Privacy policy
What we collect, why, who else sees it, and how long we keep it.
Last updated November 12, 2026
What we collect
- Your email address, to sign you in and send receipts and notices. If you sign in with Apple or Google, we receive the email address (or Apple’s private relay address) and the name they share with us.
- The texts your numbers receive: who sent each one, when, and what it said, including any code in it.
- Payment details: Stripe holds your card. We keep only its brand, last four digits and expiry date, and a record of each payment.
- Technical details: your IP address and browser, used to keep accounts secure and to stop abuse. Passkeys are stored as public keys; your fingerprint or face never leaves your device.
Why
To provide the service you asked for: give you a number, show you its texts, take payment, and renew or extend when you ask. To keep it safe: rate limits, fraud checks and investigating abuse. To meet legal duties, such as keeping payment records. We don’t sell your information, and we don’t use your texts for advertising.
Your texts are private to your account. Our staff can see who sent a text and when, but opening a text’s contents needs a recorded reason, such as a support request from you or a legal request, and every access is logged.
How long we keep it
- Texts: deleted 7 days after the number ends. Our copies of the supplier’s raw delivery notices, which contain the text too, are deleted 7 days after they arrive.
- Your account: until you delete it.
- Payment records: for as long as tax and accounting law requires, even after you delete your account.
- Security logs: [retention period].
Your choices
You can see your numbers, texts and payments in your account, remove saved cards, and delete your account there. Deleting it removes your texts, cards, passkeys and API keys; we keep payment records as described above. Depending on where you live, you may also have the right to a copy of your data, to correct it, or to object to how we use it. Write to us and we’ll answer within 30 days.
Contact
[company legal name], [registered address]. Email [email protected].