Security & Privacy
Carrier Reveal is designed with privacy in mind. We don't store your raw phone numbers.
No Data Storage
We never save your phone numbers. Lookups are processed in real-time through secure APIs, and only hashes are stored locally in your browser for convenience.
SHA-256 Hashing
Phone numbers are hashed using SHA-256 before being stored in cookies. This ensures that even if cookies are intercepted, the original numbers cannot be recovered.
Secure Payments
All payments are handled by Stripe and PayPal—we never see or store your payment information. Your transactions are protected by industry-standard encryption.
HTTPS Encryption
All data transmitted between your browser and our servers is encrypted using HTTPS. Cookies are HttpOnly and Secure to prevent unauthorized access.
Privacy Practices
What we collect
- • Hashed phone numbers (SHA-256) stored in browser cookies for 90 days
- • Anonymous analytics data (page views, feature usage) via Firebase Analytics
- • Payment metadata (amounts, timestamps) via Stripe and PayPal
- • Contact emails you choose to send to Carrier Reveal
What we don't collect
- • Raw, unhashed phone numbers (we never store the original digits)
- • Credit card details (handled entirely by payment processors)
- • Personally identifiable information beyond what you voluntarily provide
- • Third-party tracking cookies or advertising identifiers
Data retention
- • Cookie hashes expire after 90 days of inactivity
- • Payment session tokens expire after 1 hour
- • Analytics data is aggregated and anonymized
- • Contact submissions are retained for support purposes only
Security Features
Cookie Security
- • HttpOnly flag prevents JavaScript access
- • Secure flag ensures HTTPS-only transmission
- • SameSite=Lax protects against CSRF attacks
- • Signed with HMAC-SHA256 to prevent tampering
API Security
- • Lookup tokens expire after single use
- • CORS policies restrict origin access
- • Rate limiting prevents abuse
- • Input validation on all endpoints
Payment Security
- • PCI DSS compliant via Stripe & PayPal
- • No card data touches our servers
- • Session tokens prevent replay attacks
- • Payment webhooks verify signatures
Infrastructure
- • HTTPS/TLS 1.3 for all connections
- • Regular security updates
- • Monitoring and alerting
- • Automated backups
Compliance
Carrier Reveal follows privacy-by-design principles and aligns with regional data protection requirements:
GDPR
Data minimization, purpose limitation, and right to erasure via cookie deletion.
CCPA
No sale of personal information; opt-out mechanisms available.
TCPA
Line-type detection helps ensure compliance with calling regulations.
Questions or concerns?
If you have security questions or want to report a vulnerability, email us at contact@carrierreveal.com.