DRAFT — This document requires owner/legal review before publication. It reflects the current code behavior as of the date above.
1. Summary
SMSly collects only the data needed to provide one-time virtual phone numbers for SMS verification, process purchases, and enable optional account recovery. We do not sell personal data. No trackers, analytics SDKs, or advertising IDs are embedded in the app.
2. Data Controller
Timotty Two LLC (app package com.apexmobile.smsservice). Contact: support@edgpt.site.
3. Data We Collect
3.1 Anonymous device account (created on first launch)
- Device secret (32 random bytes) — generated in the Android Keystore / iOS Keychain. Only its SHA-256 hash is sent to and stored by our server. The raw secret never leaves your device.
- Platform — "android", "ios", or "web" (optional, provided by the client).
- Device label — first 8 hex chars of SHA-256(user ID). Derived server-side; not a hardware identifier. Used for support.
3.2 Optional Google / Apple sign-in (Firebase Authentication)
- Firebase UID — stable identifier for the Firebase user.
- Provider subject ID — Google
sub or Apple pairwise sub (stored in user_identities).
- Email — verified by the provider. For Apple "Hide My Email", a
@privaterelay.appleid.com address.
- Display name — from the provider profile.
We never receive your Google/Apple password. Firebase ID tokens are cryptographically verified server-side via Firebase Admin SDK (RS256).
3.3 Activation and SMS data
- Service ID, country ID, phone number, provider activation ID.
- Cost (Activations), status, timestamps (created, expired, completed, refunded).
- Received SMS: verification code (OTP) and raw message text. Stored in
activations and sms_messages tables.
3.4 Wallet ledger
- Every debit/credit: type (
ACTIVATION, REFUND, ACCOUNT_DELETION_FORFEITURE, ACCOUNT_MERGE_OUT/IN, etc.), amount, balance before/after, idempotency key, description, timestamp.
- RevenueCat webhook events (purchase, renewal, cancellation) stored in
webhook_events.
3.5 Metrics (aggregated, no PII)
Structured logs emitted via CloudWatch EMF: activation counts, durations, delivery rates, wallet events, provider API latency, error rates, database query latency. No user identifiers in metrics.
3.6 Data we do NOT collect
- Advertising ID (GAID/IDFA), IMEI, Android ID, vendor ID.
- Location, contacts, call logs, SMS from your personal inbox.
- Keystrokes, screen recordings, or any analytics/tracking SDKs.
4. Purposes and Legal Bases
| Data | Purpose | Legal Basis (GDPR) |
|---|
| Device secret hash | Identify anonymous account across sessions | Contract performance (Art. 6(1)(b)) |
| Firebase UID, provider IDs, email, name | Authenticate linked account, enable recovery | Contract performance (Art. 6(1)(b)) |
| Activation records, SMS text | Deliver the verification code service | Contract performance (Art. 6(1)(b)) |
| Wallet ledger | Process purchases, refunds, prevent fraud | Contract performance + Legal obligation (Art. 6(1)(b),(c)) |
| Metrics | Monitor reliability, debug, capacity planning | Legitimate interest (Art. 6(1)(f)) |
| Error and crash reports | Find and fix crashes and errors in the app and the server | Legitimate interest (Art. 6(1)(f)) |
5. Third-Party Processors
- Google / Firebase Authentication
- Identity verification for linked accounts. Processes Firebase UID, provider subject ID, email, name. Privacy Policy.
- Google Play Billing / RevenueCat
- Purchase processing, receipt validation, subscription/webhook management. Processes order IDs, product IDs, timestamps. RevenueCat Privacy Policy.
- TemporaSMS
- Phone number allocation and SMS delivery. Receives service code, country code, operator strategy. Does not receive your identity. TemporaSMS Privacy Policy.
- Supabase (PostgreSQL)
- Hosted database for all persistent data. Supabase Privacy Policy.
- Sentry (Functional Software, Inc.)
- Error and crash reports from the app and the server: the error message and where in the code it happened, the app and OS version, the device model, free memory and storage, locale and time zone, connection type, and a random installation identifier. Before a report leaves the device or the server, verification codes, phone numbers, email addresses, account identifiers, tokens and request bodies are removed from it, and we have set Sentry not to store IP addresses; Sentry may still record the approximate country and city it derives from the network address a report arrives from. Development builds send nothing. Sentry Privacy Policy.
- Firebase Hosting
- Hosts this legal site. Firebase Privacy Policy.
All processors are bound by data processing agreements. We do not sell personal data.
6. International Transfers
Our server and database (Supabase) are hosted in the United States. Firebase, RevenueCat and Sentry are US-based. TemporaSMS operates from the United States. If you are in the EEA, transfers to the US rely on Standard Contractual Clauses or the EU-US Data Privacy Framework as applicable.
7. Retention
- Account data (email, display name, Firebase UID, provider identities)
- While account is
active. On deletion: email/name nulled, Firebase UID cleared, identities deleted. User row kept with status = 'deleted'.
- Wallet ledger (
wallet_transactions)
- Permanent (ON DELETE RESTRICT) — tax, accounting, anti-fraud.
- Activations and SMS messages
- Permanent (ON DELETE RESTRICT) — audit, dispute resolution.
- Rentals
- Permanent (ON DELETE RESTRICT).
- Webhook events
- Permanent.
- Device credentials
- Revoked on deletion, row retained.
- Metrics logs (CloudWatch)
- Kept only as long as necessary for the purposes described in this document and as required by applicable law. CloudWatch retention settings apply.
Note — Metrics logs and backups are retained only as long as necessary for operational, security, and compliance purposes, and as required by applicable law.
8. Your Rights
- Access / portability — Request a copy of your data via support@edgpt.site (include your device label from Profile).
- Deletion — Use Profile → Delete account and all data in the app, or email us if you cannot access the app.
- Rectification — Email us to correct inaccurate data (e.g., display name).
- Objection / restriction — Email us to object to processing based on legitimate interest (metrics).
- Withdraw consent — Unlink Google/Apple in Profile (removes provider identity; account becomes anonymous).
We respond within 30 days. Identity verification (device label + email) may be required.
9. Children
SMSly is not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it.
10. Security
- Device secret stored in hardware-backed keystore (Android Keystore / iOS Keychain); excluded from cloud backup.
- Server stores only SHA-256(secret); the hash table cannot be used to sign in even if leaked.
- Firebase ID tokens verified cryptographically (RS256) via Firebase Admin SDK.
- HTTPS/TLS for all network traffic.
- Rate limits: 10 new accounts/hour/IP, 60 device calls/15 min/IP.
- Access tokens: 15-min JWT with
token_version for instant revocation on deletion/merge.
11. Changes to This Policy
We may update this Policy. Material changes will be notified in-app with a new effective date. Continued use constitutes acceptance.
12. Contact
Questions, requests, or complaints: support@edgpt.site.
Supervisory authority: your local data protection authority (e.g., ICO in the UK, CNIL in France, or the relevant authority in your jurisdiction).