Privacy Policy

When you create an account, we collect your email address and a password. The password is converted into a salted cryptographic hash before storage and is never kept in readable form.

If you contact support, we receive whatever you choose to include, such as your email address, the contents of your message, and any attachments. Please do not send passwords, verification codes, API keys, or other secrets by email.

When you order a temporary number, we record the service and country you chose, the price charged, the number assigned to you, its carrier and status, and any SMS messages received on it, including the sender, the arrival time, and the message text. These records let us show you your code and settle or refund the order.

Your wallet keeps a ledger of every top-up, order charge, refund, and administrative adjustment. When you add funds, we store the requested amount and the payment status reported by our payment processor and, once a transfer is reported, the cryptocurrency and network it arrived on. The payment itself takes place on the processor's own page; we send it the amount and an internal reference, not your email address.

If you create a developer API key, we store only a hash of it, a short prefix that helps you recognize it, and when it was created and last used.

When you use the Services, our servers record technical information such as your IP address, browser and device type, the date and time of each request, the pages and endpoints requested, and response status and timing. Each sign-in session also records the address and browser it was created from and last used from, so that unfamiliar access to your account can be spotted and ended.

We use a single first-party session cookie, smstogo_session, to keep you signed in. It holds an opaque token, of which we store only a hash, and it expires after 30 days or when you sign out. We do not use advertising or third-party analytics cookies. You can block cookies in your browser settings, but you will not be able to sign in without the session cookie.

We use the information we collect to:

• provide, operate, and maintain the Services, including delivering codes and processing refunds;
• authenticate you and keep your account and wallet records accurate;
• respond to support requests;
• send service emails and, where you have not unsubscribed, product updates and announcements;
• monitor, debug, and improve the Services;
• detect and prevent fraud, abuse, and violations of our Terms of Use; and
• comply with legal obligations.

Every announcement email includes an unsubscribe link. Unsubscribing stops announcements but not emails about your own account.

We share information only:

• with service providers that run parts of the Services for us, such as hosting, the phone-number provider that supplies numbers and messages, the payment processor, and our email delivery provider;
• when required by law, regulation, or valid legal process; and
• to protect the rights, security, and integrity of SMSToGo, our users, or others.

Our service providers receive only what they need for their task and are expected to safeguard it. We do not sell personal information.

We keep personal information for as long as needed to provide the Services, maintain accurate business and financial records, meet legal obligations, resolve disputes, and enforce our agreements. Retention varies by type of record; wallet ledger entries, for example, are kept permanently for accounting integrity, while session records expire with the session.

We use reasonable administrative and technical measures to protect information against unauthorized access, disclosure, alteration, or destruction, and limit access to people with a legitimate need. Passwords are stored as salted PBKDF2-HMAC-SHA-256 hashes, and session tokens and API keys are stored only as hashes. No system is completely secure, so we cannot guarantee absolute security.

This policy does not cover third-party websites or services, including the payment processor's checkout page and the services you verify with a number from us. Please review their privacy policies before using them.

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

We may update this policy from time to time. We will post the revised version on this page and update the date above. Continued use of the Services after a change takes effect means you accept the revised policy.

Questions about this policy, or requests to access, correct, or delete your information, can be sent to [email protected].