Niner Privacy Policy

Effective date: October 8, 2026
Last updated: October 8, 2026

Niner is a push-to-talk walkie-talkie app for iPhone, with an optional Apple Watch companion. This Privacy Policy explains what information Niner collects, how it is used, who it is shared with, and the choices and rights you have. Niner is built privacy-first: we collect the minimum needed to run the service, we do not sell or rent your data, we run no advertising, and we use no analytics, tracking, or crash-reporting software development kits (SDKs).

1. Who we are

Niner ("Niner," "we," "us," or "our") is operated by Joseph Jacoby, an individual developer, who is the data controller for the purposes of the EU/UK General Data Protection Regulation (GDPR) and comparable laws.

• App: Niner for iPhone and its Apple Watch companion, bundle identifiers com.ninerapp.ios and com.ninerapp.ios.watchkitapp
• Website: https://ninerapp.com
• Contact: support@ninerapp.com
• Person responsible for privacy: Joseph Jacoby, reachable at support@ninerapp.com
• Governing jurisdiction: the Commonwealth of Virginia, United States
• Where Niner is available: the countries and regions where Apple offers Niner on the App Store

This policy applies to the Niner app for iPhone and Apple Watch and the backend services that power it, wherever you use them. It does not cover third-party services you reach through Niner that have their own privacy policies (for example, Apple's account and payment systems).

2. Scope and summary

Niner lets you create and join group push-to-talk channels and place direct one-to-one calls to other Niner users. To do this, we maintain a lightweight account profile for you, route real-time audio through our own audio server, and deliver push notifications.

A few things up front, because they define how Niner is built:

• We do not record or store your conversations. Push-to-talk and call audio is relayed in real time and is never recorded, transcribed, or saved on our servers. The only voice we store is the optional "hail" call tone you deliberately record (see Section 3.1).
• We do not log your calls. Our backend keeps no call history, call duration, or record of who called whom, when, or whether a call was answered. Your personal call log ("Recents") lives only on your device. We do store the connection between two people who have agreed to talk (see Section 3.9) — that is a permission, not a call record, and it says nothing about whether you ever spoke.
• We run no analytics, tracking, or crash-reporting SDKs. Firebase Analytics is explicitly disabled, and there is no Crashlytics, no advertising identifier (IDFA), and no third-party tracking software.
• We never sell or rent your data, and we do not use your contacts for marketing.

3. Information we collect

We only collect what the service needs to function. Specifically:

3.1 Account information

When you create a Niner account, we store a small profile in our database:

• Phone number (in E.164 format, e.g. +15551234567) and/or your Apple ID identifier, depending on how you sign in. Niner uses Firebase Authentication with phone-number verification (a one-time SMS code) and/or Sign in with Apple. If you use Sign in with Apple, you can choose to hide your email; we receive only what Apple passes to us.
• Call sign — your chosen, globally unique handle (e.g. ALPHA-7), plus a lowercase copy used for case-insensitive lookups.
• Name — first and last name. These may be pre-filled from your iPhone "My Info" contact card if you allow it (see Section 3.3), or entered manually.
• Email address (optional) — pre-filled from your "My Info" card or entered manually. Your email is not used as a login credential.
• Avatar image (optional) — if you choose to add one, it is stored in our cloud storage.
• Custom call tone ("hail") (optional) — a short voice clip you record so contacts hear you announce yourself when you call. It is stored in our cloud storage like your avatar, is played on the recipient's device with the incoming-call notification, and you can re-record or delete it at any time. It is deleted with your account.
• Acceptance timestamps — the times you accepted the Terms of Service and this Privacy Policy, and when you completed onboarding.

3.2 Group, contact, and invite information

• Groups (channels) you create or join — the group's name, call sign, optional description, optional logo, and the list of member user identifiers. Some of your profile fields (call sign and avatar) are copied into a group's member roster so the roster renders quickly for other members of that group.
• Your curated contact list — contacts you add inside Niner for direct calling, including the display name, phone number(s), and email(s) you save. This is separate from your iPhone address book, which we never upload (see Section 3.3). Your contact list is readable only by you.
• Invite codes — when you create a shareable invite link for a group, we store the code, the target group, its expiry, and usage limits.

3.3 Contacts access (matching only — never marketing)

With your permission, Niner accesses your iPhone "My Info" card (the Contacts profile card) to pre-fill your name, email, and photo during setup, so you don't have to type them. You can decline and enter these manually.

When you add a contact to your in-app contact list, Niner normalizes that contact's phone number(s) and checks whether the number matches an existing Niner user, so it can show you who is already reachable on Niner. Important limits on this:

• Niner never uploads, stores, or syncs your full iPhone address book.
• Phone numbers used for matching are normalized to E.164 and compared only against existing Niner user records.
• Contact phone numbers are never used for advertising or marketing, and are never shared with analytics, logging, or telemetry services.

3.4 Push notification tokens

To deliver notifications (an incoming direct call, a "X joined the channel" alert, a "X wants to talk" request, or a "your contact is on Niner" alert), we store:

• Your device's Apple Push Notification service (APNs) token.
• A short-lived push-to-talk token tied to a specific channel or call, which is deleted when you leave that channel or the call ends.

A legacy, unused Cloud Messaging token field may exist in your record for forward-compatibility but is not used in this version.

3.5 Direct calls (nothing stored on our servers)

When you place a direct call, our server creates a signed call ticket for that one call. The ticket contains only: a randomly generated call identifier, the two participants' user identifiers, and an expiry time. It is delivered only to the two participants' devices — to the caller in the response that starts the call, and to the recipient inside the incoming-call notification — and is presented back to our servers to authorize joining the audio session and to notify the other participant. Our servers verify the ticket in memory; it is never written to any database or log, so no record of the call exists on our servers during or after the call. The ticket expires one hour after the call is placed.

3.6 Minimal device and technical data

Niner accesses a small amount of device data through standard Apple APIs declared in our App Privacy manifest, used only for app functionality (for example, file timestamps, locally stored preferences via UserDefaults, and system uptime). We use no advertising identifier (IDFA) and no hardware serial numbers. We do not access location, health, or activity data.

If you choose a photo for your profile picture or a channel logo, that image is uploaded and stored so it can be shown to the people you talk to. We never scan or browse your photo library — iOS shows you a picker and hands us only the image you pick.

3.7 Subscription status (payments handled by Apple)

If Niner offers paid subscriptions, purchases are processed entirely by Apple through the App Store. We never receive or store your credit card, debit card, or other payment-instrument details. We may store a record of your subscription status (for example, the product, trial/active/expired state, and renewal date) derived from Apple's purchase receipts, solely to unlock features you've paid for. Manage or cancel subscriptions in iOS Settings → your Apple Account → Subscriptions.

3.8 On-device call history (never sent to us)

Niner keeps a local "Recents" log on your device of your recent calls (the other party's call sign and avatar, direction, answered/missed outcome, time, and connected duration). This log:

• Lives only on your device, in protected app storage;
• Is excluded from iCloud and device backups;
• Has user-configurable retention (15, 30, 60, or 90 days; default 30) and auto-expires;
• Can be disabled entirely or cleared by you at any time in Settings.

This call history is never transmitted to our servers, never backed up to the cloud, and never synced across devices.

3.9 Connections (who may call whom)

Before two people can call each other directly, both must have agreed to connect. We store that permission as a single record naming the two accounts, whether it is pending or active, which of you initiated it, and when it changed. It exists so that a stranger cannot call you, and it is what you remove when you disconnect from someone.

A connection is a permission, not a call log. It records that you may talk, never that you did, when, or for how long.

3.10 Safety reports

If you report a user or a channel, we store your report so we can act on it: who reported, what was reported, the reason you selected, any note you typed, and the time. For a reported channel we also record its name, call sign, member count, and the accounts that administer it, read from our own records at the time of the report rather than supplied by the reporter.

Reports are retained after the reporting or reported account is deleted. A report that vanished when its subject deleted their account would make abuse repeatable by deleting and signing up again. See Sections 8 and 12.

4. How we use information

We use the information above only to operate and secure Niner:

• Authenticate you and maintain your account (phone verification and/or Sign in with Apple).
• Provide core features — create/join channels, place direct calls, and display member rosters and contact lists.
• Match contacts you add against existing Niner users so you know who is reachable.
• Route real-time audio between participants during push-to-talk and calls (relayed, not recorded).
• Send functional push notifications (incoming calls, channel-join alerts, and talk requests), respecting your mute settings and blocks.
• Tell your contacts you joined. When you create a Niner account, people who already have your phone number saved in their device contacts may be sent a notification showing your call sign, so you can start talking. Only people who already had your number are told — Niner never discloses your number to them, and never contacts anyone who doesn't already have it. You can turn this off at any time in Settings → Privacy & Safety → Announce me to my contacts.
• Enforce uniqueness and abuse controls, such as globally unique call signs and invite-code expiry/usage limits.
• Manage entitlements if you subscribe.
• Comply with law and enforce our Terms of Service.

We do not profile you, target ads, or build behavioral analytics.

5. What we do NOT do

To be explicit:

• No advertising. Niner shows no ads and contains no ad SDKs.
• No selling or renting of your data. We do not sell, rent, or trade your personal information to data brokers, advertisers, or anyone else.
• No analytics, tracking, or crash-reporting SDKs. Firebase Analytics is disabled; there is no Crashlytics, Segment, Amplitude, Mixpanel, or comparable software. No tracking is enabled in our App Privacy manifest.
• No call-metadata logging. We do not store who called whom, when, for how long, or whether a call was answered.
• No audio recording. Push-to-talk and call audio is real-time only and is never recorded, transcribed, or stored.
• No cloud call history. Your call log stays on your device.
• No location, health, or advertising-identifier collection. (A profile picture or channel logo you deliberately choose is uploaded — see Section 3.6.)

6. Legal bases for processing (GDPR/UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to create your account and provide the core service you request (channels, calls, notifications, contact matching for contacts you add).
• Consent (Art. 6(1)(a)) — to access your iPhone "My Info" card and Contacts, your microphone, a photo you pick for your profile or a channel, Bluetooth (Niner button), and to send push notifications. You may withdraw consent at any time via iOS Settings; withdrawal does not affect prior processing.
• Legitimate interests (Art. 6(1)(f)) — to keep safety reports and a one-way record of phone numbers that have already used the free trial window, so that abuse and trial farming cannot be reset by deleting an account.
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse, enforce uniqueness of call signs, and maintain reliability, balanced against your rights.
• Legal obligation (Art. 6(1)(c)) — where we must process data to comply with applicable law.

We do not carry out automated decision-making that produces legal or similarly significant effects.

7. Sharing and sub-processors

We do not sell or share your personal information for advertising. We use a small number of service providers ("sub-processors") strictly to operate Niner. Each acts on our behalf under contractual data-protection terms:

Within a live audio session, the participants in that session can see each other's call sign and avatar (this is how a walkie-talkie shows who is talking). This information is visible only to people in the same session and is not retained as a log.

We may also disclose information if required by law (e.g., a valid legal request), to protect rights and safety, or in connection with a business transfer (such as a sale of the app), in which case we will require the recipient to honor this policy.

8. Data retention

We keep personal data only as long as needed for the purposes above:

• Account profile, groups, and in-app contacts — retained while your account is active. There is no automatic expiry; they are removed when you delete your account (see Section 11).
• Direct calls — never stored server-side; the signed call ticket that authorizes a call exists only on the two participants' devices and expires one hour after the call is placed.
• Invite codes — expire on their configured schedule (1–30 days; default 7) and once their usage limit is reached.
• Push tokens — retained until you sign out or revoke notification permission, then cleared.
• On-device call history — never reaches our servers; on your device it follows your chosen retention setting (15/30/60/90 days, default 30) and can be cleared or disabled by you.
• Connections — retained while the connection exists; removed when either person disconnects or deletes their account.
• Safety reports — retained indefinitely, including after the accounts involved are deleted, so that repeat abuse remains visible to us (see Section 3.10).
• Free-trial record — when your phone number is first used to claim the 72-hour free access window, we keep a one-way marker against that number permanently, so the window cannot be claimed again by deleting and re-registering. It records only that the number has been used and when; it is not linked to your profile after deletion.
• General default — where no specific period applies, we retain data no longer than 90 days after it is no longer needed, unless a longer period is required by law.

9. Security

We protect your information with industry-standard measures, including:

• Encryption in transit for app-to-backend communication and for real-time audio.
• Strict access rules on our database that isolate data per user — you can only access your own contacts, and your in-app contact list is visible to no one else. Direct calls are authorized by a signed, expiring ticket held only by the two participants — not by any database record.
• Server-authoritative validation — sensitive operations (e.g., syncing your verified phone number, issuing audio access tokens) are performed by server-side functions using your verified identity, never trusting raw client input.
• On-device protection — your local call history is stored with file-level encryption and excluded from backups.

No method of transmission or storage is perfectly secure, but we work to protect your data and to limit what we collect in the first place.

10. International data transfers

Niner is operated from the United States and is available in many countries. Our account and database systems are hosted in the United States (us-central1), so if you use Niner from another country, your information is transferred to and processed in the United States. Live audio is relayed through our audio servers in the United States or Belgium (see Section 7), and our service providers (Apple and Google) may also process data in other countries where they operate.

If you are located in the European Economic Area, the United Kingdom, Switzerland, or another region with cross-border transfer rules, these transfers are protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) contained in our providers' data processing terms. You may contact us at support@ninerapp.com for more information about these safeguards.

11. Your rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Access — request a copy of the data we hold about you.
• Correction — fix inaccurate or incomplete data (you can edit most profile fields directly in the app).
• Deletion — request that we delete your data (see Section 12).
• Portability — receive your data in a portable, machine-readable format.
• Objection / restriction — object to or restrict certain processing.
• Withdraw consent — for permission-based features (Contacts, microphone, Bluetooth, notifications) via iOS Settings, at any time.

For users in the EEA, the UK, and Switzerland: you also have the right to lodge a complaint with a data protection authority — in the EEA, the authority in the country where you live or work; in the UK, the Information Commissioner's Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).

For users in other countries: you may have similar rights under the law where you live. Contact us and we will respond as that law requires.

For California users (CCPA/CPRA): you have the right to know what personal information we collect and how it's used, to request deletion and correction, and to opt out of "sale" or "sharing" of personal information. Niner does not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we do not use it for cross-context behavioral advertising. We will not discriminate against you for exercising your rights.

To exercise any right, contact us at support@ninerapp.com. We will verify your request (typically by confirming control of the phone number or Apple ID on your account) and respond within the timeframe required by applicable law. You may use an authorized agent where the law permits.

12. Account deletion

You can delete your Niner account and associated profile data at any time, directly in the app — you do not need to email us, call us, or go through any support flow:

• Open Settings → Account, choose Delete Account, and confirm.

Deleting your account removes your profile, your in-app contact list, and your group memberships from our systems. Your on-device call history is removed when you delete the app or clear it in Settings, as it never resides on our servers. Some records may persist briefly in encrypted backups or where retention is legally required, after which they are deleted.

Two things deliberately survive deletion, and we would rather say so plainly:

• Safety reports involving your account are kept, so that deleting an account cannot erase a record of abuse.
• The free-trial marker against your phone number is kept, so the 72-hour free access window cannot be claimed again by deleting and re-registering. It is a one-way record that the number has been used; it carries nothing else about you.

If you signed in with Apple, deleting your account also revokes Niner's Sign in with Apple token, so the app no longer appears under your Apple ID.

For any other data-rights request — such as a copy of your data, a correction, or a deletion request you are unable to complete in the app — contact us at support@ninerapp.com (see Section 11).

13. Children

Niner is not directed to children. To use Niner you must be at least 13 years old in the United States, and at least 16 years old everywhere else — or older, if the law where you live requires it (see Section 1.2 of our Terms of Service).

We do not knowingly collect personal information from anyone under the minimum age that applies to them — including, in the United States, from children under 13, consistent with the U.S. Children's Online Privacy Protection Act (COPPA). If you believe someone under the applicable minimum age has provided us personal information, contact support@ninerapp.com and we will delete it. Niner's App Store age rating is 13+; where our minimum age is higher, the higher age applies.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will revise the "Effective date" above and, where appropriate, notify you in the app or ask you to re-accept. Your continued use of Niner after an update takes effect constitutes acceptance of the revised policy.

15. Contact us

Questions, requests, or complaints about this Privacy Policy or your data:

Joseph Jacoby — Niner
Email: support@ninerapp.com
Web: https://ninerapp.com

Niner is built so that your conversations stay yours: real-time audio that is never recorded, no record of who you talk to, and a call log that lives only on your phone.