Privacy policy
Last updated: 1 November 2026
This privacy policy explains which personal data CodeySMS collects when you use www.codeysms.com, why we do that, how long we keep it and what your rights are. We keep it short and only collect what we need to run the service.
1. Who we are
CodeySMS is responsible for the processing of your personal data as described in this policy. For any question about your data, e-mail us at support@codeysms.com.
2. Which data we collect
- Account details: your e-mail address and a secured version of your password (we never store the password itself). If you sign in with Google, we also store your Google account ID.
- Orders: the website and country you request a number for, the number you receive, the times, the status and the price.
- Received messages: the SMS messages that arrive on your number, the sender and the verification code we find in them.
- Rental numbers: the number, the period, auto-renewal and the messages received on it.
- Balance and payments: top-ups, amounts, the currency, the payment status and the reference of the payment provider. We do not receive your wallet's private keys or bank details.
- API keys: the name you give a key, a secured version of the key, when it was created and when it was last used.
- Ratings: the stars you give after receiving an SMS.
- Technical data: your IP address, used briefly in memory to protect the site against abuse (for example too many login attempts), and short-lived server logs at our hosting provider.
3. Why we use your data
- To provide the service (performance of the contract): creating your account, issuing numbers, showing your messages, managing your balance and rentals, and the API.
- To keep the service safe (legitimate interest): preventing fraud and misuse, enforcing our terms, and making sure a number is never given to another customer for the same website.
- To meet legal obligations: keeping payment records for tax and accounting purposes.
- To contact you about your account, for example when you ask for a password reset.
- To improve the site and measure our ads (only with your permission): with analytics and marketing cookies, see article 4.
We do not sell your data. Without your permission we don't use it for analytics or advertising.
4. Cookies and local storage
Necessary (always on, no permission needed):
- smsr_session: keeps you logged in (30 days, or until you log out).
- g_state: protects signing in with Google (10 minutes, only when you use it).
- Local storage in your browser for your chosen language and currency and for your cookie choice. This stays on your device.
Analytics and marketing (only with your permission): when you click "Accept all" or switch them on under "Settings", we load the following tools. Without your permission they are not loaded at all.
- Google Tag Manager (Google Ireland Ltd.): a tool that loads the tags below. It does not set cookies itself.
- Google Analytics (analytics): measures how visitors use the site, such as pages viewed, the device and the country, with a shortened IP address. Cookies:
_gaand_ga_*, up to 2 years. - Meta Pixel (marketing, Meta Platforms Ireland Ltd.): measures the results of our ads on Facebook and Instagram. Cookies:
_fbpand_fbc, up to 3 months.
We pass on events such as "account created" and "balance topped up" (with the amount) to these tools, never your e-mail address, phone numbers or messages. You can withdraw or change your permission at any time via Cookie settings at the bottom of every page; we then stop the tools and remove their cookies.
5. Who else processes your data
We use a few service providers. They only process data on our behalf and only what they need for their task:
- Render (hosting of the website and database). Our servers and database are located in Frankfurt, Germany, inside the EU.
- Cloudflare (protecting the website against attacks and delivering it quickly). Your requests to the website pass through Cloudflare.
- Resend (sending e-mails, such as password reset links).
- NOWPayments (processing crypto payments when you top up your balance).
- Our telecom provider (supplying the phone numbers and delivering incoming SMS messages).
- Google (Google Tag Manager and Google Analytics, only with your permission; and signing in with Google, only if you choose to).
- Meta (Meta Pixel, only with your permission).
Some of these providers are located outside the European Economic Area. In that case we rely on the safeguards the GDPR requires, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.
6. Legal requests
We only share personal data with authorities when we are legally required to, for example on the basis of a court order or a legally valid request from the police or another competent authority. In an emergency involving an immediate threat to someone's life or safety, we may also share the data needed to prevent harm.
7. How long we keep your data
- Received SMS messages and codes: deleted automatically 90 days after they arrive.
- Account details, orders and rentals: as long as your account exists. When you delete your account, we delete or anonymise them, except what we must keep by law.
- Payment and balance records: 7 years, because the law requires this for our accounting.
- Login sessions: 30 days at most. Password reset links: 60 minutes.
- The link between a number and a website is kept without your name or e-mail address, so we can keep our promise that a number is never given to someone else for the same website.
8. How we protect your data
The site only works over an encrypted connection (HTTPS). Passwords, API keys and password reset links are stored as one-way hashes, so even we cannot read them. No method of sending or storing data over the internet is completely secure, but we do our best to protect your data with these measures. Only you can see your messages when you are logged in, and access to our systems is limited to what is needed to run the service.
9. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to its use, and to receive it in a machine-readable format. You can download all your data and delete your account yourself on your account page. For your other rights, e-mail support@codeysms.com from the e-mail address of your account. We respond within one month.
If you are not happy with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the data protection authority in your own country.
10. Minimum age
CodeySMS is only meant for people aged 18 or older. We do not knowingly collect data from anyone under 18.
11. Changes
We may update this policy when our service changes. The date at the top shows when it was last changed. For important changes we will let you know by e-mail or on the website.