Privacy Policy

Last updated: October 28, 2026

This policy covers three things: this website (OwnPBX.org), the My Phone Android app, and accounts on a PBX server. Each section starts with a short plain-language note, then the full detail. If the plain note and the detail ever disagree, the detail wins — but they are written to say the same thing.

Contents

1. What we collect

In plain language: this website collects almost nothing. The app collects nothing for us — it talks to your PBX server, and whatever is on that server is the account data described below.

This website

OwnPBX.org is a static site. It sets no tracking cookies, runs no analytics, and loads no advertising or third-party trackers. When you visit, the hosting provider necessarily sees the usual connection details (your IP address and the page you asked for) in its server logs, the same as any website. We do not use those logs to identify or profile visitors.

The My Phone app

The app communicates only with the PBX server you sign into. It does not send your calls, texts, voicemail, contacts, or recordings to OwnPBX.org, to Google, or to any analytics or advertising company. The app reads no data from your phone's address book, call log, or message store: the contacts, history, and messages it shows come from your PBX server. The microphone is used only while you are on a call, using push-to-talk, or recording a voicemail greeting. The camera is used only to scan a pairing QR code.

Your PBX account

When a PBX administrator creates an account for you, the server stores what that account needs to work: your extension number, your name and contact details as entered by the administrator, your messages (SMS and MMS), voicemail messages and greetings, call detail records (CDR — who called whom, when, and for how long), call recordings (where recording is enabled), faxes, contacts, and your settings. Sign-in lasts 60 days after last use; after that you sign in again.

2. What we never collect

In plain language: if it could be used to advertise to you or track you across the internet, we don't have it.

Your calls and texts necessarily pass through your telephone carrier to reach the other party — that is how telephone calls work. Passing a call to a carrier to complete it is service delivery, not a sale of your data.

3. Where your data lives

In plain language: there is no central OwnPBX cloud holding your calls and texts. Your data lives on the PBX server you use, and whoever runs that server is the one responsible for it.

OwnPBX is software you (or your administrator) run on a server you control. If you use a PBX run by the OwnPBX project operator, that operator is responsible for the data on that server, and the request processes in sections 5 and 6 apply to it. If you run your own PBX, or use someone else's, that server's administrator is responsible — this policy still describes what the software does, but deletion and download requests go to that administrator, not to OwnPBX.org.

4. California privacy rights (CCPA/CPRA)

In plain language: California law gives you the right to know what we have about you, to have it deleted, to have it corrected, and to be treated the same whether or not you exercise those rights.

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), California residents have the right to:

We will confirm a verifiable request within 10 business days and complete it within 45 days. If a request is complex, we may take up to 45 additional days, but never more than 90 days in total — and we will tell you if we need the extra time. A request is "verifiable" when it comes from the account's email address or otherwise proves you control the account; this is to stop someone else deleting or downloading your data.

5. Request deletion of your account

In plain language: you can ask for your account and everything on it to be deleted, and it will be done within 90 days. Here is exactly how to ask.

To request deletion of your account and the personal information on it, use any of these channels:

What happens next: the administrator verifies the request, then deletes the account and its personal information — messages, voicemail, recordings, faxes, contacts, and call records — within 90 days of the verified request. The only exceptions are items that must be kept for legal, security, or billing reasons (for example, an invoice already issued); if anything is kept for such a reason, we will tell you what and why. Deleting your account does not delete messages or recordings already delivered to other people.

6. Request a download of your data

In plain language: you can ask for a copy of everything on your account, and it will be emailed to you so you can download it.

To request a copy of the data on your account, use the same channels as deletion: the account portal at myaccount.ownpbx.org/ucp/delete (once live), email to support@bearermail.com from your account's email address with the subject "Download my data", or post to PO Box 1357, Lindsay, CA 93247.

Your export includes whatever is currently on the account: voicemails, SMS and MMS messages, other messages, call detail records (CDR), contacts, call recordings, and faxes. The export is prepared and emailed to the email address on your account for download, within 90 days of the verified request (and normally much sooner). Keep that email address current — it is the only way the export can reach you. If a file is too large to email, the administrator will arrange another secure delivery and tell you how.

7. Security and retention

PBX accounts are protected by password sign-in with an optional second factor, and app sign-in uses a pairing code plus a PIN you choose. Server access is restricted to the administrator. No system is perfectly secure; if you believe your account has been compromised, contact the administrator immediately so the account can be locked and its credentials rotated.

We keep account data only while the account exists and is needed to provide the service, plus any legally required retention described in section 5. Deleted data is removed from the live server; backups, if any, age out on their normal cycle and are not used to restore deleted accounts.

8. Children

OwnPBX accounts are created by an administrator for authorized users only. The service is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child's information has been provided, contact us and it will be deleted.

9. Changes to this policy

If this policy changes in a way that affects your rights, the new version will be posted here with a new "Last updated" date, and account holders will be told through the account portal or by email. Continued use of the service after a change means you accept the new policy.

10. Contact

For privacy questions, deletion requests, or data download requests:

11. Non-affiliation

OwnPBX is an independent open-source project. It is not affiliated with, endorsed by, or sponsored by Google LLC, any mobile carrier, or any phone manufacturer. Google Play and Android are trademarks of Google LLC. Nothing on this site or in the app implies an affiliation with those companies.