Privacy Policy

Last updated: October 15, 2026

This policy covers the SMSCatch app and smscatch.devinworks.app. SMSCatch is operated by Hunan Wendao Information Technology Co., Ltd. Contact [email protected] with privacy questions or data requests.

Information we process

• Account and sign-in information: guest account identifiers, usernames, sign-in sessions, and identifiers associated with linked sign-in methods. Passwords for username accounts are stored as one-way hashes.
• Apple and Google sign-in: we validate identity tokens and use the provider's account identifier to recognize you. Tokens may contain a name or email address you authorize the provider to share. We do not receive your Apple or Google password, request access to your Gmail, contacts, files, or calendar, or automatically merge accounts by email address.
• Orders and messages: selected services and countries, assigned temporary numbers, order status, and received messages and verification codes. Number providers process information needed to fulfill orders.
• Coins and purchases: balances, coin ledger entries, store transaction records or purchase tokens, and associated account identifiers. We use these to verify purchases, prevent duplicate coins, and handle refunds. Apple processes iOS payments; Google Play processes purchases where that billing option is available. We do not receive complete payment card details.
• Operational information: server and network logs may include IP addresses, request times, and error information used to operate and secure the service.
• Support: messages, contact details, and any files you choose to provide when contacting us. Our current chat service is hosted at support.devinworks.app. Opening chat connects to this service, which processes chat content, contact details you provide, and technical session information needed to provide support. Older app versions may still connect to Tawk.to; see Tawk.to's Privacy Policy for that service. You can contact us by email instead.

How we use and share information

We use information to provide sign-in and account recovery, fulfill SMS orders, maintain coin balances, verify payments, provide support, investigate failures, and prevent misuse. Relevant information is processed by sign-in and payment providers, temporary-number providers, our support service (or Tawk.to in older app versions) when you use chat, and hosting and network providers as needed to deliver these functions. We may also disclose information where required by applicable law.

We do not sell personal information or use Google user data for targeted advertising. The website does not include marketing tracking scripts. Hosting and security providers may process access logs and use technologies needed to deliver and protect the website.

Storage, retention, and security

The app keeps sign-in credentials in device secure storage. Our servers store account, linked identity, balance, and order records. Connections use HTTPS, refresh tokens are stored as hashes, and sensitive message data is encrypted on the server. No system can guarantee absolute security.

We retain information for as long as needed to provide the service, resolve disputes, maintain necessary transaction records, and meet applicable obligations. Retention depends on the type of record and its purpose. In-app account deletion deactivates the account and removes linked sign-in identities and sessions, but does not automatically erase wallet, order, message, payment, or coin ledger records. You can contact us to request deletion of retained data; we will explain any remaining retention requirements. Contact us for information about retention or deletion of a specific record.

Hosting and other service providers may process information outside your country or region.

Your choices and account deletion

You may use a guest account or link a sign-in method. You can request account deletion from the app's account page, or contact us to request access, correction, or deletion. See Account and Data Deletion for instructions and retained-record limitations. Revoking Apple or Google access alone does not delete your SMSCatch account.

Children and policy updates

The service is not intended for minors. Contact us if you believe a minor has provided personal information. We update this page when our practices change and provide appropriate notice of material changes.