Privacy Policy

1. Data controller

Operator details: see the contact page or write to support@phoneborn.com.

2. Our principles

PhoneBorn is a privacy product, so we hold ourselves to a simple standard: collect as little as possible, keep it only as long as needed, and never sell it.

• We do not ask for your name, address, date of birth, identity documents or personal phone number.
• We do not accept card payments, so we never hold card or bank details.
• We do not sell, rent or trade personal data, and we do not use third-party advertising trackers.

3. Information we collect

Account data. Your email address and a salted hash of your password (we never store the password itself). Optionally, a webhook URL you configure for the API.

Usage and order data. The numbers you buy or order, the services and countries selected, timestamps, renewal settings, refund requests and wallet transactions.

SMS content. The content of SMS messages received by your numbers and of SMS you send from them — this is the service you are paying for.

Call and SMS metadata. For every SMS and call: the other party's number, direction (incoming or outgoing), date and time, call duration and status, and message length. We use it to show your history, count your monthly allowance, apply the replacement guarantee and refunds to the PhoneBorn balance, and detect abuse. We do not record the audio of your calls.

Payment data. For crypto top-ups: the coin, network, amount, deposit address, invoice number and blockchain transaction hash. Blockchain transactions are public by nature; we do not attempt to link them to real-world identities.

Security logs. IP address and user-agent at sign-in and for security-relevant actions (password changes, API key creation), used to protect your account and prevent abuse.

Support messages. Anything you send us through the contact form, tickets or email.

Usage analytics. We use Google Analytics 4 to understand how the website is used in aggregate — pages viewed, referring site, approximate location (country/city), device and browser type. Google Signals and ad-personalisation are turned off, and we never send your email, phone numbers, SMS content or payment details to Google Analytics.

Bot protection. Sign-up, sign-in and contact forms use Cloudflare Turnstile, which processes limited technical signals to distinguish humans from bots.

4. How we use it

• To create and secure your account and authenticate you (via a strictly necessary session cookie).
• To provision numbers, deliver incoming SMS and calls, send your outgoing SMS and connect your outgoing calls, and process renewals and refunds.
• To measure usage against your plan allowances, check refund eligibility (whether a number has had any SMS or call activity) and process number replacements (including the reason you choose when replacing a number).
• To credit crypto payments and produce invoices.
• To send essential service emails — verification codes, password resets, receipts and expiry notices.
• To detect and prevent fraud, spam, bulk messaging, robocalls, abuse and other violations of our Terms, including by applying automated rate limits to outgoing traffic.
• To answer support requests and improve the Service using aggregated, non-identifying statistics.

5. SMS content and call records

Messages sent and received on your numbers, and your call history, are stored so you can see them in your dashboard. They are visible only to you — and to authorised staff when needed to resolve a support request or investigate an abuse report. When a number is released, its messages and call records stay in your history until deleted under the retention periods below; they are never shown to a later holder of the number.

Calls are connected in real time and are not recorded. We do not listen to calls or read your messages for advertising or profiling.

6. Sharing

We share data only when necessary to run the Service:

• Telecom providers that supply numbers and route SMS and calls (they process the numbers involved, message content and call signalling needed to deliver them).
• Google (Google Analytics 4) for aggregate website usage statistics, as described above.
• Payment processors for some crypto networks (invoice amount, address and transaction status — no identity data).
• Infrastructure providers such as hosting, email delivery and bot protection, under confidentiality obligations.
• Authorities, when we receive a valid, legally binding request, or when disclosure is necessary to prevent serious harm. Because we collect so little, what we can disclose is limited.

7. Retention

• Account data: while your account is active; on deletion your email is anonymised immediately.
• SMS content (incoming and outgoing): deleted automatically 90 days after the message was received or sent.
• Call and SMS metadata (numbers, direction, time, duration): up to 12 months, for billing accuracy, allowance tracking and abuse investigations.
• Security logs (IP addresses): up to 90 days.
• Wallet ledger, payment records and invoices: up to 5 years, as needed for accounting and fraud prevention.
• Support conversations: up to 2 years.

8. Cookies

We use one strictly necessary, httpOnly session cookie to keep you signed in, and our bot-protection provider may set cookies needed to operate the security check. Google Analytics sets first-party analytics cookies (_ga and _ga_*, up to 2 years) to count visits. Visitors in the EEA, the UK and Switzerland are asked first, and Google Analytics is not loaded unless they press “Accept”; you can change your choice any time with “Cookie settings” in the footer, block the cookies in your browser, or use Google's opt-out browser add-on — none of this affects the service. We do not use advertising or cross-site tracking cookies. The full list is in our cookie policy.

9. Security

Data is encrypted in transit (TLS). Passwords are hashed with a modern, salted algorithm; API keys are stored hashed and shown to you only once. Access to production systems is restricted and logged. No system is perfectly secure, so please use a unique password and keep your API keys private.

10. Your rights

Depending on where you live you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. You can change your email and password and delete your account yourself in dashboard settings. For anything else, email support@phoneborn.com from your account email address and we will respond within 30 days.

11. Children

The Service is not directed to anyone under 18 and we do not knowingly collect data from children.

12. Changes

We may update this policy as the Service evolves. The "last updated" date reflects the latest version, and material changes will be announced on the website or by email.