Privacy policy

This describes what the operator of this site actually stores. It is written from the database schema rather than from a template, so it should match reality — if you find something here that does not, tell us and we will correct one or the other.

What we collect

• Account — your email address and a hash of your password. The password itself is never stored and cannot be recovered from the hash, only replaced.
• Balance and ledger — every deposit, reservation, charge and refund, with the resulting balance. This is financial record keeping and cannot be deleted while the account is open.
• Activations — which service and country you bought, the number issued, what it cost, and the verification message received on it.
• Administrative actions — when a member of staff changes an account, we log who did it, what changed, and the originating IP address.

What we do not collect

We do not ask for your name, address, date of birth or identity documents to open an account. We do not run advertising trackers or third-party analytics that profile you across other sites.

Verification messages

The message received on a rented number is stored against your activation so you can read it, and because it is the evidence that the activation succeeded and was billable. Treat a rented number as shared infrastructure: do not send anything to it that you would not want retained, and never use one for a message containing personal or financial information.

Why we are allowed to hold it

Account and activation data is processed to perform the contract you entered when you signed up. Ledger and audit records are kept to meet accounting obligations and to investigate fraud, which is our legitimate interest and yours.

How long we keep it

• Activations and their messages: retained while your account is open.
• Financial ledger entries: retained after account closure for as long as accounting and anti-fraud obligations require.
• Audit logs of administrative actions: retained for the same period.

Who else sees it

To issue a number we send the requested service and country to the carrier supplying it. We do not send them your email address or anything else about you. We do not sell data to anyone, for any purpose.

We disclose data to authorities only where legally compelled, and only what the request actually covers.

Your choices

You can request a copy of your data or ask us to close your account and erase what we are not required to keep. Write to the support address listed on the contact page from the address on the account.

Security

Passwords are hashed with a memory-hard function. API keys are stored only as hashes and shown once at creation. The database is not exposed to the public internet. No system is perfect, so use a unique password here and rotate API keys you no longer need.