Privacy Policy

Who we are

Dimefax (the iPhone app and dimefax.com) is run by Kiyo Kubo, doing business as Dimefax (“Dimefax”, “we”, “us”). This policy explains what we collect, why, who helps us, how long we keep it, and the choices you have.

What we collect

Your account

• Email address. We use it to sign you in, send fax confirmations, and send you faxes you receive. On our website you sign in with a 4-digit code we email you; we store only a scrambled form of the code, and it stops working after 10 minutes.
• Sign in with Apple. If you use it, Apple gives us a user identifier for Dimefax and the email you choose to share (which can be an Apple private relay address). We never see your Apple ID password.
• Account settings, such as your plan, whether the “Sent with Dimefax” line is removed, and whether you send privately by default.

You don’t need an account to look around the app. We only ask you to sign in when you make your first purchase.

Faxes you send

• The document: the finished pages you choose to send. Scanning, signing, filling in and redacting happen on your phone. The pages are flattened before upload, so we receive only the final result and redacted parts can’t be recovered.
• Delivery details: the recipient’s fax number, the number it was sent from, page count, whether it was private, status (queued, sending, delivered or failed), the reason for any failure, the number of attempts, and timestamps.

Faxes set up by an AI app, a script or our website

• If you ask an AI app (such as ChatGPT or Claude) or a script to send a fax with Dimefax, it sends us the fax number and the document, and we give back a payment link. The AI app also sees the document, under its own privacy policy.
• A fax set up this way that isn’t paid for or sent within 24 hours is deleted, document included.

Faxes you send by email

• When you email a document to a fax number at dimefax.com, we process that email: the fax number it was sent to, the address it came from, the sender checks your email provider attached (SPF, DKIM, DMARC), the text and the attachments. We use them only to make the fax, to decide whether it can be charged to an account, and to reply to you.
• We don’t store the email itself. The fax we make from it is kept like any fax you send (see “How long we keep it”). If we reply with a payment link instead, the fax is kept until you pay or for 24 hours, then deleted with the link.
• If you choose “Let this address send faxes”, we keep that address on your account so its emails can be charged to you.

Faxes you receive

• If you have a Dimefax number: the incoming document, the sender’s fax number, page count and time, and which number is assigned to you and when.

Purchases

• What you bought (page credit packs, plans), when, your page credit balance, and the transaction identifiers Apple or Stripe provides so we can confirm the purchase. In the app, Apple handles payment. On our website, Stripe handles payment and tells us the amount and the email used. We never see your card or bank details.

Usage events

• Simple events such as “fax sent”, “fax delivered”, “purchase completed” or “limit reached”, with a short list of allowed details: page count, whether it was private, number of attempts, how long the send took, the plan, the platform, and a failure category such as “busy”.
• These events are tied to your account so we can apply abuse limits and decide when to show Apple’s review prompt. They never contain document contents, fax numbers, names or email addresses. Our system drops any detail that isn’t on the allowed list before it is stored.

Support and technical data

• Emails you send us, and our replies.
• Technical logs. Like every website and app, our servers process your IP address and basic request details to run and protect the service. Our hosting provider keeps these logs for a short time.
• Camera and photos. Used only on your phone to scan or pick a document. We receive only the pages you send.
• Notifications. If you turn them on, a device token so we can tell you when a fax arrives or is delivered.

This website

dimefax.com uses no cookies, no analytics and no advertising tags. It loads its fonts from Google Fonts, so your browser sends your IP address to Google when you visit.

How we use it

• To send and receive your faxes, retry busy or unanswered lines, and tell you the result.
• To bill you, keep your page balance, and return pages when a fax fails.
• To prevent junk faxing and abuse (for example, daily and hourly sending limits).
• To answer support requests.
• To understand, in aggregate, how the app is used and where it breaks, so we can improve it.
• To meet legal, tax and accounting obligations.

We don’t sell or rent your personal information, we don’t share it for advertising, and we don’t use it to build advertising profiles. We don’t track you across other companies’ apps or websites.

Who helps us run Dimefax

We share data only with the service providers below, only what they need to do their job for us, and under contracts that limit their use of it.

We may also disclose information if the law requires it, to protect people from harm or fraud, or as part of a merger or sale of the business, in which case this policy continues to apply to your data.

How long we keep it

• Private faxes you send: we tell Telnyx not to store the document, so they keep no copy. Right after delivery we lock our copy to your account’s public key and delete the readable one; only your devices hold the private key (protected by your passkey and your recovery code), so we can’t open it. The locked copy is deleted 30 days after delivery. If you haven’t set up private faxes, our copy is deleted right after delivery instead.
• Your private-fax keys: we store your public key and copies of your private key that are locked by your passkey and by your recovery code. We never see the passkey, the recovery code or the unlocked private key.
• Faxes that fail: our copy of the document is deleted once the last attempt fails.
• Standard faxes you send: we keep the document for 30 days after it’s delivered, so you can open it again, then delete it. Telnyx may also keep a copy under its own retention rules.
• Faxes you receive: we keep them so you can open them in the app until you delete your account, unless “Don’t keep my faxes” is on (below).
• A standard fax that doesn’t go through: we keep the document for 7 days so you can tap Try again, then delete it. A private fax that doesn’t go through is locked the same way and deleted after 7 days.
• “Don’t keep my faxes”: if you turn this on in your account, a fax you send is deleted as soon as it’s delivered or finally fails, and we ask Telnyx to keep no copy. A fax you receive is emailed to your account’s email address without being stored by us, and Telnyx’s copy is deleted. Turning it on also deletes the copies we hold at that time. We still keep your fax history (numbers, page counts, status).
• Addresses you let send faxes by email: until you remove them on your account page or delete your account.
• Fax history (numbers, page counts, status) and purchase records: while your account is open. After you delete your account, we keep only the purchase records that tax and accounting laws require, for as long as they require.
• Technical logs: a short time, set by our hosting provider.
• If we sign a business associate agreement (BAA) with you: records are kept as it requires.

When you delete your account, we delete your documents, fax history and usage events, and remove your email and Apple identifier, right away (copies in our database backups expire within 30 days), except the purchase records described above.

Fax numbers

When a number is released (your plan ends or you give it up), we don’t hand it to someone else right away. It is quarantined: calls to it are rejected and nothing is stored. A regular number can go back into use only after at least 30 days, and only once it has had no incoming calls for 14 days. Numbers used under a signed BAA are never given to another Dimefax customer. This keeps faxes meant for you from reaching a stranger.

Security

• All connections between your phone, our servers and our fax carrier are encrypted (TLS).
• Documents are stored encrypted. Our carrier fetches a document through a private link that expires after 15 minutes.
• We check a cryptographic signature on every message from our carrier, so no one can fake a delivery or an incoming fax.
• The honest limit: the last leg of any fax, from the carrier to the recipient’s fax machine, runs over the ordinary phone network, which isn’t encrypted. Dimefax, like every fax service, can’t offer end-to-end encryption.

No system is perfectly secure. If a breach affects your personal information, we will tell you as the law requires.

Health information

Dimefax signs a business associate agreement (BAA) only if we agree to one with you in writing; ask at dimefax.com/support#baa. With “Don’t keep my faxes” on, Dimefax only transmits your faxes and keeps no copies (see “How long we keep it”). Whether that, or Dimefax at all, meets your obligations under HIPAA is your decision; we make no representation that it does. The last leg of every fax runs over the ordinary phone network, so no fax is end-to-end encrypted.

Your choices and rights

• Delete your account in the app (Settings › Delete account), or email support@dimefax.com from the address on your account. Deleting your account doesn’t cancel an Apple subscription: cancel it in your Apple ID settings first (see how).
• Change your email in the app’s Settings.
• Get a copy, correct or delete your data by emailing us. Depending on where you live (for example California, the EU or the UK), the law gives you these rights and others, such as objecting to some uses. We honor these requests for everyone, wherever you live, and we won’t treat you differently for making one.
• If you are in the EU or UK, our legal basis for processing is mainly performing our contract with you (delivering faxes, billing), plus our legitimate interests in preventing abuse and improving the app, and legal obligations. You may complain to your local data protection authority.

Where your data is processed

We are based in the United States. Our providers run their services in the United States and other countries, so your information may be processed outside your country.

Children

Dimefax isn’t meant for children under 13 (or the minimum age in your country), and we don’t knowingly collect their information. If you think a child has given us information, email us and we will delete it.

Changes

If we change this policy, we will update the date at the top. If a change is significant, we will tell you in the app or by email before it takes effect.

Contact

Questions or requests: support@dimefax.com
Kiyo Kubo, doing business as Dimefax, 3525 SE 9th Avenue, Portland, OR 97202, United States