Privacy policy

• We collect what the service cannot run without: an email address, a password we never actually hold, the orders you place, and the money movements behind them.
• The text of an SMS that arrives on a number you rented is stored — storing it is the product, because that is how you read your code.
• We do not sell data, we run no advertising trackers, and there is no analytics cookie on this site.
• You can ask for a copy of everything we hold about you, or for it to be deleted.

• Account — your email address, your interface language, time zone, and defaults for country and operator. Your password is stored only as an argon2id hash, so we never see or hold the password itself.
• Sessions and devices — for each sign-in, the IP address, the user agent your browser sends, and when the session was created and last used. The list is on your account page and you can end any session from there.
• Two-factor and API keys — a TOTP secret if you enable two-factor authentication, and for each API key its label, a hash of the key, the first characters so you can recognise it, any IP allowlist you set, and when it was last used. The key itself is shown once, at creation, and is never stored in readable form.
• Orders — for every order: the service, country and operator, the phone number issued to you, the price, the timestamps, the status, and the full text of every SMS received on that number together with its sender and the code we extracted from it.
• Ledger — every movement of your balance: top-ups, holds, charges, refunds, bonuses and manual corrections, each with the balance that followed it. This is the accounting record, and it is append-only.
• Support and abuse — messages you send us, and reports we receive about an account.

We do not ask for your legal name, your address, your date of birth or an identity document, and we process no special categories of data — nothing about health, biometrics, politics, religion or anything comparable.

Each of those has one reason, and no second one:

• To deliver the service — a number cannot be issued without an order record, and a code cannot be shown to you without storing the message that carried it.
• To keep the money right — the ledger is what lets you and us agree on a balance, a charge or a refund, and it is what we produce if a payment is questioned.
• To prevent fraud and abuse — session IP and user agent, order patterns and reports are how stolen accounts are spotted and how numbers are stopped from being used for the things the terms forbid.
• Because the law requires it — accounting records, and responses to lawful requests from a competent authority.

We do not profile you for advertising and we make no automated decision with a legal effect on you. The one automatic mechanism that touches your account is the rating, which only throttles ordering and is described in the terms.

This is the part people care about most, so it is spelled out rather than summarised.

The number you are issued comes from one of our upstream carrier partners, which receives the SMS from the carrier before we do and passes it on. Message text therefore passes through that partner's systems as well as ours, and their handling applies to it too. What we send them is the purchase: service, country, operator. We do not send them your email address or your account.

We store the message so that you can read it in your dashboard, come back to it later, and so that support can see what actually arrived if you question an order. It is visible to you, and to our staff when they investigate an order or an abuse report.

Because the number is not yours and the traffic is not private, never send anything sensitive to a rented number, and never use one to receive a message you would not want stored.

• Upstream number providers — as described above. They see the purchase and the message, not your identity.
• Infrastructure providers — hosting, database and email delivery, acting on our instructions and only in order to run the service.
• Authorities — where a lawful request from a competent authority obliges us to respond.
• A successor — if the service changes hands, the records move with it under this policy or one no weaker.

We do not sell personal data, we do not rent mailing lists, and we share nothing with advertisers or data brokers.

• Orders, messages and ledger entries are kept while the account exists and for the period afterwards that accounting and anti-abuse obligations require, because they are the record of a financial transaction.
• Sessions vanish when they expire or when you revoke them.
• API keys remain listed after revocation so that past requests stay attributable, without the key ever being recoverable.
• Account data is deleted or irreversibly anonymised on request, except for records that must be kept — a settled transaction cannot simply be erased from an accounting ledger.

The exact retention windows depend on the operator's jurisdiction and are part of what the operator has to confirm before launch.

This site sets cookies for one purpose: keeping you signed in. The session and refresh tokens are httpOnly, so no script on the page can read them, and they are sent only over HTTPS and only to this site. A small preference cookie remembers your theme and language.

There is no advertising cookie, no third-party analytics tag and no tracking pixel. Nothing here follows you to another site, which is also why you are not being asked to dismiss a consent banner.

• Passwords are hashed with argon2id and are never stored or logged in the clear.
• Refresh tokens and API keys are stored as peppered hashes; the raw value exists only in your hands.
• Provider credentials are encrypted at rest with AES-256-GCM.
• Traffic runs over HTTPS, and your browser never talks to the API directly — requests pass through this site's own server, so no token is ever exposed to page scripts.
• Staff access to production data is limited to what an investigation needs, and administrative actions are written to an audit log.

No system is perfect. If you find a weakness, please tell us before you tell anyone else.

Wherever you live, you can ask us to:

• Show you what we hold about you — most of it is already visible on your account, orders and wallet pages.
• Export it in a machine-readable form.
• Correct anything that is wrong.
• Delete your account and the personal data attached to it, apart from records we are required to keep.
• Object or restrict where we rely on a legitimate interest, such as fraud prevention.
• Complain to your data protection authority if you believe we have handled this badly.

Write from the email address on the account to the contact address below. We answer within 30 days, and if we need longer or cannot act on a request, we say so and explain why.

Open your account page

If this policy changes materially we will say so on the site and, where we hold a verified address, by email. The date at the top is always the date of the version you are reading.

The person or company running this instance is responsible for everything on this page. These fields are deliberately empty until the operator completes them.

Legal entity

To be completed by the operator

Registered address

To be completed by the operator

Contact address

To be completed by the operator