usually not the person reporting. |
| Reports | Where it happened (dating app, marketplace, text or call, and so on), what stage things were at, roughly when, which patterns from a fixed list, an optional note of up to 500 characters, and the date. Notes are scanned for names, contact details, addresses, and links before they're saved, and refused if they contain any. |
| Who reported | A keyed hash of the IP address the report came from (a one-way hash with a server-side secret, so it can't be turned back into the address without that secret). If you're signed in, the link to your account. We use these to count how many different people reported a number and to enforce one report per number per person per month. |
| Flags and disputes | The reason, any details you type, and for disputes your email address and message. Dispute messages may include identifying details, since only moderators read them. |
| Account (optional) | Your email, a hashed password (bcrypt), whether 2-step sign-in is on, and short-lived sign-in codes and reset links. |
| Lookups | Each search or number lookup logs a hashed IP, whether it was a search or a direct visit, and whether the number was found. Used to spot scraping and floods. |
| Rate limits | Counters keyed by hashed IP, email, or account, so nobody can send hundreds of reports or sign-in attempts. Cleared when the window ends. |
| Analytics and logs | Vercel Analytics counts page views in aggregate and doesn't use cookies. Our host keeps standard request logs briefly. Neither is tied to your reports. |
Phone numbers are personal data
A phone number is about someone, and the someone is usually not the person reporting it. We want to be plain about how we treat it.
- We store it so people can look it up. That's the whole point of the site.
- On the number's own page it's shown in full, including in the page title, so people searching for it can find the page. In lists and cards it's partly hidden.
- We don't attach names, addresses, or owner lookups to a number, and reports can't include them.
- When a number's page is taken down, it's hidden everywhere and marked so search engines drop it.
- If it's your number, you can dispute the reports or ask for removal. It's free and doesn't need an account.
How we use it
- To run the site: show reports on a number's page, count how many different people reported it, and work out the signal level.
- To stop abuse: rate limits, floods, bots, duplicate reports, and scraping.
- To reply to you: dispute emails, sign-in codes, password resets.
- To keep a record of moderation decisions so we can explain them later.
If you're in the EU or UK, the legal bases are our legitimate interest in running a public safety resource and keeping it from being abused, performance of a contract for accounts, and legal obligations where they apply.
What's public and what isn't
Public: the phone number (in full on its own page, partly hidden in lists), and each visible report: platform, stage, time window, categories, the note, the status label, and the date.
Never public: who reported. Not your name, email, IP, IP hash, or account. Dispute messages, flag details, and moderation notes are also private.
Number pages with reports can be indexed by search engines. Pages for numbers that have been taken down are hidden and marked not to be indexed.
How long we keep it
| What | How long |
|---|---|
| Reports | While they're live. Removed reports stay in the database marked removed, as a moderation record, and are never shown again. |
| Reported numbers | While they have reports. A number nobody has reported isn't stored. |
| IP hash on a report | Cleared after 180 days. |
| Lookup log | 90 days. |
| Rate limit counters | Until the window ends: minutes to a day. |
| Sign-in codes and reset links | Expire within an hour and are deleted after. |
| Account | Until you delete it. Your reports stay but are detached from you and become anonymous, unless you remove them first. |
| Disputes | Kept as a record of what we decided. Email us to have yours deleted once it's closed. |
| Analytics | Aggregate only, on Vercel's standard schedule. |
Your choices and rights
- Your number is listed: send a dispute. Free, no account needed. While we look we may mark the reports disputed; then we remove them, keep them, or take the page down, and tell you which.
- Remove your own report: if you were signed in, go to Account and remove it. If you weren't, email privacy@beforeyoupickup.com with the number and roughly when you reported.
- Delete your account: from Account. Your reports become anonymous but stay, unless you remove them first.
- Access, correction, deletion, objection: email privacy@beforeyoupickup.com. We answer within 30 days, and don't charge. We may need to check it's really you: for an account, a reply from that email address; for a number, a code sent to it or a call back.
- Complaints: if you're in the EU or UK and you think we've handled your data wrongly, you can complain to your data protection authority. We'd rather hear from you first.
- Do Not Track: we don't respond to the signal, because we don't track you across sites in the first place.
Security
- Everything travels over HTTPS.
- Phone numbers are encrypted at rest. Passwords are hashed with bcrypt. IPs are hashed with a server-side key.
- Rate limits, a bot check, and holds on suspicious bursts of reports.
- Moderator actions are logged. Accounts can turn on 2-step sign-in.
No system is perfect. If a breach affects you in a way the law requires us to disclose, we'll tell you.
Children
Before You Pick Up is for people 18 and over. We don't knowingly collect data from anyone younger. If you think someone under 18 has given us data, email privacy@beforeyoupickup.com and we'll delete it.
Where data lives
On servers in the United States, with the providers listed above. If you use the site from somewhere else, your data is processed in the US.
Changes
The effective date at the top tells you when this was last changed. If we change something that matters, we'll say so on the site before it takes effect. Using the site after that means you accept the new version.
Contact
Anything about your data: privacy@beforeyoupickup.com. Everything else: hello@beforeyoupickup.com. There's also the terms and the community guidelines.