Privacy Policy

SIM Cat is an iPhone app provided by OKPATH, INC. (“OKPATH”, “we”, “us”). It is a client for a phone gateway that you run yourself: it lets you place and receive calls and send and receive text messages on the SIM cards in your own Android phone, through a server that you or your administrator operate. OKPATH does not run that server or any other service for the app. OKPATH makes the app available through Apple TestFlight. This policy explains what the app does with information, where that information goes, and the choices you have. It covers the app and this website.

Summary

What the app does

SIM Cat signs in to your server with the login and password your administrator gave you. It then shows the phone lines on your account, places and receives calls through the iOS call screen (CallKit), and sends and receives text messages. Calls and messages are carried by the SIM cards in the Android phone that runs the agent; the app never talks to a phone network itself. There is no account with OKPATH: the account is the one on your server.

Connections the app makes

The app connects to the internet in these cases only:

• Your server’s API (HTTPS). The address is the one you enter on the sign-in screen. The app sends it your login and, when you sign in, your password; the numbers you dial; the numbers and text of the messages you send; requests for your lines, call history and messages; the device name iOS gives the app (a generic name such as “iPhone”); and its push tokens, identifiers and version. Each request carries a User-Agent header with the app and its version, for example “SIMCat-iOS/1.0 (110)”.
• Your server’s call service. The app registers with your server’s SIP service over TLS, using the host, port and credentials for this iPhone that your server provides after sign-in, and sends call signalling and call audio to it, encrypted (TLS for signalling, DTLS-SRTP for audio). If your server offers a relay for call audio (TURN), the app may send the audio through that relay; your server names it, and it is normally part of your server. The app uses no public STUN or TURN servers and contacts no other host for calls.
• Apple. The app asks iOS for push tokens, which involves Apple’s push notification service (APNs). Your server sends call and message alerts through it; see below.
• This website. If you tap Privacy Policy, Support or Setup Guide in the app, it opens that page of this website in Safari.

Push notifications. After you sign in, the app gives your server two tokens that iOS provides, one for call pushes and one for message alerts, together with the app’s identifier and version. When a call or message arrives, your server sends a push to Apple, and Apple delivers it to your iPhone. A call push carries a call ID and an expiry time. A message alert carries an event ID and the fixed text “New activity – Open the app to view your line.” Neither contains a phone number or message text. Your server, not OKPATH, sends these pushes; Apple handles them under its own privacy terms.

The app has no update checker, no analytics and no crash-report upload. iOS itself may contact Apple on the app’s behalf, for example to check a server’s certificate.

The servers you connect to

The server you enter is run by you or by someone you choose, such as your organization. OKPATH does not run it, has no access to it, and receives nothing from it. Depending on how it is set up, a server can see your login name and, when you sign in, your password; your IP address and when the app connects; the numbers you dial and message and the numbers that call and message you, with their times; the text of your messages; and, because it connects the two legs of each call, the audio of your calls. Calls are encrypted between your iPhone and your server and between your server and your Android phone, but your server handles the audio in between. The Android phone that runs the agent also handles your calls and messages.

What a server records and how long it keeps it is up to whoever runs it, and its operator’s own privacy policy applies. If you use someone else’s server, ask them.

Information stored on your device

• Sign-in data. The access and refresh tokens that keep you signed in, your login name, the address of the server that issued them, your account and installation identifiers, and sign-outs your server has not confirmed yet. They are in the iOS Keychain, readable after the first unlock since a restart, on this device only and not synced to iCloud Keychain. The app does not store your password. The call credentials for this iPhone stay in memory only.
• Cached data. Your lines (names and numbers), call history, messages, including their text and messages waiting to be sent, and your position in your server’s event feed. They are JSON files in the app’s private storage, kept so the app can show your data before the server answers. iOS protects them until the first unlock after a restart, they are excluded from backups, and Sign Out removes them.
• Preferences. The address of the last server you used, so the sign-in screen can fill it in; your selected line; the call-relay choice; the push tokens last registered with your server; and a few technical settings. They are in the app’s preferences. iOS may include these in device backups.
• Logs. The app writes technical events (sign-in, sync, call setup and audio statistics) to the iOS system log on your iPhone, leaving out passwords, tokens and message text and masking phone numbers to their last four digits. This redaction is automatic and best effort. The log stays on your iPhone and iOS discards old entries. Nothing is uploaded.
• Calls in iOS. Calls made or received with SIM Cat do not appear in the Phone app’s Recents. The app keeps its own history, loaded from your server.

Sharing diagnostics with OKPATH

A log leaves your iPhone only if you share it. Settings › Export Log writes the log of the current run to a file and opens the iOS share sheet; you choose whether to send it, and to whom. The file holds the app and iOS versions, the time and the technical events described above, which can include your server’s host name and IP address, error codes and timings. Read it before you send it. OKPATH asks for a log only to find a problem you reported, and never asks for your password.

Information OKPATH receives

OKPATH receives no data from the app. It holds only the TestFlight information that Apple shares and the messages you send to support.

TestFlight

Apple, not the app, shares beta-testing information with OKPATH. It can include how you were invited and whether you accepted, install and session counts, your device model, iOS version and language, crash logs collected by iOS, and any feedback, screenshots and comments you choose to send through TestFlight. If OKPATH invited you by email, it has the name and email address it used. If you joined through a public link, Apple does not show OKPATH your name or email address. Apple’s TestFlight privacy terms apply.

Support requests

If you contact us, we receive what you send: your email address, your message and anything you attach. We use it only to answer you, and keep it only as long as we need it to resolve your request.

Demo server

To let Apple review the app and to demonstrate it, OKPATH runs a demo server with simulated phone lines. It is not connected to any phone network: calls and messages on it are simulated and no real call or text is placed. OKPATH keeps a demo account on it for Apple’s reviewers. If you sign in to the demo server, OKPATH operates that server, so it receives what the app sends to any server, as described above. That information is stored on the demo server only to run the demonstration. OKPATH does not use it for anything else and does not sell or disclose it.

Permissions and why the app asks

• Microphone. So the other party hears you during a call. The app asks after you sign in, or at your first call. The audio goes only to your server as part of the call; the app does not record it.
• Notifications (optional). For message alerts, which need alerts, sounds and badges. The app asks after you sign in. Incoming calls use the iOS call screen and need no notification permission.
• Background activity. iOS lets the app wake for an incoming-call push, keep call audio going when you leave the app, and renew its sign-in periodically in the background.
• Nothing else. The app does not ask for, or use, your contacts, location, photos, camera or local network, and it does not scan your network.

Keeping and deleting your data

• On your iPhone. Tap Sign Out in Settings, under Account. The app tells your server to revoke this iPhone, which ends its sessions and removes its call account and push tokens (if the server cannot be reached, the app keeps trying), and clears the cached lines, call history and messages from the device. Delete the app to remove everything else it stored, including its preferences. Device backups follow your backup settings.
• On your server. Whoever runs the server controls what it keeps. Ask them, because OKPATH cannot see or delete it.
• Information OKPATH holds (TestFlight information that Apple shares and your support emails): to get a copy, or to have it corrected or deleted, email privacy@okpath.com. We may need to confirm your identity first. Depending on where you live, you may have further rights under local law, including the right to complain to a data protection authority.
• Leave the beta. In TestFlight, open SIM Cat and tap Stop Testing.

Children’s privacy

SIM Cat is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has sent us information, contact us and we will delete it.

This website

These pages have no cookies, analytics, advertising or tracking, and they load nothing from other sites: the fonts and images come from this site. They are served by Amazon CloudFront from Amazon S3. Amazon Web Services processes each request, including your IP address and the page you asked for, to deliver the page. OKPATH has turned off access logging for the site and does not collect those requests.

Changes to this policy

If we change this policy, we will post the new version at this address and update the effective date above. We will also mention significant changes in the TestFlight notes for the next build.

Contact

OKPATH, INC. is responsible for the information it receives, as described in this policy. Send questions and requests about privacy to: