GistMe
DRAFT — effective on publication · Drafted 1 October 2026
GistMe is a voice-calling app for one-to-one calls, designed to work on weak and expensive connections, published by Apex Root Solutions LLC. This policy describes what the app and its servers actually do with your information.
The short version. We do not record or store your calls. Call audio travels directly between the two phones, or through a relay that only forwards encrypted data. We never read your address book, location or advertising ID. We keep an account (username, display name), your contacts and a short call log so the app works. There is no advertising and no third-party analytics.
GistMe is published by Apex Root Solutions LLC ("we", "us"), a limited liability company organised under the laws of the State of Delaware, with its registered office in Wilmington, New Castle County, Delaware, and its principal place of business in Cedar Hill, Dallas County, Texas. We are the controller of the personal data described here. Contact: support@apsoluts.com.
| Data | Why | Kept |
|---|---|---|
| Username, display name, password (stored only as an Argon2id hash), recovery code (stored only as a hash) | To run your account and sign you in | Until you delete the account |
| Contacts, contact requests, invite links, blocks | Calls are allowed only between people who are contacts; blocks stop unwanted calls | Until removed or the account is deleted |
| Call log: who, when, how long, outcome (completed, missed, declined…), audio mode | To show your history and missed calls, and to prevent abuse | 90 days, then deleted. You can delete entries earlier. |
| Device name and platform, refresh-token hash, last-used time, push token | To keep you signed in on each device and to wake your phone for an incoming call | Until you sign out of that device or delete the account |
| Network addresses (IP) when you connect | To deliver signaling and relayed media, enforce rate limits and stop abuse. The relay also sees addresses; relayed calls hide each person's IP from the other. | Operational logs, truncated, up to 30 days |
| Reports you file or that are filed about you (reason, optional note, call metadata), and our record of any action taken on them (such as an account suspension and its reason) | To act on abuse and to keep an audit trail of our own actions | 365 days |
| Optional call-quality summary (relayed or direct, setup time, average delay, loss %, platform) | To improve reliability. Off by default; only sent if you turn it on in Settings. | 30 days |
When you delete your account (Settings → Account → Delete account), your account, devices, push tokens, contacts, requests, invite links and blocks are deleted immediately. Calls you took part in stay in the other person's call log (for up to 90 days) as "Deleted user", no longer linked to any account, and reports filed by or about you are kept unlinked for up to 365 days. Backups: we keep encrypted database backups for up to 30 days, so deleted data can remain in a backup for up to 30 days after deletion. If we ever have to restore from a backup, accounts deleted after it was taken would come back with it; we delete them again as soon as we can.
Call setup messages (who is calling, connection details) go to our servers over an encrypted connection. Audio is encrypted with DTLS-SRTP and sent directly to the other phone when possible; otherwise it passes through a relay server that forwards encrypted data it cannot decrypt. When a call is direct, the other person's phone can learn your IP address; turn on Always relay my calls in Settings to prevent that.
The encryption protects call audio between the two phones. Because the connection details that authenticate the two phones pass through our servers, GistMe does not claim end-to-end encryption with verified identities. You can compare the security code shown during the call with the other person to confirm that nobody is in the middle.
We do not sell personal data.
Connections use TLS; credentials are held in the iOS Keychain or Android Keystore; passwords are hashed with Argon2id; we rate-limit sign-in, lookups, invites and call attempts. No system is perfectly secure.
Lost password: because we do not collect an email address or phone number, a lost password and lost recovery code cannot be recovered. Keep your recovery code safe.
GistMe is not directed to children under 13 and we do not knowingly collect their information. Do not use GistMe if you are under 13 (or the minimum age in your country).
Calls use your Wi-Fi or mobile data. GistMe is designed to use little data but cannot make calls without an internet connection. The app shows an estimate of each call's data use and explains how it is measured.
If we change this policy in a way that matters, we will tell you in the app before it takes effect.