Privacy Policy
Last updated: 30 September 2026: section 2 now covers the Buy us a coffee link to Ko-fi, and says we send Ko-fi no referrer, so it is never told which number page you were on. Nothing else about how we handle your data has changed. Earlier updates: 29 September 2026: section 2 began covering links to 3 Wee Pages and the Share GotMyNumber button, and how clicks are counted (a note from your browser, not a hop through our server). 27 September 2026 (evening): section 2 now says that we count daily visitors from the lookup hash and count clicks on links to our other Towpath sites, section 6 how long those are kept, and section 7 a cookie the people who run the site set on their own browsers. Earlier on 27 September: section 2 began covering quote requests for business list checks, with why we hold them (section 3) and how long we keep them (section 6). Previous update, 24 September 2026: lookups now keep a one-way hash of your IP address for 31 days, and reports keep a hash of the network the report came from (section 2, "What we hold, by what you do", and section 6). Rewritten in this version: what we hold is now set out by what you do on the site, with how long we keep it and who processes it; section 4 is new, for people whose numbers are reported; section 7 covers cookies; "Data Protection Officer" is replaced by our privacy contact.
1. Who we are
GotMyNumber is run by Towpath Digital Ltd, registered in England and Wales (company no. 16913912). We are the data controller for personal data processed through gotmynumber.co.uk. Towpath Digital Ltd was called Central Contacts Ltd until 13 April 2026; it is the same company, so nothing about who holds your data has changed.
We are registered with the Information Commissioner's Office, registration number ZC210106.
Privacy contact: privacy@gotmynumber.co.uk. We have not appointed a Data Protection Officer; this address reaches the people who run the site.
2. What we hold, by what you do
Looking up a number. We record the number you looked up, when, the page that sent you to us (if your browser tells us), your browser type, and a one-way hash of your IP address made with a secret key. We never store the IP address itself, and we delete the hash after 31 days. The hash lets us count how many different people looked a number up, rather than how many times a page loaded, which is how we decide whether a number's page is shown to search engines. We also use lookups to understand how people find the site, and we count how many different people use it each day from the same hash, only as daily totals. You do not need an account.
Following a link to another Towpath site, or sharing GotMyNumber. When you click a link from GotMyNumber to UniversalContacts, GotAPal or 3 Wee Pages, or press the Share GotMyNumber button, your browser sends our own server a short note as it goes, and the link opens as normal. We record which link it was (or that the Share button was pressed), where it sat on the page (on number pages, which of the four versions of the 3 Wee Pages box you saw), when you clicked, whether your browser type looks automated, and the same one-way hash of your IP address that lookups use, deleted after 31 days. The link tells the other site you came from GotMyNumber and which box you clicked; it never carries the number you looked up. The Share button shares the address of GotMyNumber, never the number you looked up, and we cannot see whether you sent it or to whom. Nothing is stored in your browser.
Buying us a coffee. The “Buy us a coffee” link on a number page opens Ko-fi, a third-party tipping service, in a new tab. We deliberately send Ko-fi no referrer, so it is never told which page you came from — and a number page’s address is the number you looked up. We count that the link was pressed in the same way as the links above: which link, where it sat on the page, when, whether your browser type looks automated, and the same one-way hash of your IP address, deleted after 31 days. If you choose to tip, everything after that happens on Ko-fi under Ko-fi’s own privacy policy: we never see your card details, and we see your name or message only if you give one there.
Checking for a verified business. When you open a number's page, your browser asks the Towpath Hub, our central business directory, whether a verified business has registered that number. Only the number is sent.
Reporting a number. We store the number, the type of report, what you wrote, the date of the call if you give it, and two one-way hashes made with a secret key: one of your IP address, and one of the wider network it belongs to. We never store the address itself. The first lets us count how many different people have reported a number; the second stops one person using two addresses on the same network from counting as two people. We do not ask for your name or email to make a report.
Creating an account. Your email address, and your name if you give it. Your password is handled by our database provider's sign-in service and we never see it.
Joining a waitlist. Your email address and which feature you asked about. On the claim your number waitlist we also ask two optional questions: which situation you are in (it is your number, or your number has been reported and it was not you) and which number you mean. Both can be left blank and the waitlist works without them. We ask because those are two different problems and we cannot tell them apart otherwise. The number is kept so we can see whether it has been reported; it is never shown on a number’s page or anywhere else public. All of it is deleted together with your email address once we have emailed you.
Asking for a quote for a business list check. What you type into the quote form on the business list checks page: your name, email address, company if you give it, the size of your list and your message, with the time you sent it. We use it to reply and to prepare your quote. It is kept in a file on the server that runs this website, in the UK, not in our database, and we do not store your IP address with it. When a request arrives, the people who run the site get an email saying a request is waiting; that email gives the list size and when it was sent, not your name or contact details.
Claiming a number you own. This is not open yet. When it opens it will use Towpath Digital's central verification service: we will send a one-time code by text message to prove the number is yours, and the record of that check will hold a one-way hash of the number, not the number itself. We will update this policy before it opens.
What we never collect: payment card details (we do not take payments on this website), your contacts, your call history, or your location.
3. Why we use it (lawful basis)
| What | Lawful basis under UK GDPR |
|---|---|
| Lookups and the verified-business check | Legitimate interests: running the service, counting how many different people look a number up, and understanding how the site is used, including how many people use it each day and how many follow a link to our other sites. |
| Publishing reports | Legitimate interests: helping people decide whether to answer or trust a call, and to spot scams. See section 4. |
| Your account | Contract: providing the account you asked for. |
| Waitlist | Consent: you asked us to tell you. You can withdraw it at any time by emailing us. |
| Quote requests | Contract: the steps you ask us to take before one, which are replying to your request and preparing a quote. |
| Keeping records we must keep | Legal obligation. |
4. If your number has been reported
A phone number can be personal data, for example a personal mobile. You have rights over it even though you have never used this site.
Reports are about calls and messages, not about people. Our terms forbid names, addresses and other personal details in a report, and we remove reports that include them. Each report is shown as one person's account, which we have not checked, and the Community score measures how widely a number has been reported, not whether it is dangerous.
We rely on legitimate interests to publish reports. We have weighed the value of warnings about unwanted and scam calls against the effect on the person using the number, and that is why reports are limited to what happened on the call and are open to challenge.
To object to, correct or remove a report, email privacy@gotmynumber.co.uk with the number and the report you mean. If you are asking about a number you say is yours, we may ask you to show that it is. We will reply within one month. If we decide to keep a report, we will tell you why, and you can complain to the ICO.
5. Who processes it for us
We do not sell personal data or share it for advertising. These providers process it on our behalf, under contract:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, and the Towpath Hub | London, UK |
| Krystal Hosting Ltd | The servers that run the website | UK |
| Cloudflare | Delivering the site securely and protecting it from attacks | Global network; see below |
Transfers outside the UK. Our data is stored in the UK. Cloudflare's network handles connections from wherever you are, so connection data can pass through its servers outside the UK; its data processing addendum sets out the safeguards it applies. If we add a provider, such as a text-message provider when claiming opens, we will add it here first.
6. How long we keep it
| Record | How long |
|---|---|
| Lookups (number, time, referring page, browser type) | 24 months, then deleted. |
| The IP hash kept with a lookup | 31 days, then deleted from the record. |
| Clicks on links to our other sites | The IP hash: 31 days, then deleted from the record. The rest (which link, where, when): 24 months, then deleted. |
| Reports and the IP and network hashes with them | While the number's page is live, unless removed after a request (section 4) or for breaking the reporting rules. |
| Account | Until you ask us to delete it. |
| Quote requests | 12 months from when you sent it, then deleted automatically. You can ask us to delete it sooner. |
| Waitlist email | Until we email you once, when the feature launches, or decide not to build it. Then deleted. |
| Number verification (when claiming opens) | Valid for a year; the record is deleted 12 months after it expires. |
7. Cookies and browser storage
Visit counting is switched off. We used to count visits with Porthole, Towpath Digital's own visit counter, without asking first. We have stopped: anything it sends is now discarded, not stored. Until the last part of it is removed from our network, a page may still place a random ID in your browser's local storage; it is not linked to you and nothing it sends is kept. You can clear it by clearing this site's data in your browser.
Signing in. If you sign in, your browser keeps your sign-in session in its local storage, which is needed for signing in to work. In the account dashboard, a cookie remembers whether the side menu is open or closed.
Team browsers. The people who run GotMyNumber can mark their own browsers so that their visits are left out of our counts. That sets a cookie called gmn_team, for a year, from a page only they can open. Visitors never receive it.
We do not use advertising cookies or third-party analytics. To remove the visit-counting ID, clear this site's data in your browser settings.
8. Your rights
You can ask for a copy of your data, and ask us to correct it, delete it, restrict what we do with it, move it, or stop using it (objection). Where we rely on consent, you can withdraw it at any time.
Email privacy@gotmynumber.co.uk. We will reply within one month. That covers anything held about you in the Towpath Hub as well.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would like the chance to put it right first.
9. Security
Connections to the site are encrypted (HTTPS). Database access is restricted by row-level security, so the public site can read only what it is meant to show. We keep one-way hashes of IP addresses, never the addresses themselves, and delete the hash kept with a lookup after 31 days. More on the security page.
10. Contact
Privacy contact
Towpath Digital Ltd
Email: privacy@gotmynumber.co.uk
Registered in England and Wales, company no. 16913912
ICO registration ZC210106