Skip to content

Privacy Policy

Last updated 2026-10-15

Plain-language summary

SMSKit is a fully managed, hosted service. You bring the phones and SIMs; we run the platform. We process the message content and recipient numbers you send through us on your behalf and on your instructions, as a data processor. Phone numbers and message content are masked in our logs.

This is scaffolding pending legal review, not legal advice. Final wording will be reviewed by counsel before launch.

1. What we collect

  • Account email address (for passwordless login).
  • Recovery phone number (verified via Twilio Verify).
  • Sign-in times and last dashboard activity, used to run and secure the service.
  • Message content and metadata routed through the service.
  • Device telemetry from paired phones (battery, signal, SIM info, heartbeats).
  • Billing information processed by our payment provider (Paystack).
  • With your explicit in-app opt-in only: SMS history and complete contacts on a paired phone (see section 4, Business SMS archival).

2. Why we collect it

To operate the service: route and deliver your messages, surface delivery state, run the dashboard, bill your account, and secure the platform.

3. How long we keep it

Messages, jobs and received SMS follow your plan window: 1 day on Free and 30 days on Standard. Webhook delivery history and device logs are kept 30 days; phone heartbeats are kept 7 days. Contacts stay until you delete them or the account is deleted. A deleted record leaves backups and webhook delivery history within 30 days. Account data is retained while your account is active. Sign-in events are kept for 365 days. The latest sign-in and dashboard-contact timestamps remain until account deletion.

Close your account from Settings, using Close account. Service stops immediately and your subscription stops renewing. The account is deleted 30 days after your paid time ends, or 30 days after closure if no paid time remains. Sign in before that date to reactivate. After your paid time ends, reactivation returns you to Free with 1-day message history.

A Free account with no sign-in, dashboard use, phone heartbeat or API activity for more than 365 days gets a warning email. It is deleted 30 days after the email is accepted unless you use the account. Any activity cancels the deletion. Paying accounts, including those in the payment grace period, are not deleted for inactivity. Moving to Free restarts the inactivity clock.

4. Business SMS archival

Business SMS archival requires explicit consent on the phone. Open the SMSKit Android app, then Device Details, then Data & Archive, then Enable archiving, or tap Archive existing messages. An inline explanation shows the data before requesting READ_SMS and READ_CONTACTS in both Play and direct builds. After fresh consent, enabling starts automatic uploads of new inbox and sent SMS from that time, and a complete contacts snapshot followed by additions and edits. Older SMS history needs a manual import from the phone, dashboard or API. Changes trigger scans while the gateway runs, with periodic catch-up about every 15 minutes. Android may delay scans. Offline work retries after reconnection; force stop can prevent background work until SMSKit is reopened. Upgrades from manual-only consent require fresh opt-in before either stream starts. Remote requests are rejected until a fresh Android report confirms consent and both grants. Dashboard and API actions cannot grant phone consent. See the phone setup guide and restricted-settings help for missing permissions. Turning off archiving or revoking either permission stops further archive reads and uploads. It does not erase server data.

  • What is stored: sender and recipient phone numbers, the message body, timestamps, and the SIM slot the message belongs to.
  • Contacts: for each contact, the names, phone numbers, emails, postal addresses, organizations and job titles, websites, dates such as birthdays, notes, groups and photo that your phone exposes, with their type labels. Also the account each contact is stored in (account name and type) and whether it is a Google, phone or SIM contact, when your phone reports that. If it does not, SMSKit records the origin as unavailable and never assumes phone storage. The app shows this disclosure again when it changes, and asks you to accept it before further archive reads and uploads. Edits you make in SMSKit change SMSKit's copy only. SMSKit never writes to your phone, Google account or SIM card.
  • Where it lives: on our managed platform.
  • Retention: SMS and request metadata are stored temporarily under plan retention (30 days on Standard), then purged. Contacts remain until deleted through the contacts API or account deletion; they do not use SMS expiry.
  • Deletion & export: delete imported and received messages from the dashboard or API, individually or in bulk. SMSKit send-history rows cannot be deleted through the archive. Export up to 50,000 messages per NDJSON/CSV request; use date ranges or the paginated messages API for larger timelines. Delete contacts through the contacts API or account deletion.

5. Access & roles

As a hosted SaaS, SMSKit is the data processor; you, the customer, are the controller of the recipient data you send through us. See our Terms for data-processing terms.

6. Subprocessors

  • Paystack: billing.
  • Twilio Verify: recovery phone verification.
  • Firebase / FCM: push wake-ups to your phones.

7. Cookies and site analytics

This website, smskit.cloud, uses Google Analytics to count visits and see which pages people read. The dashboard at app.smskit.cloud and the API do not load it. These are all the cookies and browser storage this website sets:

  • _ga and _ga_2JE24F8WTR: set by Google Analytics to tell visits apart. Each lasts up to 2 years and renews when you visit.
  • smskit-cookie-notice: kept in your browser after you press OK on the cookie notice, so the notice does not show again.
  • smskit-theme: kept in your browser when you choose light or dark mode.

Google receives the address of each page you view, including its query string, the page that sent you here, the page title, your IP address, and browser and device details. It also receives what it measures on the page: scrolls, clicks on links to other sites, site search, form use, video plays and file downloads. Google handles this data under its privacy policy. To stop it, block cookies for smskit.cloud or use a browser extension that blocks Google Analytics.

8. Your rights

You can access, export, or delete account data from the dashboard or API. To close the whole account, use Close account in Settings. For other privacy requests, contact support@uwapi.com.

9. Contact

Privacy questions: support@uwapi.com.