iTellYour calls never touch our servers.
Not because we promise not to look, but because they never come our way. Here's how the link between your two phones works.
1 · Pair once, in person
The Android phone shows a QR code that holds its public key and a one-time token, valid for five minutes. Your iPhone scans it and the two phones exchange long-term keys face to face. No one else can join later.
2 · Fresh keys for every connection
Each time the phones connect they create new temporary keys and combine them with the paired ones (P-256 ECDH, then HKDF-SHA256). Even if a key leaked one day, older conversations stay locked.
3 · Everything travels locked
Calls, texts, contacts and history move in AES-256-GCM encrypted packets, each with its own counter, so nothing can be read, changed or replayed on the way.
4 · No server in the middle
The link is Bluetooth, phone to phone. There is no relay, no cloud copy and no inbox on our side. Your account server only knows that your two phones exist.
What we keep, and what we never see
We keep
- Your email address and the mobile number you typed
- A public key and the model of each of your two phones
- Your orders and license
- Support tickets, and diagnostic logs only when you press send (numbers and texts removed on your phone first, deleted after 30 days)
We never see
- Your calls or call audio
- Your text messages
- Your contacts
- Your call history
- Where you are
Keys that stay on your phones
Your account keys are made inside the iPhone's Secure Enclave and the Android phone's hardware keystore. They never leave the device, not even to us.
Found a security issue?
Write to support@itellapp.com. We read every report, reply quickly, and credit you if you like.
What if…
…someone nearby tries to listen in?
They'd see encrypted Bluetooth packets and nothing else. Without the keys made during your pairing, the packets are noise.
…I lose my iPhone?
Unpair it from the Android phone with one tap, then free its seat in your account. Your data was never in our cloud to begin with.
…your servers were hacked?
An attacker would find accounts and licenses, not conversations. Calls and texts are never there.