Privacy policy

This Privacy Policy (the "Policy") sets out what data the SemySMS service (the "Service") processes, for what purposes, for how long it is retained and how it can be deleted. The Policy applies to the semysms.net website, the Service API and the SemySMS Connect app published on Google Play (the "SemySMS Connect App").

The Service allows the user's Android phone to be used as an SMS gateway. Messages are not sent by the Service: the app on the phone receives a job from the server, and the message is transmitted from the user's SIM card, through the user's mobile carrier and from the user's phone number. The Service is neither a mobile carrier nor the sender of messages; it passes jobs to a phone that the user has linked to their account.

Data is processed solely for the operation of the Service: maintaining the account, passing jobs to linked phones and showing the user the status of messages and phones.

The Service does not build advertising profiles, does not sell user data and does not disclose it to third parties, except as set out in section 6.

The calling and SMS features of the SemySMS Connect App are available without an account. A user account with the Service is required only for the Connect feature, which is enabled separately. Information on the SemySMS Connect App is provided in section 8, and the procedure for deleting data and the account in section 9.

Account data: the email address used as the login, the password, time zone, interface language, and the dates of registration and last sign-in. A first and last name are optional. The password is stored only as an irreversible hash; the Service has no access to the password in plain text.

Data on linked phones: device name and model, manufacturer, Android version, app version, mobile carrier, SIM card phone number (if the app on the phone transmits it; the SemySMS Connect App does not), battery level, time of last activity and the limits set by the user. For phones with the SemySMS Connect App, the App installation code and the Firebase Cloud Messaging push token are also stored (see section 8). This data is shown to the user on the Devices page of their account.

Messages: for outgoing messages - the recipient's number, the text, the time, the delivery status and the IP address from which the sending request was received; for incoming messages - the sender's number, the text and the time. If the user has enabled the transmission of incoming call details, the number and time of the call are stored. The content of conversations is neither recorded nor transmitted.

Contacts: only contacts added to the Service by the user - manually, by import from a file or text, or by uploading the phone book: number, first name, last name, middle name, email address, date of birth and note. The phone book is uploaded only upon a separate action of the user.

Payments: the fact of payment, the amount and the invoice number. Bank card details are entered on the payment system's side; the Service does not receive or store them.

Messages are retained no longer than necessary for the operation of the Service and are deleted automatically within the following periods:

• incoming messages and call details - 3 months after they are received by the Service;
• sent messages - 5 months after the message date; sent messages of a phone unlinked from the account - 2 months after the message date;
• campaigns - moved to the archive 2 months after creation or start; campaign messages are deleted within the periods above;
• API token statistics - no longer than one month.

These periods are maximum periods. The user may delete any message earlier in their account or through the API.

Account data (email address, language, time zone) is retained for as long as the account exists. The procedure for deleting the contacts of inactive accounts is set out in section 4.

If no sign-in to the account (authorisation on the website) has occurred for 6 months, the account's contacts are deleted.

The account itself is retained and sign-in remains possible; however, deleted contacts cannot be recovered. The account may be deleted at the user's request in accordance with section 9.

Messages are sent from the user's phone, through the user's SIM card and from the user's phone number. For the recipient, the mobile carrier and under the law, the sender is the owner of the phone number, not the Service.

The owner of the account and the phone is responsible for:

• the content of messages - the Service does not compose, modify or review them;
• the choice of recipients and their consent to receive messages;
• compliance with the laws on advertising, personal data and communications in the recipient's country;
• payment for the services of the mobile carrier, which charges for messages under the user's tariff.

The Service does not moderate the content of messages: it passes jobs to the user's phone and displays the result of sending. Complaints from recipients and blocking of a phone number by the mobile carrier are matters between the owner of the number and the carrier. The Service may block an account used for spam or for fraudulent purposes.

Certain data is processed by third parties for the operation of the Service:

• The mobile carrier whose SIM card is installed in the user's phone receives the number, text and time of each message, as it transmits the message.
• Google: Firebase Cloud Messaging is used to notify apps of new jobs, reCAPTCHA to protect the sign-in and registration forms, Google Analytics to count website visits, and Firebase Analytics and Firebase Crashlytics to collect usage statistics and crash reports of the SemySMS Connect App (see section 8). When signing in with a Google account, only the email address is passed to the Service. The processing of data by Google services is governed by the Google Privacy Policy.
• Payment systems receive the amount and the invoice number when services are paid for. The processing of bank card data is governed by the policies of the respective payment systems.

The website uses cookies to keep the user signed in and to remember the selected language and theme. Google Analytics uses its own cookies in accordance with Google's policy. No advertising networks are used on the pages of the Service.

Self-service deletion. Messages and contacts are deleted by the user in their account or through the API. A phone is unlinked from the account in the app or on the Devices page; sent messages of an unlinked phone are kept for no more than 2 months from the message date.

Account deletion is carried out at the request of the account owner in accordance with section 9.

Changes to the Policy. A new version of the Policy is published on this page with the date of the update. Individual notices of changes to the Policy are not sent.

Contacts. Questions regarding data processing should be sent to admin@semysms.net.

The SemySMS Connect App is an app for calls and SMS published on Google Play. It may be set as the default phone and SMS app. The calling and SMS features are available without an account; until the Connect feature is enabled, the App does not transmit messages, call details or contacts to the servers of the Service.

Data processed on the device. The following data is processed on the phone and used solely for the operation of the App:

• SMS and MMS - to display conversations and to send and receive messages;
• calls and the call log - to make and receive calls, display call history and block numbers on the blocklist;
• contacts - to display names and to search, create, edit and delete contacts;
• SIM card information - to select the SIM card for a call or a message and to display the mobile carrier;
• notifications - to notify the user of new messages and incoming calls.

SMS, the call log and contacts are stored by the Android operating system. The App stores on the device its settings and the blocklist and allowlist numbers.

Data transmitted from the device:

• Messages and calls are transmitted through the user's mobile carrier.
• Contacts saved in the App (name, phone number, email address) are written to the phone's address book, into the account where the user's contacts are stored (usually Google). Synchronisation with cloud storage is performed by that account.
• Usage statistics and crash reports. The App uses Google Firebase Analytics and Firebase Crashlytics, which transmit the App installation ID, the advertising ID, information about the screens opened and the duration of sessions, and technical details of crashes. Names, phone numbers and message texts are not transmitted. This data is used to fix errors and to analyse the use of features.
• Connect feature data - only after the feature is enabled by the user (see below).

The Connect feature links the phone to the user's account with the SemySMS Service. Once enabled, the App receives SMS sending jobs from the Service and automatically sends messages using the connected SIM cards, including in the background when the App is not open. Jobs are created through user actions or automation configured by the user. SMS charges are determined by the user's mobile carrier plan.

The Connect feature is disabled by default. The user enables it in the App settings after explicitly consenting to data transmission on a separate screen. Until then, the App does not connect to semysms.net. Once the feature is enabled, the App transmits the following data to semysms.net:

• phone information: manufacturer, model, Android and App versions; for SIM cards connected to the Connect feature - the mobile carrier, network code and slot number; battery level and charging state;
• the installation code created by the App when the Connect feature is enabled, and the Firebase Cloud Messaging push token. The Service identifies the phone by the installation code and a secret key; push notifications are used to notify the phone of new jobs;
• the result of each job received from the Service: status, time of sending, delivery or failure, and the number of SMS parts. The App receives the recipient's number and the message text from the Service as part of the job and does not transmit them back;
• incoming SMS (sender's number, text, time, SIM card) - only for SIM cards for which the user has enabled sending incoming SMS to the site. SMS containing confirmation codes and SMS from short and alphanumeric senders are transmitted only if the corresponding separate settings are enabled for the SIM card;
• incoming call details (caller's number and time of the call, SIM card) - only for SIM cards for which the user has enabled sending incoming calls to the site. Conversations are not recorded.

The Connect feature does not transmit the address book or the conversations and call log stored on the phone before it was enabled. SMS sent under jobs received from the Service are kept in the conversations on the phone.

Data is transmitted over a secure connection to semysms.net only and is stored in the user's account with the Service to which the user has linked the SIM cards using linking codes. Sections 1-7 of the Policy apply to it, including the scope and retention periods of data (sections 2 and 3), responsibility for sending SMS through the Service (section 5) and the involvement of third parties (section 6).

Stopping the transmission of data. Sending incoming SMS and call details is disabled in the card of a SIM card, and receiving jobs is suspended with the "Online" switch. The "Unlink the phone from the website" action in the Connect settings stops the exchange of data completely.

Disclosure of data to third parties. Data is not sold and is not used for advertising purposes. The App transmits Connect feature data only to the SemySMS Service; statistics and crash reports are processed by Google on behalf of the Service.

Data protection. Connect feature data, statistics and crash reports are transmitted over a secure connection. Other data is stored on the phone under the protection of the Android operating system: only apps to which the user has granted access can access messages, calls and contacts.

Deletion of data and the account, retention periods - see section 9.

Procedure for deleting a SemySMS account and all its data:

1. Send an email to admin@semysms.net from the email address the account is registered to, with the subject "SemySMS account deletion". Sending the email from that address confirms that the request comes from the account owner.
2. Within 30 days, the account, the phones and SIM cards linked to it, messages, call details and contacts are deleted from the Service's production systems, and a reply to the email is sent.

Deleting individual data without deleting the account:

• Unlinking the phone. The "Unlink the phone from the website" action in the Connect settings stops the exchange of data with the Service; the installation code, the secret key and the push token are deleted from the phone immediately.
• Messages and call details in the account are deleted by the user in their account or through the API; otherwise, automatically within the periods set out in section 3.
• Usage statistics and crash reports (Google Firebase Analytics and Firebase Crashlytics) are processed by Google; their retention and deletion periods are determined by Google and set out in Privacy and Security in Firebase and the Google Privacy Policy. A request to delete statistics may be sent to admin@semysms.net with the subject "SemySMS Connect data deletion", stating the phone model and the approximate date the App was installed; if the records can be identified unambiguously by these details, they are deleted within 30 days.
• App settings and call filter lists are deleted when the App is uninstalled from the phone; the collection of statistics stops at the same time.
• Contacts saved through the App are stored in the phone's address book and are deleted there.

Data that is retained: SMS, the call log and contacts on the phone. They are stored by the Android operating system, so unlinking the phone or deleting the App or the account does not affect them.