Privacy Policy
Last updated: 2 October 2026
Operator and contact
MySMSCodes is operated under the name MySmsCodes Online (registration pending), in Nigeria. Registration is pending; this notice does not claim that MySmsCodes Online is currently a registered company or business. Contact support@mysmscodes.com for privacy and rights requests.
Account and security information
We store account and profile information such as your name, email address, password hash, declared residence and citizenship, account status and policy acceptance. For purchase eligibility we retain the proxy-verified client IP with the order and recheck its country before provider dispatch. We also process session identifiers, IP addresses, browser/user-agent information, email verification and password-reset records, and security/rate-limit records. Passwords are not stored in plain text. Session cookies are used for authentication.
Why we process information
We also store support tickets, their topic, subject, message, account identity, optional related order, status and administrative audit history. Support messages are emailed to our support mailbox through the configured SMTP service; failed notifications remain queued for retry. Support records are retained for as long as reasonably necessary for assistance, dispute handling and legitimate legal or operational purposes. There is currently no automatic support-ticket deletion schedule. Do not send passwords or verification codes in a support request. We use this information to provide and secure accounts, send requested verification and recovery emails, check geographic eligibility, prevent abuse, support users and maintain reliable records. Country lookup takes place locally from the client IP; country headers supplied by a visitor are not accepted as proof of location.
Order and verification information
When you confirm an activation, we store the assigned phone number, provider/order identifiers, selected service/country/operator, prices, wallet transactions, order status and timestamps. Received verification messages may include the sender, full message body, extracted code, receipt time and provider message identifier. Copies can also occur in provider response records used to reconcile an order. Order events retain identifiers and status/financial evidence.
Verification-content cleanup
The current activation-content cleanup runs hourly. For an activation in a terminal state with no unresolved review reason, it deletes stored messages/codes, clears the assigned phone number and order eligibility IP and removes number/message copies from provider response records once the order has not been updated for more than 30 days. This is the current implemented setting, not a promise of deletion exactly 30 days after receipt of a message. Active orders and unresolved review cases are excluded until resolved; there is no automatic maximum duration for those exceptions. Reconciliation history retains candidate order identifiers and status/cost information, not SMS bodies or phone numbers.
Financial and account retention
Order, accounting, wallet, transaction and audit records are distinct from verification-message content. We retain financial/transaction records for up to 7 years where reasonably necessary or legally required for accounting, tax, fraud prevention, disputes and regulatory/legal obligations; afterward we delete or anonymize them where appropriate. Account/profile information is retained while the account is active and afterward only as reasonably necessary for legitimate operational/legal purposes, subject to mandatory retention requirements. These longer-term records require reviewed retention/deletion handling; there is no automatic seven-year purge in the current application.
Sessions and backups
Expired session and verification records and short-lived authentication throttles are periodically cleaned up. Local database backups rotate under a 14-day retention schedule, so a removed record may remain in a restricted backup until it expires. Deletion from our application does not itself delete records independently retained by an upstream provider.
Service infrastructure
The deployed service uses Hostinger for VPS hosting, an SMTP service configured for our business email for account messages, and 5SIM for number availability and order processing. These systems receive information necessary for their functions. The local IP-country database is supplied by DB-IP; no per-visitor geolocation API request is made. Enabled and configured payment gateways process hosted checkout and payment verification for wallet funding.
Privacy requests
For access, correction or deletion requests, contact support@mysmscodes.com. We may verify identity where reasonably necessary. Requests remain subject to applicable legal/financial retention requirements and the need to preserve relevant dispute or security evidence. We aim to minimize verification content rather than retain it as a permanent account record.