Privacy Policy

We collect the minimum needed to run the service: an email address, what you ordered, what you paid, and the addresses you connected from. We keep the messages your numbers receive so we can show them to you. We do not sell personal data. We do keep records that identify an account responsible for abuse, and we hand those over when properly asked.

• Account data — your email address, a hashed password (we never store the password itself), and an optional display name.
• Order data — the numbers issued to you, the service and country, timestamps, and the messages those numbers received.
• Financial data — your balance, a ledger of every credit and debit, and the blockchain addresses and transaction ids of deposits. Deposits are pseudonymous; we do not collect card or bank details.
• Technical data — IP address and user agent at sign-up, sign-in, and order, recorded in a tamper-evident log.

We do not ask for identity documents, a real name, or an address, and we do not run third-party advertising or analytics trackers.

Messages sent to a number you hold pass through our systems so we can display them and extract the verification code. They are stored against your order and are visible to you in your dashboard and in your data export.

Treat these numbers as a non-private channel. They are temporary, they are recycled to other customers afterwards, and in the case of numbers labelled shared the inbox is a public web page. Do not have anything sensitive sent to one.

Message content is excluded from what we disclose in response to abuse complaints — it is not needed to identify who placed an order.

Where UK/EU data protection law applies, our lawful bases are:

• Contract — account, order and balance data. Without it we cannot provide the service you are paying for.
• Legitimate interests — the audit log, IP records and abuse controls, so the service is not used for fraud and so we can answer a complaint about it. We think this is proportionate: it is metadata, not message content, and the alternative is being unable to respond to serious misuse.
• Legal obligation — financial records, and responding to lawful requests.

• Number suppliers. To issue a number we tell a supplier the service and country requested. They necessarily see the messages sent to their own numbers. We do not pass them your email address or account identity.
• Infrastructure providers — hosting, email delivery, and public blockchain explorers used to confirm deposits.
• Platforms and law enforcement, in response to a specific, properly-scoped request about a number and a time. We disclose the account, the addresses it used, and when it held the number. We do not disclose message content, and we do not provide bulk access.

We do not sell personal data, and we do not share it for advertising.

• Orders and messages — while your account is open. Deleted with the account.
• Financial records — retained after account closure for as long as accounting law requires, typically six to seven years.
• The audit log — retained after closure in pseudonymised form. It is hash-chained, so deleting entries would destroy the integrity proof for every other record. It is also what lets us answer an abuse complaint, and allowing an abuser to erase it by closing their account would make it worthless. On deletion we remove the IP, user agent and identifying subject from those rows and keep the chain intact.
• Sessions — 30 days, or until you sign out.

Depending on where you live you may have the right to:

• Access and portability — download everything we hold, as JSON, from settings. No request needed.
• Erasure — close your account from settings. See the retention note above for what survives and why.
• Rectification — correct your display name in settings; contact us for anything else.
• Objection and restriction — object to processing based on legitimate interests.
• Complaint — to your local data protection authority.

Passwords are hashed with bcrypt. Sessions are carried in signed, HTTP-only cookies and can be revoked everywhere from settings. API keys are shown only to you and can be rotated at any time. The audit log is hash-chained, so alteration is detectable.

Payment addresses are derived from an extended public key, so no spendable key exists on our servers.

Suppliers and infrastructure are located in several countries, so your data is processed outside your own. Where required we rely on appropriate safeguards such as standard contractual clauses.

We set one cookie: a signed session cookie that keeps you logged in. It is strictly necessary for the service to function, so no consent banner is required. We set no advertising, analytics or tracking cookies.

The service is not for anyone under 18. We do not knowingly collect their data; if we learn we have, we delete it.

For any privacy question or to exercise a right that is not self-service, contact us via support.