Privacy Policy

1. Who we are

SmsGrab (“we”, “us”) runs the SmsGrab Android app, the server it connects to and this website, smsgrab.com. This policy applies to all three. It does not apply to the apps and websites you use our numbers with; their own privacy policies apply there.

2. Information we keep

We keep only what we need to sell you a number, show you the codes it receives and protect the service from abuse:

• Account details. For an email account: your email address and your password, which we store only as an Argon2 hash and never in readable form. A guest account has no email address or password; it is identified only by a random account ID.
• Device identifier. The app creates a random identifier when it is installed and sends it with its requests. We store only a SHA-256 hash of it. We use it to give any starting credit only once per device, to tie your sign-in sessions to the device that opened them and to detect referral abuse, such as someone inviting themselves.
• Sessions. Sign-in (refresh) tokens are stored only as hashes, together with the hashed device identifier, and expire after 30 days at the latest.
• Activations and rentals. For every number you rent: the service and country you chose, the phone number, the price, the status and the relevant times.
• Received messages. The text of each SMS that arrives on a number you rented, the code we extract from it and the sender, so that we can show them to you.
• Balance ledger. Every movement of your in-app balance, such as starting or promotional credit, referral rewards, purchases and refunds, with its amount, currency and time.
• Promotions and referrals. The promo codes you redeem, your referral code, the invitations you sent or accepted and the status of their rewards.
• Push notification tokens. If you allow notifications: your device’s notification token, the platform, the app version and your language setting, used only to tell you that a code has arrived or that a number is about to expire.
• App server and security logs. The servers behind the app log requests (the path, the result and the duration, plus the app version and the account ID) to keep the service running. Security events such as sign-ins, failed sign-ins, lockouts and referral checks record your IP address and device identifier only as a keyed hash (SHA-256 with a secret server-side key, shortened to 12 characters), so the app servers never write your raw IP address to their logs or database.
• Website server logs. The web server for smsgrab.com keeps standard access and error logs: your IP address, the time, the page you requested, the result, the page that linked to it and your browser’s user agent. We use them only to keep the site secure and to block abusive traffic automatically, and they are deleted after 14 days.

Apart from the website logs above, IP addresses are used only in memory and only for a short time, to limit the number of requests and sign-in attempts coming from one network.

3. What we do not collect

We do not ask for your name, your own phone number, your contacts or your location. The SmsGrab server and this website use no cookies, advertising identifiers, analytics tools or third-party trackers, and we never sell or rent your data to anyone.

4. Why we use it and on what legal basis

• To provide the service you ask for: creating your account, renting numbers, showing the codes you receive, keeping your balance and giving refunds (performance of a contract).
• To keep the service safe and fair: rate limits, sign-in lockouts, one starting credit per device and checks against referral and promotion abuse (our legitimate interest in preventing fraud and abuse).
• To keep records of charges, credits and refunds (our legal obligations and our legitimate interest in accurate accounting).
• To send push notifications, only after you allow them in your device settings (your consent, which you can withdraw at any time by turning notifications off).

5. Who we share it with

We share data only with the service providers we need to run SmsGrab, and with each of them only as much as it needs:

• 5sim.net, our number provider. It supplies the virtual numbers and delivers the messages they receive to us, so the text of those messages passes through 5sim. We place orders with 5sim under our own account and send it only what an order needs (the country, the service and the order itself). We never send it your email address, your device identifier or your IP address.
• Google Firebase Cloud Messaging, only when push notifications are enabled. A notification contains the service name, the phone number and, for a received code, the code itself.
• Our hosting and infrastructure providers, which store and process data on our behalf.
• Public authorities, when the law requires us to disclose information.

To show prices in your currency we download public exchange rates from an exchange-rate service (open.er-api.com). That request contains no personal data.

6. International transfers

Our providers may process data in countries other than your own. Where the law requires it, we rely on appropriate safeguards for these transfers, such as standard contractual clauses.

7. How long we keep it

• SMS messages and codes: deleted automatically 30 days after they arrive.
• Activations: once an activation has ended, its phone number is removed 365 days after the purchase. The rest of the record (service, country, price and status) stays for accounting.
• Rentals: kept until you delete your account; their messages follow the 30-day rule above.
• Guest accounts: deleted automatically after 30 days without use if they never had a balance entry or an activation.
• Sign-in sessions: 30 days at most.
• Push notification tokens: deactivated when you sign out, and deleted after 90 days without use or when you delete your account.
• Balance ledger: kept as long as accounting and tax rules require, and anonymised when you delete your account.
• Account details: until you delete your account.

8. Deleting your account

You can delete your account at any time in the app under Settings > Account > Delete account. An email account confirms with its password; a guest account confirms by typing the confirmation word shown in the app. Deletion takes effect immediately:

• all your sign-in sessions are ended on every device;
• your email address and password hash are removed;
• the phone numbers of your activations and rentals are erased, and all received messages are deleted;
• your push notification tokens and stored request records are deleted.

The entries of your balance ledger remain, no longer linked to any email address, because we have to keep financial records. Any balance left in the account is lost when it is deleted. You can sign up again later with the same email address; the new account starts empty. If you cannot use the app, write to support@smsgrab.com from the email address of your account.

9. Your rights

Depending on where you live, including under the EU General Data Protection Regulation (GDPR) and Türkiye’s Personal Data Protection Law (KVKK, Law No. 6698), you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to certain processing, including processing based on our legitimate interests;
• receive the data you gave us in a portable format;
• withdraw your consent at any time, without affecting earlier processing;
• complain to a data protection authority, such as the Personal Data Protection Board (KVKK) in Türkiye or the supervisory authority of your EU country.

To use these rights, write to support@smsgrab.com. We may ask you to confirm that the account is yours before we act on a request.

10. Security

Connections to our servers are encrypted. Passwords and sign-in tokens are stored only as hashes, IP addresses and device identifiers appear in the app’s security logs only as keyed hashes, and access to our systems is restricted. No system is perfectly secure, so please use a strong password for SmsGrab that you do not use anywhere else.

11. Children

SmsGrab is not intended for anyone under 18. Do not use the app if you are under 18. If you believe that a minor has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy when the service or the law changes. We will change the date at the top and, for significant changes, tell you in the app before they take effect.

13. Contact

For any question about privacy or this policy, write to support@smsgrab.com.