How your phone number is quietly used to track you across apps

You gave your number to Swiggy once. For OTP verification. That's it.

Except that's not really it.

Your phone number isn't just a contact detail

This is the part most people don't think about.

When you hand over your phone number to an app — any app — you're not just giving them a way to reach you. You're giving them an identity token. A unique string that ties together everything you do, everywhere you've ever typed those 10 digits.

Phone numbers don't change much. Unlike email addresses where people have three or four different ones, most Indians have had the same mobile number for years. Sometimes a decade or more.

That makes it perfect for tracking.

How the network actually works

Okay so here's the thing that should bother you more than it does.

Swiggy has your number. Zomato has your number. Amazon has your number. Your bank has your number. That one random app you downloaded in 2019 and deleted three months later — they still have your number.

Each of these companies individually knowing your number is whatever. Fine.

But a lot of these apps share data with the same advertising networks. Google. Meta. A bunch of smaller data brokers you've never heard of.

And when multiple apps all send your phone number to the same ad network — even in hashed form, even "anonymously" — that network can quietly build a profile. Same number showing up from Swiggy, Meesho, MakeMyTrip, and a fitness app? Now someone knows roughly who you are, what you buy, where you travel, what you're interested in.

You didn't sign up for that. You just wanted your biryani delivered.

The WhatsApp angle nobody talks about

When you give someone your WhatsApp number, you're not just letting them contact you.

WhatsApp is owned by Meta. Meta runs Facebook and Instagram. Your number is the thread that connects your activity across all three platforms — even if you have different names, different profile pictures, different personas on each one.

Meta has said they don't use WhatsApp messages for ads. Okay. But your number, your contacts, your usage patterns — that's a different conversation.

And the moment someone you don't fully trust has your WhatsApp number, they have a way to find your Facebook, potentially your Instagram, maybe your linked accounts elsewhere. Phone numbers are surprisingly searchable if you know where to look.

The UPI problem

This one is specifically Indian and specifically underappreciated.

Your UPI ID is often just your phone number @okaxis or @ybl or whatever. So when you pay someone — a shop, a freelancer, a person on OLX — they don't just receive money. They receive a string that contains your phone number.

From that they can find your WhatsApp. Possibly your name. Possibly more.

You were just trying to pay for something. You accidentally handed over a small piece of your identity.

What does "hashed" actually mean and does it matter

Apps often say — don't worry, we only share your number in hashed form. Meaning they run it through an algorithm and send a scrambled version, not the actual digits.

The problem is phone numbers have low entropy. There are only about 700-800 million active mobile numbers in India. A determined system can just hash all of them and compare.

So "hashed" doesn't mean anonymous. It means slightly inconvenient to reverse. That's different.

So what do you actually do about this

Honestly, completely avoiding this is impossible if you use a smartphone in India in 2026. Your number is already out there in too many places.

But you can stop it from spreading further.

For new people you talk to — especially one-time conversations, marketplace deals, freelance discovery calls, anyone you're not sure about yet — there's no reason to hand over your number as the first move.

That's kind of the whole reason GhostCall exists.

You get a link. They get a link. You talk. Call ends. Nobody got anybody's number. The thing that usually starts the whole tracking chain — that first number exchange — just never happened.

It's a small thing. But tracking always starts somewhere. Usually with the number.

The bigger picture

India's data protection law — the DPDP Act — is slowly coming into effect. It's supposed to give people more control over how their data is used. Good. Long overdue.

But laws take time. Enforcement takes longer. And the data that's already been collected, already been shared, already sitting in a hundred different servers — that's not going anywhere.

The only real protection right now is being a bit more careful about who gets your number in the first place.

Which sounds obvious. But most people don't think about it until something weird happens. An unknown number calling at odd hours. Ads that feel too specific. Someone knowing something about you they shouldn't.

By then the number has already traveled further than you think.

Keep your number closer than you think you need to.