Security at ZeroPercent

Last updated: 25 September 2026

How we protect your family, how to tell a real ZeroPercent text from a fake one, and what we have not done yet. Each section starts with a short answer in plain English. The detail is underneath if you want it.

Is this text really from ZeroPercent?

In short: anyone can copy what our texts look like. The code word is the part they cannot copy. If it is missing, or the text asks for money or a code, check with the family another way first.

This matters more for us than for most apps. A rescue text says, in effect, "it's me, my phone's gone, I'm on someone else's". That is also how the "Hi Mum" (or "Hi Mom") scam begins.

Where our texts come from. Rescue texts and calls come from 07460 069376 in the UK and (888) 479-9370 in the US and Canada. In the UK, sign-in codes arrive from the sender name ZeroPercent. In the US, they come from (888) 479-9370.

Why that is not enough. The number or name shown on a text or call can be faked by anyone, and a fake can even land in the same message thread as a real one. No sender can stop that. So a matching number tells you very little.

What a real rescue text looks like, with a note beside each part:

Check another way first if the code word is missing or wrong, or if the text asks for money, a PIN, a sign-in code, or anything you would not normally do. Ring someone who is likely to be with them, or another member of the family. Their own phone going straight to voicemail is normal in a real rescue, so on its own it proves nothing either way. A real rescue text never asks for money: it only tells you they are trying to reach you, and lets you reply.

If you were never told a code word, the rest of the message can only tell you it might be real, so check another way before you do anything it asks.

A rescue can also ring you from our number. When you answer, you are connected straight to the person. If you are unsure, ask them for the family code word.

Ring us to check a text

Ring 07460 069376 (UK) or (888) 479-9370 (US and Canada) from the phone that got the text. A recording says we will ring you back, and ends the call. Within a minute we ring that phone and tell you whether anyone used ZeroPercent to reach it in the last day. If they did, we tell you who, the last three digits of their number, and the four characters their text asked you to reply with, so you can check they match the text you have.

We ring back rather than answer straight away because the number shown when someone calls can be faked. Ringing you back means only the real owner of that phone hears the answer.

• Only ring the numbers on this page. Our texts never ask you to ring a different number to check them. If a text gives you a number to ring, that text is not from us.
• Ring from the phone the text came to. We can only check the phone we ring back. We only text mobiles, so we cannot check a landline.
• If your number is hidden, we cannot ring you back.
• We ring back once every ten minutes at most, so nobody can use our line to make us ring someone over and over.

What we will never do

In short: we send you sign-in codes to type into the app yourself. We never ask you to tell anyone your PIN or a code, or to give us payment details. Anyone who does is not us.

• Sign-in codes are sent to you when you create an account, join a family or sign in on a new phone. You type them into the ZeroPercent app, or on zeropercentapp.com, and nowhere else.
• By text, phone call, email or chat, we will never ask you to tell us or send us your PIN, a sign-in code, or any payment or bank details.
• Your date of birth: we will not ask for it unless you have contacted us first to correct it.
• The only thing we ever ask anyone to text us is the word SAVED, and only from someone added before 25 September 2026 or by an older version of the app. Everyone else agrees on our website instead.
• You only ever type your PIN into the ZeroPercent app or at zeropercentapp.com/rescue.
• If someone asks you for a code you have just been sent, even if they say they are from ZeroPercent or a friend who sent it by mistake, do not give it to them. That is how accounts are taken over.
• Payment only ever happens through Apple's App Store. We never take payment by text, by phone or on our website.

Can someone take over my teenager's number?

In short: they could sign in to the app and see the family's names, and your teenager's own backup contacts, including their numbers. They could not use the rescue page or move the account, and could only reset the PIN after a 24-hour wait that the family is told about.

Phone networks can be tricked into moving a number to a new SIM card, which is called a SIM swap, and old numbers are eventually given to someone new. Whoever holds a number can receive sign-in codes sent to it, and could sign in to the app.

• What they could see. Until the PIN check on a new phone is required for everyone (we will switch it on once everyone has the latest app), someone who has taken over the number and signs in could see the family's names (never the family's phone numbers), and your teenager's own list of backup contacts, with their numbers, because that list belongs to the account.
• You are told. A new sign-in in the ZeroPercent app sends a notification to the account holder and the family's admins (the adults who manage the family), whichever phone it claims to be. Every sign-in is also recorded in the app.
• They cannot use the rescue page, which needs the PIN. The PIN does not come with the SIM.
• They cannot quietly reset the PIN. Changing it needs the current PIN. If it has been forgotten, a new one only takes effect after 24 hours, the account holder and their family are told, and for two hours after it lands the rescue page still will not accept it. If you get that message and did not ask for it, open ZeroPercent on your own phone and cancel it: a phone that was already signed in can cancel without a new code. Or email [email protected] and we will stop it.
• They cannot move the account to another number without the PIN.
• On a new phone the app asks for the PIN, and changing the PIN or the backup contacts in the app also asks for Face ID or the phone's passcode.

What you can do: set a PIN or password on your account with your mobile network (in the US, a port-out PIN or number lock), so the number cannot be moved without it. If a phone suddenly shows "No Service" or "SOS", call the network straight away.

The rescue page on a borrowed phone

In short: guessing is limited, you are told if someone keeps guessing, your PIN is never stored in a readable form, and the session ends on its own.

• Your PIN is the real lock. It is six digits (older accounts may have four), and easy-to-guess PINs are refused.
• Guessing is limited. After a few wrong tries, the rescue page stops accepting attempts for that number, and from that device, for a while. There is also a limit over the whole month.
• You are told. After three wrong tries in an hour, the account holder and the family's admins get a notice. It counts only tries that got the number and the date of birth right, so somebody who knows neither cannot use the notice to pester you, and it is sent at most once a day.
• A wrong answer does not say which detail was wrong: the number, the date of birth or the PIN.
• Your PIN is stored in a form that cannot be turned back into your PIN. We cannot tell you what it is.
• Sessions are short. A rescue session ends by itself after 15 minutes. Sign out before you hand the phone back.
• Rescue messages are deleted from our systems within about a day of the session ending. Our text provider, Twilio, keeps its own copy of each text it sends.

Who can see what

In short: the adult(s) who run your plan see your battery, never your location, your backup contacts or your rescue messages. Your backup contacts only see what you send them.

The adult(s) who run your plan cannot see who your backup contacts are or read your rescue messages. They can see when you last used a rescue, but not who you contacted or what you said.

Our internal activity feed, which tells us the app is being used, shows which country and roughly what age group (for example 13 to 15), and totals. It never shows a name, a phone number or anything anyone wrote.

Children and teenagers

In short: 13 is the minimum age, under-16s need an adult to approve them, and a family with a child in it always keeps an adult.

• You must be 13 or over to have an account.
• 13 to 15 year olds can only join a family, and an adult in that family approves them.
• Everyone who joins a family is approved by an admin first, who sees a partly hidden version of their number and their age group before saying yes.
• A family with someone under 16 in it must keep an adult admin, and the last adult cannot leave or be removed while that child is there.
• No advertising, no selling data, and no location, for anyone.

If someone is using ZeroPercent to keep tabs on you

In short: you can leave a family yourself, at any age, and there is help if you feel unsafe. The full version, with what your family can and cannot see, how to leave, how to change your PIN and who to talk to, is at If someone is using ZeroPercent to control you.

ZeroPercent shows the people who run a family their members' battery, not where anyone is. If you are in a family someone else created and no longer want to be, tap Leave my family at the bottom of your home screen (admins will find it in Settings). Anyone who is not the family's creator can leave, including teenagers. We allow this on purpose, so nobody can be kept in a family against their will. The only other exception is the last adult in a family that still has someone under 16 in it.

If you created the family, you can remove the other person from the Family tab. Then change the code word, then switch them off under Rescue texts from your plan in Settings, and take them off your backup contacts if they are on it.

If you feel unsafe, you do not have to deal with it alone. The helplines for the UK and the US, and a confidential way to reach us, are on that page. In an emergency, call 999 in the UK or 911 in the US.

The technology we use

In short: a handful of well-known companies run parts of ZeroPercent for us, each under contract and only for that job.

The privacy policy has the full list.

New backup contacts have to agree on our website, with a one-time code sent to their number, before we can text them. Replying STOP stops all ZeroPercent texts to that number, from everyone who has added it, including family. Reply START to turn them back on.

What we have not done yet

In short: no certifications, no outside security test and no paid reward scheme yet. Here is what we do instead.

• We do not have a security certification such as SOC 2 or ISO 27001.
• We have not had an independent penetration test (an outside firm trying to break in). In September 2026 we reviewed the app, the rescue page and the database end to end ourselves, and have been working through what we found.
• We do not pay rewards for reported flaws. We do have a vulnerability disclosure policy that promises not to pursue anyone who reports a flaw in good faith.

No system is perfect, including this one. If something goes wrong that affects you, we will tell you what happened and what to do.

Report something

In short: email [email protected], and if you have lost money, call your bank first.

• A message or call pretending to be ZeroPercent: tell us at [email protected]. We aim to reply within two working days. In the UK, and on most US carriers, you can also forward scam texts free to 7726.
• If you have lost money: call your bank straight away. In the UK, report it to Report Fraud on 0300 123 2040, or in Scotland to Police Scotland on 101. In the US, report it at reportfraud.ftc.gov.
• If you think someone has your PIN: change it in the app now, then tell us. The new PIN works on the rescue page straight away and the old one stops. For 24 hours after any PIN change the account's phone number cannot be moved, which is the step a thief would need next.
• A security flaw in ZeroPercent: see how to report a vulnerability.
• A request from the police, a court or another authority: what we hold, how we verify a request and when we disclose is at requests from police and authorities.

Questions