Privacy Policy

In short

• We never ask for or collect your own phone number, email, name or a password.
• Your account is anonymous and tied to your device.
• No ads, no analytics SDKs, no tracking; we don't sell your data or build profiles.
• You can delete your account from inside the app at any time.

Data controller

The data controller for the Service is [Şirket / kişi adı] ([Adres]). For any privacy question or request: [email protected].

1. Anonymous account

On first launch the app generates a random account ID (in the format $abantsms-<uuid>) and a random device key, both stored in your device's iOS Keychain.

Our server stores: the account ID, a SHA-256 hash of the device key (the key itself is never stored on the server), your app language, time zone, last sign-in time, token balance and the account creation time.

Purpose: to recognize you without an email or password, tie your balance and numbers to your account, and show the app in the right language and time zone.

2. Numbers and SMS messages

When you buy a number, our server records the service, country, operator, the rented phone number, the price in tokens, status, timestamps and the SMS messages received on that number (sender, full text and the extracted code).

Numbers and SMS messages are provided by the third-party provider 5SIM (5sim.net); SMS content passes through 5SIM on its way to us.

Your own phone number is never collected.

Purpose: to provide the number, show the incoming code in the app, keep your history and refund your token when no SMS arrives.

3. Token ledger

Every token movement (purchase, spend, refund and manual adjustments by support) is recorded together with the balance after it. Purpose: to keep your balance accurate and resolve disputes.

4. Purchases

In-app purchases are processed by Apple. Purchase validation is managed by RevenueCat (RevenueCat, Inc.), which receives your anonymous account ID and purchase data.

Our server stores the sale records reported by RevenueCat: product, transaction ID, price in USD and in local currency, country, store, environment (production/sandbox) and timestamps.

Your card or payment details never reach us.

5. Server logs

To run the Service, fix errors and prevent abuse, each request's method, path, status code, duration and IP address are logged. Request and response bodies are never logged.

6. Service providers and international transfers

Data is shared with the following providers only for the purposes above and only as much as needed:

• 5SIM (5sim.net): providing virtual numbers and SMS messages.
• RevenueCat, Inc.: purchase validation (anonymous account ID and purchase data).
• Apple: processing payments through the App Store.
• Cloudflare: CDN/proxy in front of api.abantsms.site; traffic between the app and our server passes through it.

Some of these providers are located outside Türkiye and outside your country, so data may be transferred internationally. Each provider is subject to its own privacy policy.

7. What we don't do

• We don't show ads.
• We don't use analytics or tracking SDKs, and we don't track you across apps or websites.
• We don't sell or rent your data or use it for profiling.

Clipboard: the app copies the incoming code to the clipboard only when the "Auto copy" setting is on (it is on by default) or when you tap the copy button. You can turn the setting off in the app.

8. Retention and deletion

Profile → Delete My Account in the app deletes your account, numbers, SMS messages and token ledger immediately. Deletion isn't possible while a number is still waiting for an SMS; cancel the number or let it expire first.

Sale records are kept for accounting and legal obligations, but without the link to your account. Your customer record at RevenueCat is deleted as well.

Unused tokens are lost when the account is deleted.

Server logs are rotated by the hosting environment and older logs are removed.

9. Children

The Service is not intended for anyone under 18.

10. Your rights

Under KVKK (Türkiye, art. 11) and the GDPR (EU/EEA) you have the right to access your data, have it rectified or erased, object to processing, receive it in a portable format, and lodge a complaint with a supervisory authority (the Personal Data Protection Board (KVKK Kurulu) in Türkiye, or your local data protection authority in the EU).

To exercise your rights, write to [email protected]. Because accounts are anonymous, we may ask for additional information to verify which account a request belongs to. The fastest way to delete everything is Delete My Account in the app.

11. Changes

We may update this policy. The current version is always on this page, with the date at the top.

12. Contact

[Şirket / kişi adı], [Adres] · [email protected]