The short version, and the rest of this document is the long version of exactly this:
phonebook.directory is operated by Phonebook Directory LLC, an Ohio limited liability company, 6545 Market Ave. North STE 100, Canton, OH 44721. In this document, “we” and “us” mean that company, and “you” means the person or organization using the service. phonebook.directory is for people and organizations in the United States and Canada.
phonebook.directory holds only information people give us directly. We do not purchase, scrape, or import data about anyone from any other source, and no listing exists until the person or organization it belongs to creates it. If you have never signed up, we hold nothing about you beyond what you send us yourself, such as an email or a bug report, and the short-lived security records described under “Account security”.
An email address, a password, and a phone number, for both personal and organization accounts. Personal accounts also give a date of birth, which is used only to confirm you are old enough to join and to buy a plan (18, or 19 in some provinces and territories) and is never displayed to anyone.
Personal accounts also record the time zone your device is set to when you sign up (for example, America/New_York), read from your browser, so that times can be shown in yours. It is never shown to anyone.
Personal accounts also give a legal first and last name, and may add a middle name. The name your listing shows is built from it, and your last name always appears; a middle name shows only as you choose, in full, as initials or not at all. It isn’t sent for the identity check, which compares your first and last name. Your legal name can’t be changed from your settings once saved; to correct it, write to privacy@phonebook.directory.
Verifying your phone number is a required step of signing up. Until it is done, no part of the service is reachable. Your email address is verified separately, by a confirmation link. You sign in with your email address and password. If you turn on two-step sign-in in your settings, signing in also takes a one-time code we text to your verified phone, after your password. Changing either requires your current password first, and the old one keeps working until the new one is independently verified, so a change cannot lock you out.
The phone number on your account is a security credential. It is a different thing from a phone number you may choose to add as a field on your listing, which is unverified, freely editable, and subject to the same visibility settings as every other field.
When you sign up, we record when you agreed to the Terms of Service and this policy, and the version of each. When we email you a notice of a change to either, we keep a record of when it was sent and to which address. Both records are erased with your account.
The only texts we send are one-time codes you ask for: when you sign up, when you change the phone number on your account, and when you sign in, if you have turned on two-step sign-in. One message each time you ask for a code. Message and data rates may apply. Reply STOP to opt out and HELP for help. The full terms are in our Text Message Terms.
If you ask us to call instead, or your number is a home phone, we call it and a recorded voice reads the code. We make no other calls. Press 9 during the call, or write to support@phonebook.directory, and we won’t call or text that number again.
Your mobile number and your consent to receive these texts are not shared with, sold to, or used by any third party or affiliate for marketing or promotional purposes. Twilio, listed below, receives your number only to deliver the code, by text or by call, and to tell us what kind of line it is (below).
If you ask us to stop texting or calling a number, we keep a one-way code made from it (the number can’t be read back from it) and its last four digits, so we never text or call it again. We keep them until you ask us to remove them.
You can optionally verify your identity through Didit, a third-party identity-verification provider, which adds a “Verified” badge to your listing. This is free and optional, except that members in Tennessee and Mississippi must verify their age before their listing goes live, and a personal account on an internet phone number must verify its identity (both below). Otherwise an unverified listing is not restricted in any way. Your identity documents go to Didit, not to us. Didit tells us the outcome, along with the details it read from your ID (such as your name and date of birth); we keep only the outcome and discard the rest. How Didit handles your face data, and when it is deleted, is in our Biometric data policy.
Organization verification opens in stages and isn’t available yet. When it is, nonprofit, religious and community-group organizations verify through Didit, and businesses and organizations listed as “Other” through a separate provider, Middesk, which checks business registrations. Government organizations cannot be verified yet. An organization applying gives us its registration number. Through Didit, it is the person applying on the organization’s behalf whose identity is checked. Until Middesk is connected, we check a business’s registration ourselves.
A badge confirms that a real identity check was completed at that time. It is not an ongoing guarantee about who is using an account today.
To follow state age-verification laws, we use the state you give us, your phone number’s area code, and the state your connection appears to come from when you sign up. We use the connection’s state only at that moment and don’t keep it.
When you sign up for a personal account, or change the number on one that isn’t verified, we ask Twilio what kind of line your phone number is. If it is an internet number (such as Google Voice or TextNow, a toll-free number, or any number that isn’t a mobile or home phone), your listing is hidden, and you can’t contact anyone, until Didit verifies your identity. If that hasn’t happened within 30 days of signing up, the account is deleted; signing in within the 30 days after that restores it, with 7 more days to verify. We use Twilio’s answer only for this, at that moment, and don’t keep it. For any account, if the number is a home phone, we call it with the code instead. The same identity check applies when you sign up with a number that’s already on another account. If your number was verified by a call, we note that, so later codes are called too.
Whatever you choose to add: a display name, and any of a bio, aliases or nicknames, phone numbers, email addresses, a home address, a general non-precise location, links to sites and social accounts, messaging-app handles, custom fields you define yourself, and photos, which your browser strips of the location data a camera adds before they are uploaded. Each carries its own visibility setting.
A home address is always private. It cannot be set to Public or Connections, and it cannot be included in a bulk sharing template or granted to a tag or directory. This is enforced in the database, not only in the interface.
Connection requests including the optional short message attached to one, messages you send and receive, tags you privately apply to your own connections, invites you generate, blocks you place, and reports you file or that are filed about you. We do not tell a listing who reported it. We also hold the listings you save to your phonebook, the private notes you keep on them, your privacy templates, the member directories you belong to, and, for an organization, its roster and who holds its linked-account and backup-contact roles.
If you report a bug, we keep what you write, the page you were on, your browser’s description, and your account if you were signed in. We email the report to ourselves, with your name and email address if you were signed in, and delete it a year after you file it.
If you ask us to remove an intimate image, we keep your request: your name, how to reach you, the listing, your statement and, if you act for someone, their name. We use it only to act on the request and as a record, and delete it a year after the request is closed.
We do not log what you search for. The names you search for are never recorded or attributed to you or to the person searched for. To stop anyone copying the directory, we count how many searches and listing pages come from each network address, and how many listing pages each signed-in account opens, in a few minutes; that count holds no names and is deleted within 48 hours. The names you search for are never put in a web address, so they do not appear in our hosting provider’s request logs either.
So you can see which devices are signed in and end sessions you do not recognize, we keep the description your browser gives of itself (the browser, its version and the operating system) and sign-in and last-active times. A sign-in lasts 30 days, and its record is deleted 30 days after that. No location of any kind is recorded with a session. Only you ever see your own sessions.
To stop abuse, we record the network (IP) address of sign-ins, signups, searches, code requests and similar actions, and a failed sign-in is recorded with the email address that was typed, so repeated guessing can be stopped. Both are deleted after 48 hours.
When an organization listing is opened, appears in search or browse results, or has one of its buttons tapped (Call, Text, Email, Directions, its website or another link), we add one to a monthly count for that listing, and for a tap, for that button. To count each visitor once a day, we briefly keep a one-way code made with a secret key from the visitor’s account if they’re signed in, or their network address if not, with the date, the listing and what was counted. It can’t be turned back into the account or the address, is different for every listing, every count and every day, and is deleted within three days. Apart from that, the count is the only thing written, and there is no way to reconstruct who contributed to it. A tap is counted by your browser telling us which button was tapped; the link itself goes where it always did, and we don’t learn whether a call or visit followed. Organizations on a paid plan can see their own counts. Nobody else can, and an organization’s own visits, searches and taps don’t count. These counts are kept only for organization listings, never for a person’s.
An organization on a paid plan can also see how many phonebooks its listing is in now. Below 5 it sees only “fewer than 5”, and never whose phonebooks they are.
If you are in an organization’s Member Directory, we note when you last changed your listing, and keep it for 31 days. The organization sees only how many of the directory’s members changed their listing in the last 30 days, “fewer than 5” below 5, and never which members. The time is in your data export and is erased with your account.
We do not collect your location automatically, with one exception: at signup, when you start an identity check, and at checkout, we use the state or province your connection appears to come from, to follow Tennessee’s and Mississippi’s age laws, the age of majority in each province, and Quebec’s rules, since we don’t serve Quebec yet. We use it only at that moment and don’t keep it. The only location we hold is one you type yourself, such as the optional city on your listing. Browse offers a “Use my location” button; if you press it, your browser asks your permission, and the distances it shows are calculated on your device. Your location is never sent to us or to anyone else. If you type a city or ZIP code into the “near” box, that text is sent to Mapbox to find it on a map. It is never put in a web address and we do not store it; your browser keeps it until you close it, so the results stay sorted as you page through them. Organizations that publish a street address have it located the same way when they save it.
Paid features go through Stripe’s own hosted checkout page. Card details go directly to Stripe and never reach our servers. We keep a record that a payment was made and what it was for. Stripe’s page also asks for your billing address, which Stripe uses to work out any sales tax, and lets an organization add its GST/HST number.
Every field is set to one of three levels, which you control:
Beyond those three, you can grant a field to a tag or a member directory, and you can revoke one specific person’s access to one specific field without changing the broader setting it otherwise falls under. A revocation always wins over a grant.
Your name, the year you joined, whether you’re verified, and the fact that you have a listing, are visible to anyone searching for you by name. That is what makes a directory a directory. Nothing else is shown unless you choose to show it. In rare cases, for someone’s safety, we can take a listing out of search. It still works for its owner and their connections, and a link to it still opens. We ask search engines such as Google not to show people’s listings, so people are found by searching here. Organizations’ listings can appear in search engines.
If an organization invites you to a private member directory and you accept, other members of that directory can see whatever you have chosen to share with them. Joining creates no connection with the organization or with any other member, and changes nothing about what anyone outside the directory can see. You can leave at any time, and the organization can remove you. An organization can also share one of its own fields with a directory it owns.
We do not sell your personal information, and we do not share it for advertising. We share it only with the providers needed to run the service, and only what each one needs:
Text messages and your phone number. Your mobile information is not shared with third parties or affiliates for marketing or promotional purposes, and it never will be. Your text-message opt-in and the consent behind it are not shared with anyone. Twilio receives your number only to deliver the code you asked for and, when an account signs up or changes its number, to tell us what kind of line it is.
We do not sell personal information, and we do not share it for advertising or lead generation.
We don’t track you across other websites, and we don’t let advertisers or data brokers do so. We count how parts of the site are used, as daily totals only: how many searches were run, how many listings were opened, and the like. A count holds no account, no network address and nothing that follows you; it uses no cookies and builds no profile of anyone. Because nothing here follows you from site to site, a browser’s “Do Not Track” signal has nothing here to turn off. Payments are completed on Stripe’s own checkout page, under Stripe’s privacy policy.
Cookies. We use cookies only to keep you signed in, to hold your place for a few minutes while you finish signing in, to remember a place you searched near, and to remember whether you chose a light or dark look. None follows you to other websites.
We may also disclose information where we are legally required to. We verify that a request is genuine before acting on it.
If an image here shows a child sexually, we report it, with the account that posted it, to the National Center for Missing & Exploited Children, as the law requires.
Our providers keep and use your information in these countries:
Information kept in the United States can be reached by its courts, police and national security agencies under US law. Questions about where your information is kept go to privacy@phonebook.directory.
Organization listings have these same rights, exercised through the organization’s own account.
If you are a California resident, the CCPA and CPRA give you rights to know what we hold, to request deletion, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined, so there is nothing to opt out of; the other rights are exercised through the export and deletion tools in your account settings. We give everyone the same rights, wherever they live, rather than only where a particular law requires them: export, correction, deletion, and the removal of one person’s access to one field.
If we turn down a request about your information, reply to ask us to reconsider. If we still say no, you can contact your state’s attorney general or, in Canada, the Privacy Commissioner.
A few decisions are made automatically: whether an identity check passes (by Didit), whether a phone number is an internet number (by Twilio), whether a name or other words on a listing break our House Rules, and whether a photo is refused by our filters. If one affects you, you can ask what information was used and why, have it corrected, and have a person review the decision. Write to privacy@phonebook.directory.
Your listing and account data are kept while your account exists.
A device’s notification address is kept until notifications are turned off on that device, the device is signed out, or the browser tells us the address no longer works.
When you delete your account, your listing disappears from search and from everyone's view immediately, every session ends, and any paid plan is canceled. For the next 30 days you can change your mind: signing in restores the account, unless its email address or phone number has since been used for a new account. A canceled paid plan is not restored.
After 30 days we permanently erase it: your email address, phone number, date of birth, password, photo, every field on your listing, your Connections on both sides, and your tags, notes, privacy templates, blocks, invites and settings. Copies may remain in our database backups for up to 7 more days, and photos in our photo backups for up to 3 weeks, after which they are gone.
What we keep after that, and why:
A photo removed because of a takedown is kept out of view for 180 days so an appeal can look at it, then deleted unless the appeal restores it. Erasing the account deletes it at the same time. When we remove an intimate image on request, we keep a fingerprint of it, a short code the image cannot be rebuilt from, to stop the same image being posted here again.
Words the House Rules check refused are kept 90 days, so a person can look at them if you tell us the decision is wrong, and until that is decided; a year if they were refused under rule 1. When we decide refused words were fine, we keep a record of that for a year, so they are not refused again.
If we closed your account for breaking our Terms, it cannot be restored. When it is erased, we keep a one-way, keyed fingerprint of its phone number and email address — never the number or address itself — used only to stop them opening a new account.
Organization listing counters are aggregate monthly numbers with no individual events behind them.
You must be 18 or older to create an account, or 19 in British Columbia, New Brunswick, Nova Scotia, Newfoundland and Labrador and the three territories. We ask for your date of birth at signup and refuse the signup if it shows you are under that age. If we later learn that an account belongs to someone under 18, we close it.
We will post any change here with a new date, and for changes that materially affect what we collect or who can see it, we will notify you by email to your verified address at least 30 days before the change takes effect. Small corrections that do not change what we collect or who can see it, such as a typo or updated contact details, take effect when posted.
Privacy questions and requests: privacy@phonebook.directory
Report an image or content to be taken down: takedown@phonebook.directory
Account help: support@phonebook.directory
Appeal a suspension or closure: appeals@phonebook.directory
Our privacy officer, the person responsible for protecting your personal information, is the founder of Phonebook Directory LLC. Write to privacy@phonebook.directory.
We read every message sent to these addresses.
phonebook.directory is in beta. These documents will change before general availability, and we will tell you when they do rather than changing them quietly; see the section on changes.