What we hold, and what we never do.

• Your name and email address, so you can sign in and we can reach you.
• The Telegram chat we alert, so a ring can be delivered.
• Android notification registration, if you enable it in the app. We keep this installation’s identifier, push-notification token and a protected device access record linked to your sign-in session.
  The detail

  Removing the device, signing out of that session or deleting your account revokes its access. Expired registrations are removed by our regular cleanup, which runs about every 15 minutes.
• Short-lived Android alert records. These link a notification to an eligible ring and record whether Google accepted the request. Acceptance does not prove your phone rang.
  The detail

  Alert references expire within 60 seconds and are removed in the next regular cleanup; your ordinary ring history follows its separate retention period.
• A list of when your doorbell rang, kept for 30 days and then removed.
• A record of what you paid, but never your card. If you take a paid plan, the card details are typed into Paystack and never reach us — we have no card number, no expiry, no CVV and no billing address.
  The detail

  What we keep is the boring half: the amount, the currency, which plan, whether it succeeded, a reference so it can be traced if something goes wrong, and the codes Paystack uses to identify your subscription. On the free tier none of this exists for you at all.
• An unsent form, held on your phone by the Android app. The email, name or message of an unsent form stays on that phone for Android to give back. It never reaches us, and it is never a password or a code.
  The detail

  It is removed when you send the form, when you tap Clear it, or after 3 days. The website in a browser keeps nothing of the kind.
• A short-lived counter of sign-in attempts. When you ask for a sign-in code we note that a request happened, against a one-way scrambled version of your email address and of the internet address you asked from.
  The detail

  We do not keep the address or the email itself in those records — only the scrambled marker — and we clear them after about a day. It is there so nobody can flood your Telegram with sign-in codes or sit there guessing at your code, and there is no way to run it backwards to build a list of who signed in from where.
• A message you choose to send through the contact form. We keep the name and message you type, plus your email address or phone number only if you choose to provide them.
  The detail

  Telegram receives a notification and a link for the Virtual Doorbell operator to open after signing in; that notification does not include your name, email, phone number or message. The saved message does not include your internet address and is not tied to a Virtual Doorbell account; as with sign-in codes, only a one-way hash of your address is kept briefly, so nobody can flood the form. We delete our copy after 60 days. A full copy previously sent to the operator's Telegram is not ours to delete and stays in that chat until they remove it — contact the operator if you want an earlier copy removed.
• The heading, wording and logo you put on a contact QR. If you make a "contact me" QR code, you can give its form a heading, a line of detail and an image — usually a logo.
  The detail

  We keep exactly what you upload, in our own database, and we show it to anybody who scans that QR code: that is what it is for, so treat it as public. We cannot see inside the image and we do not check what is in it, so please only upload something you have the right to publish — if it happens to show a person, a vehicle or a place, you are publishing that. It stays until you replace it, remove it, delete that QR code or close your account, and it goes immediately in all four cases. Visitors never upload anything — the only file on a contact form is yours.

As little as we can while still stopping abuse. A visitor does not need an account, an app, or to tell us who they are. To enforce the ring limits we keep a short-lived, one-way scrambled marker rather than a plain record of the device.

That marker goes after about a day — not after 30 days. The ring itself stays in your list for 30 days so you can see that somebody came to your door, but the thing that could group one visitor's rings together is wiped long before that. An earlier version of this page said the marker was discarded "on the same 30-day cycle", which undersold what actually happens; the code has always cleared it on the shorter clock. We do not build a profile of anyone and we do not track visitors across other websites.

Some Virtual Doorbell customers put a QR code on an advert, a business card or a "contact me" page rather than on a door. If you scan one of those and choose to send a message instead of calling, this is what happens to what you type.

• What is kept. The message itself, and — only if you choose to fill them in — your name, email address and phone number. All three are optional and none of them is verified. Your internet address is never stored with the message: what we keep alongside it is only a short-lived one-way marker, so nobody can flood the form. Separately from that, our web server keeps an ordinary access log that does record the address every request came from, including this one. That log is kept for 3 days and then deleted.
• Who sees it. The Virtual Doorbell customer whose code you scanned, and nobody else. They read it in their own dashboard. It is not shared with anyone, it is not used for advertising, and it is not readable by other Virtual Doorbell customers.
• How long. We delete our copy after 60 days, or sooner if they delete it or close their account. When they delete a message, everything that names you — the message, your name, email and phone — is erased immediately; what remains is a nameless record that a message arrived and was billed for on a given date, which identifies nobody. That record dies on the same 60-day clock.
• The message itself never leaves this service. The customer is told on Telegram that a message is waiting, but that alert names only their own contact point — it never contains your message, your name or your details. (Older messages, sent before 3 August 2026, did go to Telegram in full; those copies are in the customer's chat and are not ours to remove — ask them.) For anything sent since, our copy is the only copy, so deleting it here deletes it everywhere.
• If you want it removed. You have no account with us and we cannot identify you, so there is no self-service button we could honestly offer. Write to us through the contact form and we will handle it by hand.

The fonts, images, styles and scripts on this site are served by us, from our own server. There is no third-party analytics script, no advertising pixel, no social widget and no content delivery network. That is a deliberate choice: pulling a font or a script from someone else's server would hand a stranger's IP address to a third party before they had agreed to anything. We count visits ourselves, in aggregate, to know whether the thing works.

What that counting actually is, in full: for each day we keep a tally of how many times each page was opened, a tally of how many separate visitors we saw, and a tally of how many times things like a doorbell ring or a sign-in happened. They are numbers and nothing else — no name, no address, no record of which pages any one person looked at. There is no cookie and no fingerprint. To avoid counting the same person twice in a day we briefly keep the same scrambled version of your internet address described above, and it is deleted on the same 24-hour clock; the numbers it produced stay, the scrambled address does not. Because of that, “visitors” is a good estimate rather than a headcount: two people on one wifi look like one, and one person on wifi and then mobile data looks like two.

One thing sits underneath all of that and it would be misleading to leave it out. Like every web server, ours writes an access log: for each request, the internet address it came from, the time, the page, and which browser asked. That is a real record of your address, not a scrambled one, and it is kept whatever else this page says we do not store. It exists so we can investigate abuse and faults, it is readable only by the server's administrators, and it is never combined with your account or used to build a profile. That log is deleted after 3 days. Sign-in codes, door codes and links to a visitor's photo or recording are stripped out of it before it is written.

Telegram, because that is how a ring or sign-in reaches you and, if you use the contact form, how that message reaches the Virtual Doorbell operator. Our hosting provider, because the server runs in Germany. And Paystack, if you take a paid plan — they handle the card, so they see your payment details and we do not. If you enable Android app notifications, Google Firebase Cloud Messaging handles an installation token and technical connection information to deliver the alert to your phone. We send it an expiring alert reference, without the visitor’s name, message, photograph or recording. The signed-in app retrieves the doorbell details from us. We do not sell your information and there is nothing here worth selling.

And anyone you invite into your household — see below. That is a person, not a company, and it is the one case where somebody other than you can see and hear a visitor at your door.

You can invite other people into your household so they can answer the door too. This is the most significant thing you can do to the privacy of anyone who rings your bell, so it is worth being exact about it.

A housemate you invite can see and hear a visitor's live video and audio when they answer, exactly as you can.

• They can see the door in their own dashboard, see when it rang, and answer a call.
• They cannot create or replace the QR code, change the door's settings, invite anyone else, or remove anyone. Those stay yours.
• You can remove them at any time, from your dashboard. Removal is immediate: their access stops, any call they are already in ends, and an invite you had not yet given out stops working.
• They can leave on their own, and you are told when they do.

A visitor is not told which member of a household answered. If that matters to you, tell the people you invite — we cannot tell a stranger at your gate who is on the other end.

You can delete your account and everything in it from your dashboard, at any time.

You do not have to ask us and you do not have to explain. It removes your account, your doors, your codes and your ring history from the live system straight away. We also keep encrypted off-site backups so a hardware failure cannot lose everyone's doors, and those are kept for up to 30 days before they are deleted in turn — so a copy of your data can survive there for up to 30 days after you delete it, and no longer. Those backups are encrypted with a key that is not stored on the server, and we do not read them or use them for anything except restoring the service.

For the purposes of South Africa's Protection of Personal Information Act (POPIA), the Responsible Party for the information described on this page is Dewald du Toit, a sole proprietor trading as Seidr Labs. It is not a registered company, so there is no company registration number. Business address: 41 Market Street, Villiers 9840, Free State, South Africa.

Our Information Officer is Dewald du Toit. To reach the Information Officer, use the contact form.

To ask for a copy of what we hold about you, to have it corrected, or to have it deleted, use the same form and say that it is a POPIA data request. We may need to check that you are the person the information is about before we act on it.

South Africa's Protection of Personal Information Act applies. You may ask what we hold about you, ask us to correct it, or ask us to delete it — the dashboard does the last one instantly. If you think we have handled something badly, tell us, and you may also complain to the Information Regulator of South Africa. To ask us anything about your information, use the contact form; it reaches a person.

Virtual Doorbell is for adults running a household. We do not knowingly collect information about children.

If this changes materially we will say so here and update the date at the top. We will not quietly start doing something this page says we do not do.