What Porch keeps, and why.

What we collect

On the website

If you join the waitlist or request a pilot invite, we collect your email address. On the waitlist, we also ask who would use Porch (for example, “My mom”), if you want to answer. We use it to email you about Porch.

Like any website, our hosting provider receives your IP address and browser details when you visit, and keeps request logs for a short time. When you send the waitlist or pilot form, it also checks that the request came from a person using a real browser, using details about that browser. Our social media icons are plain links, and those sites have their own policies.

The website uses Google Analytics to count visits and see which pages are useful. It sets cookies in your browser and tells Google which pages you visit, the site that sent you, and your browser and device. We use it only to understand the website, not for advertising, and the website doesn’t use advertising cookies.

In the Porch app

Porch has no usernames or passwords. A caregiver sets up a household with a private invitation, chooses a six-digit caregiver PIN, and invites family members. Your loved one’s Porch runs on an iPad or Android tablet, called their tablet below. To make that work, our server keeps:

• Household details. The household’s name, the name used for your loved one’s tablet, each person’s name as it’s entered, who is a caregiver, whether each device runs iOS or Android, and the settings you choose, such as drop-in permissions, ring time, and the language and announcement voice on your loved one’s tablet.
• Profile photos. A photo each person adds for themselves, or that a caregiver adds for them, if you choose to.
• Device sign-in details. A random identifier for each paired device and a secret that proves it belongs to your household. We store only a scrambled (hashed) form of that secret and of the caregiver PIN, never the PIN itself.
• Availability. When each device last checked in and whether it’s ready for calls, so Porch can show who is reachable.
• When someone was last at the tablet. Unless a caregiver turns this off, the last time someone pressed a key or touched your loved one’s tablet and, on an iPad, if a caregiver turns it on, the last time its camera saw a face close by. We keep only the latest time. Family members see that someone is at the tablet, or how long ago someone was, so they know whether to call. It doesn’t say who it was or how Porch noticed.
• Notification tokens. Addresses from Apple, or from Google for Android devices, that let us ring a family phone or tell it a message has arrived.
• Phone numbers. Numbers saved on the Porch keypad or for calling a regular phone, numbers a caregiver approves to call or drop in, and numbers a caregiver adds to a call, with the label they give it.
• Call history. For each call to or from your loved one’s tablet: who it was with (their name, or the phone number for a regular phone), voice or video, when it started, whether it was answered, missed or declined, and how long it lasted. Caregivers can see it with the caregiver PIN. We don’t record what was said.
• Messages. Audio and video messages that family members record for each other, including on your loved one’s tablet, with who sent them, when, and whether they’ve been played.
• Text messages to a Porch number. The sender’s number, the words, when it arrived, and how many pictures or other attachments came with it. We don’t keep the pictures or attachments themselves. See “When someone texts a Porch number” below.

Call audio and video travel live between devices through our calling provider. We don’t record calls.

When someone calls a Porch number

A household can have its own phone number that any phone can call. When someone calls it, we receive the caller’s phone number, unless it’s withheld, and whether their phone company verified it. If nobody answers and the caller leaves voicemail, we keep the recording and their number. A caregiver reviews it before it plays, unless it’s a verified call from a number on the keypad. If a caregiver blocks unknown callers, we keep a list of recently blocked numbers, with when and how often they called, so the caregiver can review them.

When someone texts a Porch number

The same phone number can receive text messages. We keep the sender’s number, the words, and how many pictures or other attachments came with it. A text from a number saved on the keypad, approved for phone drop-in, or allowed by a caregiver is shown on your loved one’s tablet and read aloud. A text from any other number waits until a caregiver reads it and lets it through or removes it. The sender’s number on a text isn’t checked with the phone company, so it can be faked.

If the words aren’t already in the language set on the tablet, we send them to Anthropic to translate them. The tablet then shows the translation, with the original underneath, and reads the translation aloud. A household that uses a natural voice also sends what the tablet reads, up to a short length, to ElevenLabs. On an iPad, longer readings, a reading in another language’s own voice, and every reading when the built-in voice is chosen, stay on the iPad.

If you join the pilot

Pilot families get Porch through Apple’s TestFlight or Google Play’s testing program. On iPhone and iPad, you send us the Apple Account email address for each device, so Apple can send it a TestFlight invitation. We use those addresses only for the pilot. TestFlight may also share with us information such as your name, the version you installed, and any feedback or crash reports, according to your TestFlight settings and Apple’s privacy policy. On Android, you join the test on Google Play, and Google’s privacy policy applies to what Google Play collects.

What stays on your device

• Noticing someone in front of an iPad. If a caregiver turns this on, your loved one’s iPad uses its camera to notice that a face is in view, so it can start waiting messages or let family know someone is there. This happens on the iPad. It doesn’t recognize who the person is, and no image is saved or sent anywhere. For family, only the time it last saw someone is sent.
• Contacts. When you pick someone from your contacts, Porch receives only that person’s name and phone numbers. It never reads your whole address book.
• Photos. When you choose a photo, Porch receives only that photo.
• Keypad and display settings. Contact buttons, photos on the keypad and display preferences stay on the device. The phone numbers on the Porch keypad are also sent to our server, so calls from those numbers are recognized.
• Built-in voices. When a household uses an iPad’s built-in voice, announcements and text messages are spoken on the iPad and nothing is sent to a speech service. A text in another language can still be sent for translation, as described above.

How we use it

• To run Porch: pair devices, ring and connect calls, deliver messages and voicemail, show and read text messages sent to a Porch number, send notifications, place and receive phone calls, and speak announcements.
• To keep it safe: check that requests come from your household’s devices, enforce caregiver permissions, and limit misuse, for example with caps on messages and phone calls.
• To find and fix problems, and to make Porch better.
• To contact you about the waitlist, the pilot, or important changes to Porch.

We don’t use your information for advertising, we don’t sell it, and we don’t share it for anyone else’s marketing. We don’t use your calls, messages or photos to train AI models.

Who we share it with

People in your household

People in a household see each other’s names, photos and whether they’re available. A message goes to the person it’s for, and a message for your loved one can be heard by whoever is near their tablet. Caregivers can see household settings and approved numbers, and can review messages, voicemail and text messages waiting for your loved one. A text for your loved one is read aloud, so anyone near the tablet can hear it. When Porch calls a regular phone, the person who answers sees a Porch phone number as the caller ID.

Service providers

We use these companies to run Porch. They handle information on our behalf, to provide their service to us. We choose providers whose terms limit them to that and require them to protect information at least as well as this policy describes.

LiveKit

Carries live call audio and video between devices, and connects Porch calls to the phone network.

Receives: Call audio and video as it happens, device and call identifiers, and the phone numbers on phone calls.

Twilio

Phone service for a household’s Porch number, for calling a regular phone, for adding a phone number to a call, and for receiving text messages sent to that number.

Receives: Phone numbers, call audio as it happens, voicemail recordings, and the text messages sent to the Porch number. We delete Twilio’s copy of each voicemail recording once we’ve saved it.

Vercel

Hosts the website and our server, and keeps messages, photos, announcement audio and readings of text messages in private storage.

Receives: Everything our server handles, including request logs with IP addresses.

Upstash

Database for household details, settings, the list of waiting messages, and the words of text messages sent to a Porch number.

Receives: The household details described above, including those text messages.

Apple

Delivers call and message notifications to iPhones and iPads through the Apple Push Notification service, and runs TestFlight.

Receives: Notification tokens, the caller’s name and call type for an incoming call, and a message sender’s name and length.

Google Firebase

Delivers call and message notifications to Android phones and tablets through Firebase Cloud Messaging.

Receives: Notification tokens, the caller’s name and call type for an incoming call, and a message sender’s name and length.

ElevenLabs

Turns short announcements, and text messages sent to a Porch number, into natural speech, when a household uses a natural voice.

Receives: The sentence to be spoken. For an announcement, that may include a family member’s name. For a text, the words the tablet reads, which are the message or its translation.

Anthropic

Translates a text message into the language set on the tablet, when the message isn’t already in that language.

Receives: The words of that text. Not the sender’s number or name.

MailerLite

Sends waitlist and pilot emails.

Receives: Your email address, and your waitlist answer if you give one.

Google Analytics

Counts visits to the website, so we can see which pages help people. It isn’t used in the Porch app.

Receives: The pages you visit, the site that sent you, browser and device details, and your IP address, which it uses to estimate your general location.

When the law requires it

We may disclose information if the law requires it, to protect someone’s safety, or to protect Porch from fraud or abuse. If Porch ever becomes part of another company, your information would stay protected by this policy, and we’d tell you before it was used in a different way.

How long we keep it

Messages waiting for your loved one

Until they’re played. Deleted after 7 days if nobody plays them.

Played messages

Kept 90 days so they can be replayed, then deleted.

Messages sent from your loved one’s tablet to family

90 days from when they were left.

Unsent or removed messages

Deleted right away.

Voicemail from phone callers

The same as other messages. Twilio’s copy is deleted as soon as we’ve saved it.

Text messages to a Porch number

Until they’re read, or a caregiver removes them. Deleted after 7 days if nobody reads them. A natural-voice reading is deleted with the text. We don’t keep the pictures or other attachments.

Someone who leaves or is removed

Their profile, photos, notification tokens and messages are deleted. We keep a small record that their device was removed, so it can’t reconnect.

Photos that are never saved

Deleted shortly after the upload expires.

Blocked callers

Up to the 30 most recent numbers, until a caregiver clears the list.

When someone was last at the tablet

Only the most recent time, which replaces the one before.

Call history

The 100 most recent calls, for up to 90 days, including calls with someone who was later removed.

Natural-voice announcements

Kept so each sentence is made only once, until the household is deleted.

Household details

While your household uses Porch. When you ask us to delete it, we delete its details, photos, messages and recordings within 30 days.

Waitlist and pilot email

Until you unsubscribe or ask us to remove it.

Website analytics

Up to 14 months in Google Analytics, then deleted.

Website and server request logs

A short time, for security and troubleshooting.

How we protect it

The app, the website and our server talk over encrypted connections. Call audio and video are encrypted on the way to and from our calling provider, but calls aren’t end-to-end encrypted: the provider’s servers handle them in order to route them. Calls to and from regular phones also travel over the telephone network.

Messages and photos are kept in private storage, which devices reach only through links that expire within an hour. Device secrets and the caregiver PIN are stored hashed. No system is perfectly secure, but we work to protect your information, and we’ll tell you as the law requires if a breach affects it.

Your choices

• Camera and microphone. Turn access on or off in your device’s Settings. On iPhone and iPad, voice calls never turn on the camera.
• Noticing someone in front of an iPad is off unless a caregiver turns it on, separately for starting messages and for telling family.
• Showing family when someone is at the tablet can be turned off by a caregiver. That deletes the last time we kept, and the tablet stops sending it.
• Drop-in works only for people a caregiver approves, and can be turned off at any time.
• Messages, voicemail and text messages to the Porch number can be turned off together by a caregiver.
• Announcements and text messages can use an iPad’s built-in voice, so nothing is sent to a speech service. A text in another language can still be sent for translation.
• Leaving. A family member can leave a household in the app, and a caregiver can remove anyone.
• Seeing or deleting your information. Email us to get a copy of your information, to correct it, or to delete a whole household.
• Waitlist emails. Use the unsubscribe link in any email.
• Website analytics. Block cookies for helloporch.store in your browser, or install Google’s Analytics opt-out add-on.

Depending on where you live, you may have rights to access, correct, delete or get a copy of your information, and to object to some uses. We honor these requests wherever you live, and we won’t treat you differently for making one. We don’t sell or share personal information as California law defines those terms.

Setting up Porch for someone else

Porch is often set up by a caregiver for a parent or loved one who doesn’t manage technology themselves. If you set up Porch for someone, please make sure you’re entitled to make these choices for them, and explain Porch to them in a way they can understand, including that people they approve can drop in, and that anyone with the Porch number can text it. A text from a number they haven’t allowed waits for a caregiver. Others are shown and read on the tablet. When you add other people’s phone numbers or photos, please add only what they’d be comfortable with.

Porch isn’t an emergency, medical or monitoring service. In an emergency, call 911 or your local emergency number.

Children

Porch isn’t made for children, and we don’t knowingly collect information from children under 13. Children can of course join a family call on a parent’s device. If you think a child has given us information, contact us and we’ll delete it.

Changes to this policy

When we change this policy, we’ll update the date at the top. If a change affects how we use information we already have, we’ll tell you in the app or by email before it takes effect. Porch is run from the United States, and our providers may process information wherever they operate.

Contact us

Questions, or a request to see or delete your information? Email privacy@helloporch.store. We’ll reply within 30 days.