Privacy Policy

Name: Meow
Author: qFiber LTD

Last updated: 31 October 2026

This policy explains how qFiber LTD processes personal data when you use Meow, our SIP softphone for desktop, the Meow phone app, and the meow.qfiber.co.il website. It is written to meet the EU General Data Protection Regulation (GDPR), which applies to us when we offer Meow to people in the European Union, and Israel's Protection of Privacy Law, 5741-1981, which applies to us as an Israeli company.

1Who we are

The controller responsible for your personal data is:

qFiber LTD

Israeli company number 516859592

75 Ein Al-Luza, Silwan, Jerusalem, Israel

Email: [email protected]

We have not appointed a data protection officer; [email protected] reaches the people responsible for data protection at qFiber.

2In short

Your calls, contacts, contact pictures, call history, recordings and SIP passwords stay on your computer or phone, and we never receive them unless you send them to us yourself, for example in a support request or an extended log. The one exception is a phone setup code: if an administrator puts a SIP account in it, that account, password included, is stored encrypted on our server only until the code is used, revoked or expires; then only its SIP server and extension stay (section 3).
On a phone, Meow reads your contacts on the phone to show who is calling, and never uploads them. To ring the app while it is closed, the caller's number and name pass through our server and Google's push service, without being stored.
Crash reports and extended logs from the phone app stay on your phone, and reach us only if you send them to us by email from Get support.
To license the app we need your license key and a hashed fingerprint of your device.
To sell you a license we need your name and email; your card details go to our payment provider, Cardcom.
The app's usage heartbeat and this website's analytics only run if you say yes, and you can take that back at any time.
We keep data only as long as the table in section 8 says, and a daily job deletes it after that.
We do not sell personal data, and we do not use it for advertising.

3What we process, why, and on which basis

Every activity below lists the data involved, the purpose, and the legal basis under Article 6 GDPR.

Licensing (the app)

Data: License key; a device fingerprint (a SHA-256 hash of your CPU model, RAM size, network adapter MAC address and machine ID); the app version; a public key the app generates to sign its requests; when the device was activated and when it last checked its license; your IP address while the request is handled.
Purpose: To activate and validate your license or trial, to limit a license to the number of devices it covers, and to count the devices in use on licenses sold through a reseller, who is billed for them.
Legal basis: Performance of our contract with you, or steps you asked for before one (Art. 6(1)(b)). Reading these device details is strictly necessary for the licensing you requested.

Setting up the phone app (setup codes)

Data: A one-time setup code and its QR code, stored encrypted; the SIP account it carries (server, username, password), stored encrypted; the license it belongs to; who created it and when it expires. When the phone uses it: a device ID and a public key the app generates to sign its requests, and, from the code's SIP account, the SIP server and the extension (its username), kept for that device on its license. The password is never kept.
Purpose: To set up Meow on a phone in one step, with its license and, usually, its SIP account. The code and the SIP account are deleted as soon as the code is used, revoked or expires, except the SIP server and extension, which we keep so that only the phone that used the code can receive incoming-call pushes for that extension (see the next activity).
Legal basis: Performance of our contract with you (Art. 6(1)(b)).

Ringing the phone app for calls (push)

Data: The phone's push token from Google Firebase Cloud Messaging, stored encrypted; a device ID; the app and Android versions; the SIP server and extension, which must be ones kept from the phone's own setup code; the license. For your phone system, the push token it uses to reach our server, which belongs to a customer or a license. For each incoming call, the caller's number and display name and a one-time call token, which your phone system sends through our server to Google and which we do not store.
Purpose: To make the phone ring when a call arrives while Meow is closed, so it does not have to stay connected and drain the battery. A phone can register only for a SIP server and extension kept from its own setup code, and a phone system's token rings only phones on the licenses of the customer or license that owns it, so no one can receive pushes for an extension that is not theirs.
Legal basis: Performance of our contract with you (Art. 6(1)(b)).

Free trial abuse prevention

Data: The trial start date, a trial key, and the same four hardware details, each hashed separately.
Purpose: So a free trial cannot be restarted on the same machine.
Legal basis: Our legitimate interest in offering a trial that is not endlessly repeatable (Art. 6(1)(f)).

Purchases

Data: Name, email address, plan, amount, the payment transaction ID, the license key issued, the country you tell us you live in, the country your connection comes from, and the country that issued your card. Buyers in Israel and the Palestinian territories also give an ID or company number for the tax invoice. Your card number, expiry date and security code go only to our payment provider, Cardcom, and never reach us.
Purpose: To take payment, issue your license, charge the right VAT, and keep the accounting records the law requires. Israeli VAT applies to buyers in Israel and the Palestinian territories and not to anyone else, so we check that the card comes from the same region as the country you chose, and we keep the three countries as the record of why VAT was or was not charged. The ID or company number is stored encrypted only until your invoice is issued, then deleted; the invoice itself keeps it, as the law requires. To manage your licenses yourself, you enter your purchase email and a license key, and we email a single-use sign-in link to that address. We store only a hash of the link, when it expires and is used, and the IP address it was requested from.
Legal basis: Contract (Art. 6(1)(b)); our legal obligations under Israeli tax and bookkeeping law (Art. 6(1)(c)).

Emails

Data: Your email address, and a log of what we sent you (subject, type, delivery status).
Purpose: To send your license, expiry reminders and support replies, and to know whether they arrived.
Legal basis: Contract (Art. 6(1)(b)); the delivery log is our legitimate interest in knowing an email reached you (Art. 6(1)(f)).

Support, contact forms and bug reports

Data: Name, email, your message and your IP address, and anything you attach, such as a log file.
Purpose: To answer you and fix the problem you reported.
Legal basis: Contract where it concerns your license (Art. 6(1)(b)); otherwise our legitimate interest in answering people who write to us (Art. 6(1)(f)). The app never sends a report on its own; only you do.

Crash reports (the phone app)

Data: If the phone app stops with an error, it keeps a short crash report on your phone (the time, app and Android versions, phone model, and the technical error, with phone numbers, names, account details and passwords removed). It stays on your phone, is never sent automatically, and reaches us only if you choose Send crash report in Get support, which sends it from your own email app; you can delete it there at any time.
Purpose: To find and fix the error that stopped the app. We delete reports and logs sent to us once the problem is resolved, and at the latest after 90 days.
Legal basis: As for support requests: contract where it concerns your license (Art. 6(1)(b)); otherwise our legitimate interest in fixing the problems people report to us (Art. 6(1)(f)). The app never sends a crash report on its own; only you do.

Extended logs (the phone app)

Data: If you turn on extended logs in the app's Settings to help us with a problem, the app records detailed diagnostic information on your phone for up to six hours, including phone numbers, SIP addresses and call details. This log stays on your phone; we receive it only if you choose to send it to us by email from Get support. You can delete it from the app at any time.
Purpose: We use it only to investigate the problem you reported. We delete reports and logs sent to us once the problem is resolved, and at the latest after 90 days.
Legal basis: As for support requests: contract where it concerns your license (Art. 6(1)(b)); otherwise our legitimate interest in fixing the problems people report to us (Art. 6(1)(f)). Extended logs are off unless you turn them on, and only you can send one.

Partner portal (resellers)

Data: For people at companies that resell Meow: name, work email, role, a hash of your password, your authenticator secret (stored encrypted), and a log of your sign-ins and actions with the IP address and time. For licenses a partner issues: the customer label and reference the partner chose.
Purpose: To let partners issue and manage licenses securely, and to keep a record of who did what on their account, which they and we can see.
Legal basis: The contract with the partner, and our legitimate interest in securing their account (Art. 6(1)(f)).

Update checks (the app)

Data: The app version you are running, and your IP address while the request is handled. Downloading an update also sends your operating system.
Purpose: To tell you when a newer version is available and deliver the right file.
Legal basis: Our legitimate interest in keeping the copies of Meow in use up to date and secure (Art. 6(1)(f)). Nothing is stored beyond the web server logs in section 8.

Usage heartbeat (optional, off by default)

Data: Your device fingerprint, operating system, app version and request-signing public key; the country your connection comes from; the first and last day we heard from the device and the days in between on which it was used.
Purpose: To count how many copies are in use and on which systems, to decide what to work on.
Legal basis: Your consent (Art. 6(1)(a)), given with the switch on Meow's first-run screen or in Settings, Privacy. It is off unless you turn it on, and turning it off stops it immediately.

Website analytics (optional)

Data: Google Analytics cookie identifiers, the pages you view, where you came from, your browser and device type, and your approximate location from your IP address.
Purpose: To see which pages are useful and how visitors find us.
Legal basis: Your consent (Art. 6(1)(a)), asked for by the banner before anything is loaded.

Security and abuse prevention

Data: IP addresses, browser type and request times in web server logs; short-lived request counters keyed by IP address; for our own staff, a log of actions taken in the admin panel.
Purpose: To keep the service and your data secure, and to stop automated abuse.
Legal basis: Our legitimate interest in running a secure service (Art. 6(1)(f)).

Where we rely on legitimate interests, we have weighed them against your interests and rights, and you can object at any time (section 9). A device fingerprint is a one-way hash, but because it identifies a device it is still personal data, and we treat it as such.

4What stays on your device

Meow keeps its working data on your own computer or phone. None of it is sent to us:

SIP accounts and their passwords (stored encrypted)
Contacts, including their numbers, email, website, birthday, notes and pictures
Call history and call recordings
Settings and preferences
On a phone, your contacts: the phone app reads them from the phone's own address book to show names and pictures, only with your permission, and never uploads or keeps a copy
On a phone, the microphone: used only during calls
On a phone, crash reports and extended logs: kept on the phone until you delete them, and sent to us only if you send them yourself from Get support

Your calls go directly between Meow and the phone system (PBX or SIP provider) you configure; they never pass through us, and we have no access to them. Whoever runs that phone system is responsible for what it processes. The only way any of this reaches us is if you send it to us yourself, for example by attaching a log or a recording to a support request. The one exception is a phone set up with a setup code: the code carries its SIP account through our server, and we keep that account's SIP server and extension, never its password, as section 3 describes. You can delete everything by uninstalling Meow and removing its data folder.

5Cookies and website analytics

The website uses storage in your browser for three things:

Your cookie choice: stored in your browser's local storage so the banner does not ask again on every page. It is strictly necessary to respect your choice and needs no consent. It expires after 12 months, when we ask again.
Sign-in cookies: for our own staff using the admin panel, and for you while you are signed in to manage your licenses (it holds a signed customer number and ends after 30 minutes). Strictly necessary.
Google Analytics: only if you accept. Google sets the cookies _ga and _ga_<id>, which last up to 2 years, and processes your IP address, the pages you view, where you came from and your device type. For visitors in the EU the provider is Google Ireland Limited; data may be transferred to Google LLC in the United States (section 7). See Google's privacy policy.

Nothing from Google is loaded until you choose Accept. You can change your mind at any time: reopens the choice (the same link is at the bottom of every page), and rejecting deletes the Google Analytics cookies. Withdrawing consent does not affect processing that happened before.

The desktop app sets no cookies. Its usage heartbeat is covered in section 3.

6Who receives data

We share personal data only with service providers who process it on our behalf and under our instructions, or where the law requires it:

Cardcom (Israel): payment processing. Cardcom receives your card details directly; see Cardcom.
Neutrino API (New Zealand, with servers in the EU, the United States and elsewhere): when you pay, it tells us which country issued your card. It receives only the first six digits of the card number, which identify the issuing bank and not you or your card. It keeps nothing after answering; see Neutrino's privacy policy.
YeshInvoice (Israel): issues our tax invoices and credit notes. It receives your name, email address, country, what you bought and paid, and, for buyers in Israel and the Palestinian territories, your ID or company number, and keeps the invoices for as long as Israeli tax law requires.
Resend (United States): delivery of the emails we send you.
Cloudflare (United States, with servers worldwide): network security and content delivery for the website and the licensing service. All traffic, including IP addresses, passes through it.
Google (Ireland and United States): website analytics, only with your consent.
Google Firebase Cloud Messaging (Ireland and United States): delivers the wake-up for an incoming call to the phone app. It receives the phone's push token, the caller's number and display name, and a one-time call token.
Our hosting provider: runs the servers that store the data described in section 3.
Authorities: where we are legally required to disclose data, for example by a court order.
A buyer of our business: if qFiber or Meow is sold or merged, the data would pass to the new owner, who would be bound by this policy for data already collected.

We do not sell personal data or share it for advertising.

7Transfers outside the EU

We are based in Israel. The European Commission has decided that Israel ensures an adequate level of protection for personal data (Decision 2011/61/EU, confirmed in the Commission's 2024 review), so data can be transferred to us from the EU without further safeguards.

Some of our providers are in the United States. Transfers there rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.

8How long we keep it

We keep personal data only as long as the purpose needs it, and a job on our server deletes it automatically once the period below has passed. Crash reports and extended logs that you email to us we delete ourselves, within the period their row gives.

License records	Until 7 years after the license expires; a license with no expiry is kept while it exists
Orders and purchase records	7 years from the order (Israeli tax and bookkeeping law)
Trial records	3 years from the start of the trial
Usage heartbeat	Deleted 13 months after the last heartbeat; for a device still in use, days of use older than 13 months are removed
Support tickets and bug reports	2 years after the ticket is closed
Phone app crash reports and extended logs sent to us	Deleted once the problem is resolved, at the latest after 90 days, also when sent with a support ticket
Phone app crash reports and extended logs on the phone	Kept on the phone until you delete them in Get support; extended logging itself turns off after six hours
Email delivery log	12 months
Web server logs	30 days
Request counters (rate limiting)	Until the counter resets, usually within an hour
Phone app push registrations	Deleted 60 days after the phone last refreshed it, or at once when the phone is removed from its license
Phone app setup codes	The code and the SIP account it carries are deleted as soon as the code is used, revoked or expires, except the SIP server and extension kept for the phone that used it (next row); a record that the license had a setup code stays with the license
Phone app SIP server and extension (from the setup code)	Kept while the phone is on its license, so that only that phone can receive pushes for that extension; deleted when the phone is removed from its license or the license is deleted. The password is never kept
Admin panel audit log	12 months
Google Analytics cookies	Up to 2 years in your browser, or until you withdraw consent, which deletes them

We may keep data longer only where the law obliges us to, or to establish or defend a legal claim, and only for that.

9Your rights

Under the GDPR you have the right to:

Access: get a copy of the personal data we hold about you (Art. 15).
Rectification: have inaccurate data corrected (Art. 16).
Erasure: have your data deleted, unless we must keep it, for example accounting records (Art. 17).
Restriction: have us limit what we do with your data while a question is resolved (Art. 18).
Portability: receive the data you gave us, in a machine-readable format (Art. 20).
Object: to processing based on our legitimate interests (Art. 21). We will stop unless we have compelling grounds that override yours.
Withdraw consent: at any time, for the heartbeat (Settings, Privacy in the app) or analytics (), without affecting processing before you withdrew.
Complain: to the data protection authority in the EU country where you live or work, or where you believe the problem happened. In Israel, you can complain to the Privacy Protection Authority.

To use any of these rights, email [email protected]. It is free. We answer within one month; if a request is complex we may extend that by two more months, and will tell you why within the first month. We may ask for information to confirm it is you, so we never hand your data to someone else.

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects. License checks are automatic, but they only confirm whether a license key is valid for a device.

10What you have to provide

The license key and device fingerprint are needed for Meow to run: without them we cannot license it. Your name, email and payment details are needed to buy a license. Everything else, including the usage heartbeat, analytics and bug reports, is optional, and saying no changes nothing about how the app works.

11Security

Communication between the app, the website and our servers is encrypted (HTTPS). License tokens and the app's requests are signed with Ed25519, so they cannot be forged, and access to personal data is limited to the staff who need it. SIP passwords are stored encrypted on your own device and never sent to us, except inside a phone setup code, where the account is stored encrypted on our server only until the code is used, revoked or expires, and then deleted, all but its SIP server and extension (section 3).

If a personal data breach happens, we report it to the competent supervisory authority within 72 hours where the GDPR requires it, and tell you without undue delay if it is likely to put your rights and freedoms at high risk.

12Children

Meow is a business product and is not directed at children under 16. We do not knowingly collect their personal data; if you believe a child has given us personal data, contact us and we will delete it.

13Changes to this policy

When this policy changes we update the date at the top. If a change affects something you consented to, we ask for your consent again rather than assume it; other material changes we announce on this website and, where we have your email address, by email.

14Contact

qFiber LTD, Israeli company number 516859592

75 Ein Al-Luza, Silwan, Jerusalem, Israel

Email: [email protected]