How we handle your phone number
What we store
Of your phone number we keep only a keyed fingerprint (HMAC-SHA256). Beyond that: your country code, your wishlists and, if you choose to add them, your name and birthday. Nothing else.
Why a plain hash is not enough
Hashing is often presented as anonymisation, but for phone numbers that is an illusion. A Dutch mobile number is 06 plus eight digits: about a hundred million possibilities. A laptop tries them all in a few seconds and has thereby reversed every plain hash. So we use a keyed hash instead: HMAC-SHA256 with a secret key that exists only on our servers and is deliberately kept separate from the database. Without that key the fingerprint cannot be reversed, no matter how much computing power you throw at it.
How contact matching works
When you look for contacts, the app sends numbers from your address book to our server over an encrypted connection. There they are normalised and hashed in memory, compared against the fingerprints of existing users, and forgotten immediately afterwards. The numbers themselves are never stored and never end up in log files.
SMS verification
To deliver your login code, the server holds your number in memory for at most fifteen minutes, and our SMS provider receives it to deliver the message. After that, only the fingerprint remains. Our own logs never contain a number either, at most the fingerprint.
Honest about the limits
If someone obtained both our database and the secret key, numbers could still be recovered. That is exactly why we keep the two separate. We don't promise magic; we promise careful engineering and honesty about what it can and cannot do.
Deleting your account
If you delete your account, your data, wishlists and images are removed from our servers.