Privacy policy
How Reachable handles your data, in plain words. Updated 12 October 2026.
- In short
- Who we are
- What stays on your phone
- What our server keeps
- What we never get
- Who helps us
- Legal basis
- Deleting everything
- Your rights
- Security
- This website
- Contact
In short
- Your password, your calls, your recordings and your contacts stay on your phone.
- Our server only keeps what it needs to sign you in at your provider and make your phone ring while the app is closed.
- The server is in the EU (Germany). No ads, no tracking, no analytics, no account with us.
- Want it all gone? Remove your account in the app. Or email us.
Who we are
Reachable is an app by A Brand New Company, Volume 88, 1446 WJ Purmerend, the Netherlands, Chamber of Commerce 88565548. We are responsible for the data our server processes. Questions? Email info@abn.company.
What stays on your phone
- Your password is stored encrypted in your phone's secure storage (the iPhone Keychain or the Android Keystore) and never goes to us.
- Recent calls, favourites and settings stay on your phone, outside your backup.
- Your contacts are read only on your phone, to put names to numbers or to pick a number. They go nowhere.
- Recordings are made by you, with a tap. They stay on your phone, outside iCloud and your backup, and are removed after 90 days by default. On iPhone the app writes a recording out and sums it up with your iPhone's own speech and language models; none of that goes to us or anyone else. A recording leaves your phone only when you share it.
- The microphone is used only during a call.
What our server keeps
Phones pause apps in the background. To still make yours ring, our server (r1.bereikbaar.abn.company) signs in at your provider for you. That is on by default for each account. If you switch our server off in that account's settings, the app sends nothing more to our server for that account and the data below is erased.
| What | Why | How long |
|---|---|---|
| Your SIP account: the username (often your phone number), your provider's domain and, if you fill them in, the server, port, transport and outbound proxy | To sign you in at your provider and receive your calls | As long as a phone of yours uses the account |
| An encrypted sign-in key. That is not your password but a value your phone derives from it in your provider's own way. It is sealed so that only our server can open it, and it works only at your provider | To stay signed in for you while the app is closed | As long as a phone of yours uses the account |
| Your phone: a random code the app makes itself, the kind of phone (iPhone or Android), the app's language and version, the push codes from Apple or Google, and a public key we use to encrypt push notifications | To wake your phone when a call comes in | Until you remove the account; deleted by itself after 30 days without contact |
| The name you gave the account (like Work) and whether it may ring on this phone | To ring the right phone | As long as you use the account |
| Numbers you block yourself (only if you do) | So a blocked caller does not make your phone ring | Until you unblock or remove the account |
| Calls without numbers: when a call came in, how it ended (answered, missed, blocked) and how quickly the push arrived | To tell you why you missed a call and to keep the service reliable | 30 days |
| Whether your account was signed in at your provider, and if not, why | For the reason under Not reachable in the app | 7 days |
| The number of new and old voicemail messages, if your provider sends it | For the count on your voicemail | Overwritten each time |
Our server uses your IP address to make the connection. To stop abuse (too many attempts) it keeps it briefly in its working memory; it never goes into the database or the logs. The server's logs hold no phone numbers and no IP addresses, only technical codes and how a call ended, and are erased after 7 days.
What we never get
- Your password. Only the derived sign-in key above.
- Your calls. The sound runs straight between your phone and your provider, never through our server.
- Who you call and who calls you. An incoming call passes our server on its way to your phone; the caller's number travels encrypted to your phone and is not kept. Outgoing calls pass our server to your provider, also without the number being kept.
- Recordings, transcripts, summaries, contacts and your list of recent calls.
- Data for ads or analytics. The app has no ads, no tracking and no analytics software, not from Google or Apple either.
Who helps us
- Hetzner Online GmbH (Germany) hosts our server in a data centre in Nuremberg. The data stays in the EU.
- Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) deliver the push notifications that wake your phone. Who is calling sits encrypted inside the notification, so they cannot read it.
- Your own provider receives your sign-in and your calls, as always. Their own privacy policy covers what they do.
- Vercel hosts this website.
We sell no data and give it to nobody else.
Legal basis
We process this data to provide the service you ask for: making your phone ring (GDPR Article 6(1)(b)). The IP address in working memory is used to stop abuse, our legitimate interest (GDPR Article 6(1)(f)).
Deleting everything
- Open the app and go to Settings.
- Tap your account and choose Remove account.
- The app erases the account from your phone and signs it off at our server. If this is the last phone with that account, our server erases everything about it and signs out at your provider.
Already deleted the app? Then our server erases your phone by itself after 30 days without contact, and then any account without a phone. Rather now? Email us your SIP username and your provider and we erase it within a week.
Your rights
You may ask which data we hold about you, have it corrected or erased, and object. Email info@abn.company. If you are not happy with how we handle that, you can complain to the Autoriteit Persoonsgegevens.
Reachable is made for people with their own SIP account. We do not knowingly collect data from children.
Security
Everything between the app and our server goes over TLS. The sign-in key and the push contents are encrypted with HPKE (RFC 9180), so only the intended receiver can open them. Calls are encrypted with TLS and SRTP when your provider supports it. Only we have access to the server.
This website
This website uses no cookies, no analytics and no scripts from others. The host keeps standard technical logs (such as IP addresses) for security.
Contact
A Brand New Company, Volume 88, 1446 WJ Purmerend, the Netherlands. info@abn.company. If this policy changes, the new version appears here with a new date. Version of 12 October 2026.