SMSTunnel lets you write texts on your computer (at smstunnel.io or in the desktop app) or from your own software and have your own Android phone send them from your number — and, if you turn it on, sync the texts your phone receives back to your account. This policy covers the SMSTunnel website, web dashboard, Android app, desktop app for Windows and Linux, browser extension for Chrome, SMSTunnel for Shopify, and API.

1. Who We Are

SMSTunnel is provided by NARBOWEB SRL, a company registered in Romania, which is the controller of your personal data.

Company: NARBOWEB SRL
Privacy questions and requests: privacy@smstunnel.io
General contact: contact@smstunnel.io
Website: https://smstunnel.io

2. What Data We Collect

Account information: your name and email address, and a hashed password — or, if you sign in with Google or Facebook, the account ID they give us.
Sign-in and connection data: the IP address and device or browser type of your sign-ins and of your phones (and the IP address an API key was created and last used from), for security.
Your phones: device name and model, Android and app version, a device identifier, a push-notification token (Firebase Cloud Messaging), online status and, if you use end-to-end encryption, the phone's public key.
Messages you send: the recipient's number, the text, the time and the delivery status, for texts you write in the dashboard or the desktop app, or that your own software hands over with your API key.
Messages you receive — only if you turn on "Sync received texts": the sender's number, the text and the time it arrived (and, on dual-SIM phones, which SIM received it). See section 3.
Names you save: names you give to numbers in the dashboard or the desktop app, or import from a file, so texts show who they're from or to. They stay in your account until you delete them or your account. If you allow it on a key, the app using that key, for example your AI app through the SMSTunnel MCP server, can look up these names to find a number. Your phone's contacts are never shared this way.
API keys, webhooks and usage: your API keys (stored hashed), their permissions and last use, webhook settings, and usage counters (for example texts sent today).
SMSTunnel for Windows and Linux (desktop app): where it connects and what it keeps on your computer are in section 5.
SMSTunnel for Chrome (browser extension): keeps your API key, your default phone and your country code in the extension's local storage in that browser profile, on that computer; they are never synced to your Google account. It sends to smstunnel.io only your API key, the number and the text of each message you send, and the requests for your list of phones and for a message's status. It does not read the pages you visit: Chrome passes it only the number or text you right-click and choose to send. It has no ads and no analytics.
Payments: handled by Stripe. We store your plan and subscription status, never your card number.
Website: technical data such as IP address and browser, and Google Analytics visit statistics. Analytics cookies are set only if you click "Accept All" in the cookie banner; otherwise Google Analytics runs without cookies (see our Cookie Policy).

Texts you write are stored in your account so you can see your history and their status. With optional end-to-end encryption (supported integrations such as the WordPress plugin, and "Encrypt for my phone" in the desktop app), we store only the encrypted text, which we cannot read.

3. Received-Text Sync ("Sync received texts")

Optional and off by default. The app explains it on screen and asks for your agreement before Android asks for the permission to receive SMS.
Only new texts. Only texts that arrive after you turn it on are collected. Your existing SMS inbox and conversations are never read: the app does not request the permission to read SMS, and it is not your default SMS app.
Only you can see them: in your dashboard, and through API keys you explicitly allow to read received messages (permission sms:inbox, off by default). Websites and apps you link with a QR code or a standard API key cannot read them.
How they are protected: they travel over encrypted connections (TLS) and are stored in your account in readable form, so the dashboard can show them; they are not end-to-end encrypted.
How long: they stay in your account until you delete them (one by one or with "Delete all messages") or delete your account.
Turning it off: anytime in the app's Settings — collection stops immediately.

4. Mobile App Permissions

Send SMS: to send, from your phone's SIM and number, the texts you wrote on your computer or that your own software handed over. Your carrier's normal SMS rates apply.
Receive SMS (optional, off by default): only for "Sync received texts", as described in section 3.
Camera: only to scan the QR code that links the phone. No photos or videos are taken, stored or sent.
Phone: only to let you choose the sending SIM on dual-SIM phones.
Notifications and background service: to keep the link to your computer running and show its status.
Internet: to connect to your SMSTunnel account.

The app does not access your contacts, location, photos or SMS inbox, and it shows no ads.

5. The Desktop App (Windows and Linux)

SMSTunnel for Windows and Linux shows the texts in your SMSTunnel account and lets you write texts that your own phone sends. It collects nothing beyond what section 2 lists for your account.

Where it connects: only to SMSTunnel's own servers: dashboard.smstunnel.io for your account, your texts and the live connection to your phones, and smstunnel.io for updates. On a Windows computer without Microsoft Edge WebView2, which draws the app's window, the installer downloads it from Microsoft.
Signing in: your password is sent once, to sign in, and is never stored. The app keeps you signed in with a sign-in token kept in your operating system's keychain: Windows Credential Manager, the Secret Service on Linux (GNOME Keyring or KWallet) and, once there is a macOS version, the macOS Keychain. Signing out deletes it.
Your texts: the app shows them from your account, as the dashboard does: the texts you send and, if you turned on "Sync received texts", the texts your phone receives (section 3). It doesn't save texts on your computer; it holds them in memory while it runs. On your computer it keeps only its settings (language, theme, notifications, tray), the email address you last signed in with, to fill in the sign-in form, and when you last opened each conversation, by phone number, to mark new texts as unread.
Notifications: while notifications are on, each text your phone receives appears in your computer's notifications with the sender's number and, unless you turn that off, the text. Your operating system may keep them until you dismiss them.
Encryption: your texts are stored in your account as sections 2 and 3 describe, and they are not end-to-end encrypted, except a text you encrypt with "Encrypt for my phone": of that one, we store only the encrypted text, which we cannot read.
Updates: a few times a day, the app checks smstunnel.io for a new version. It downloads updates from smstunnel.io and installs them only if they are signed with SMSTunnel's update key.
No ads, analytics or tracking. Like any program that connects to a server, its requests show our servers your IP address and name the app, its version and your operating system (see "Sign-in and connection data" in section 2).
Removing it: signing out deletes the sign-in token. Uninstalling removes the app; on Windows, tick "Delete the application data" in the uninstaller to remove its settings too.

6. How We Use Your Data

To provide the service you asked for: hand your texts to your phone, show your message history and, if you turned it on, your synced texts (contract)
To manage your account, subscription and invoices (contract and legal obligation)
To send you service emails, such as password resets (contract)
To keep the service secure and prevent abuse, for example rate limits and blocking premium-rate numbers (legitimate interest)
Website analytics, only with your consent

We do not sell your data and we do not use it for advertising. Our staff do not look at your messages, except when that is needed to answer a support request you send us or to investigate abuse.

7. Service Providers

We use these providers to run SMSTunnel. Each processes data only for the purpose listed:

Amazon Web Services (AWS, USA): hosts our servers and our database, on encrypted disks, and sends account emails through Amazon SES.
Google Firebase Cloud Messaging: wakes your phone when a text is waiting for it. The wake-up message carries only a technical signal and your phone's push token — no message text and no phone numbers.
Google Sign-In and Facebook Login (Meta): only if you choose to sign in with them; they share your name, email address and account ID with us.
Stripe: payment processing for paid plans.
Google Analytics: statistics about visits to the smstunnel.io website only (not the apps), with analytics cookies only if you accept them.

8. International Transfers

Some of these providers process data outside the European Union, mainly in the United States. These transfers are covered by the European Commission's Standard Contractual Clauses (and, where the provider is certified, the EU-U.S. Data Privacy Framework).

9. Data Security

All data is encrypted in transit using TLS 1.2 or higher
Our database and its backups are stored on encrypted disks
Passwords are hashed using bcrypt, and API keys are stored hashed
Your messages and synced texts are visible only to your account
Optional end-to-end encryption for supported integrations: we store only encrypted text we cannot read

10. Data Retention

Account, phones, API keys and settings: as long as your account exists.
Your message history (sent texts and, if sync is on, received texts): until you delete those messages or your account. There is no automatic expiry.
Names you save: until you delete them or your account.
Technical server logs: kept for a limited time (up to 30 days) for security and troubleshooting.
Invoices and payment records: as long as tax law requires, even after your account is deleted.
SMSTunnel for Shopify: what it keeps for a store, and for how long, is in section 14.
SMSTunnel for Wix: what it keeps for a site, and for how long, is in section 15.

11. Your Rights (GDPR)

You have the right to:

Access: request a copy of your personal data
Rectification: correct inaccurate data
Erasure: delete your data (see section 13)
Portability: receive your data in a standard format
Restriction and objection: limit or object to certain processing
Withdraw consent: for example, turn off "Sync received texts" or reject analytics cookies at any time

To exercise these rights, contact us at privacy@smstunnel.io. You can also complain to your data protection authority; in Romania this is the ANSPDCP (www.dataprotection.ro).

12. Cookies

We set no cookies of our own: your browser's local storage keeps you signed in and remembers your preferences (language, cookie choice). Google Analytics cookies are set only if you accept them. See our Cookie Policy for details.

13. Deleting Your Account and Data

In the app: Settings → Delete account → confirm. Your account and its data (profile, linked phones and connections, message history including synced texts, names you saved, API keys, webhooks and usage statistics) are deleted immediately.
Without the app: email privacy@smstunnel.io from your account's email address. We delete the account within 7 days and confirm by email. Details: smstunnel.io/delete-account.
Only some data: delete messages, names, phones or API keys yourself in the dashboard, or ask us — see smstunnel.io/delete-data.

After deletion we keep only invoices and payment records required by tax law.

Facebook Login deletion requests: if you remove SMSTunnel from your Facebook settings and ask for your data to be deleted, Facebook forwards the request to us, and the SMSTunnel account linked to that Facebook login, with its data, is deleted as soon as Facebook forwards the request. Facebook gives you a confirmation code (SMT-…); its status and our contact for questions are at smstunnel.io/delete-data.

14. SMSTunnel for Shopify

SMSTunnel for Shopify is an app for the Shopify App Store, made by NARBOWEB SRL. A store that installs it sends texts about its orders from the store's own Android phone, through SMSTunnel. For the store's customers, the store is the controller of their data and we process it on its behalf, under our merchant terms.

What the app reads from Shopify: for each order the store chose to text about, the order number, the total or the refunded amount, the tracking link or number, the link to the order's status page, the customer's name and first name, and the phone number on the order (from the shipping address, the checkout or the customer's account). It reads these protected fields only with Shopify's approval.
What it does with it: it writes the text the store set up (for example "Acme Outdoor: your order #1001 is on its way") and sends it, one text to one number, from the store's phone. Texts to the store's own numbers say which order came in and who placed it. Only texts about the customer's own order; never advertising.
What the app keeps: for each text, for 30 days: the time, the kind of text, the order number, whether it went out, the number's last 2 digits and a keyed hash of the number (so a customer's records can be found and erased). Never the words of the text, never the full number. The store's settings (its own numbers, the words of its texts) until the store uninstalls the app.
What SMSTunnel keeps: the texts themselves (number, words, status, time), in the store's message log at smstunnel.io, so the store's phone can send them and report their status, and replies the phone receives while it is signed in as the store. Kept for 30 days, then deleted. A store that links its own SMSTunnel account keeps them in that account, under the rest of this policy.
Who else: the texts leave from the store's phone over its mobile carrier, like any text the store sends. Our hosting providers are listed in "Service Providers" (section 7) above. Shopify sends us the order data. Nothing is sold or shared for advertising.
Your rights as a customer of a store: ask the store; Shopify passes the request to us. A request for your data: we gather what we and SMSTunnel keep for each of your phone numbers and give it to the store within days. A request to be erased: we erase each of your numbers from the app's records and from the store's message log at SMSTunnel. You can also write to privacy@smstunnel.io.
When a store uninstalls the app: its SMSTunnel link stops at once; 48 hours later Shopify asks us to erase the store's data, and we erase everything the app holds for it and its message log at SMSTunnel (unless the store installed the app again in between).
Security: everything travels over TLS; the stores' keys, privacy requests and exports are encrypted in our database; backups are encrypted; access is limited to NARBOWEB's administrators; the logs hold no phone numbers, emails or texts.

15. SMSTunnel for Wix

SMSTunnel for Wix is an app for the Wix App Market, made by NARBOWEB SRL. A site that installs it sends texts about its orders and bookings from the site owner's own Android phone, through SMSTunnel. For the site's customers, the site owner is the controller of their data and we process it on their behalf, under our terms for site owners.

What the app reads from Wix: for the orders and bookings the site owner chose to text about: the order number, the total or the refunded amount, the tracking link, number and carrier, the service booked with its day, time, time zone and staff member, the customer's name and first name, and the phone number on the order or the booking with the country of its address. About the site: its business name, time zone, language and country, its plan for the app, and which of Wix's own apps it has.
What it does with it: it writes the text the site owner set up (for example "Acme Outdoor: your booking for Haircut on Thu, Nov 12 at 2:30 PM is confirmed") and sends it, one text to one number, from the site owner's phone. Texts to the site owner's own numbers say which order or booking came in and from whom. Only texts about the customer's own order or booking; never advertising.
What the app keeps: for each text, for 30 days: the time, the kind of text, the order number or the service, whether it went out, the number's last 2 digits and a keyed hash of the number (so a customer's records can be found and erased). Never the words of the text, never the full number. An event from Wix waits encrypted until its texts are sent (minutes, at most 12 hours), then only its id stays, for 7 days. A booking reminder keeps the customer's number and the booking's details encrypted until it is sent or the booking is canceled. The site's settings (the owner's numbers, the words of the texts) until the app is removed.
What SMSTunnel keeps: the texts themselves (number, words, status, time), in the site's message log at smstunnel.io, so the phone can send them and report their status, and replies the phone receives while it is signed in for the site. Kept for 30 days, then deleted. A site linked to its owner's own SMSTunnel account keeps them in that account, under the rest of this policy.
Who else: the texts leave from the site owner's phone over its mobile carrier, like any text the owner sends. Our hosting providers are listed in "Service Providers" (section 7) above. Wix sends us the order and booking data. Nothing is sold or shared for advertising.
Your rights as a customer of a site: ask the site's owner, or write to privacy@smstunnel.io. A request for your data: we gather what we and SMSTunnel keep for your phone number and send it within 30 days. A request to be erased: we erase your number from the app's records and from the site's message log at SMSTunnel.
When a site removes the app: its texts stop at once; 48 hours later we erase everything the app holds for the site and its message log at SMSTunnel (unless the app was installed again in between).
Security: everything travels over TLS; the sites' keys, the events waiting to be sent and the reminders are encrypted in our database; backups are encrypted; access is limited to NARBOWEB's administrators; the logs hold no phone numbers, emails or texts.

16. Children

SMSTunnel is intended for people aged 18 or over and is not directed at children.

17. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email or through the service, and the date at the top always shows the latest version.

18. Contact Us

If you have questions about this privacy policy, please contact us:

Email: privacy@smstunnel.io
Contact form: smstunnel.io/contact

Privacy Policy