Privacy policy

1. Who we are

Smsinbox is developed by an individual developer (a private person, not a company) (“we”, “us”). We are responsible for the processing of personal data described in this policy (the “data controller” or “data fiduciary”).

Contact for all privacy questions and requests, including the grievance officer for users in India: the Smsinbox developer, info@sms-inbox.ru.

2. Data that stays on your phone

Smsinbox works as your default SMS app. To do that it reads and stores on your device:

• SMS and MMS messages, including their text, attachments, phone numbers and dates;

• your contacts (names, phone numbers, photos) to show who wrote to you;

• your phone number and SIM information to send messages from the right SIM;

• scheduled messages, blocklist, favourites, private folder, themes and settings;

• the private folder PIN, stored only as a salted cryptographic hash (PBKDF2).

This data is not sent to us. It is deleted when you uninstall the app or clear its data (messages remain in the Android system message store, as with any SMS app). Please note: the private folder hides conversations inside the app and protects the screen from screenshots, but the messages themselves are not encrypted on the device.

3. Data that leaves your phone

3.1. Cloud backup (only if you start it)

In Settings → Backup you can save your SMS and contacts to the cloud and restore them later, for example on a new phone. To do this you sign in with your Google account.

• Account: your Google account email and identifier, received through Firebase Authentication.

• SMS: phone number of the other party, message text, date sent and received, type (incoming or outgoing) and read status. MMS are not backed up.

• Contacts: contacts that have a phone number, with their names, phone numbers, e-mail and postal addresses, organisation, notes, birthdays and other dates, websites, nicknames and relationships. Contact photos are not backed up.

Each new backup replaces the previous one: the old copy is deleted only after the new copy has been fully saved. Backups made by app versions before 1.8.0 are kept so that you can still restore them. You can ask us to delete any of your backups at any time (see section 8).

3.2. “Seen” marks

When both people use Smsinbox, the sender can see that an SMS has been opened (a blue check mark). For this, when you open an incoming SMS, the app sends a record containing:

• a one-way MD5 fingerprint calculated from the last 10 digits of the sender’s and the recipient’s phone numbers and the message text;

• the fact that the message was viewed and the server time.

The phone numbers and the text themselves are not sent. The sender’s app looks up only the fingerprint of the message it sent. Records are automatically deleted after 30 days. Short service numbers are skipped.

3.3. Feedback

If you send us a message or rating from the app, we receive the text you wrote and, to help us understand the problem: app version, store (Google Play or RuStore), app language and region, Android version, device manufacturer and model, the time it was sent and an anonymous app identifier. We keep feedback for up to 3 years.

3.4. Themes

To show and download decorative themes, the app signs in to Firebase with an anonymous identifier (not linked to your name, phone number or Google account) and downloads theme files from Firebase. The list of themes depends on the region you select in the app or on the country of your Google Play account.

3.5. Crash reports and usage statistics

We use Firebase Crashlytics, Firebase Performance Monitoring and Google Analytics for Firebase to find bugs and understand which features are used. They collect:

• crash and error details, device model, Android version, app version, free memory and similar technical state;

• events such as “message sent”, “message received”, “backup started” — counts only, never the text, phone numbers or names;

• an installation identifier, the advertising ID if your device provides it, and approximate location (country or city) derived from your IP address by Google.

Google retains Analytics data for up to 14 months and crash reports for 90 days.

3.6. Notifications service and Google Play

Firebase Cloud Messaging assigns the app a token so that it can receive service notifications. The Google Play version asks Google Play for the country of your Play account to pick a region; no purchases are made and no payment data is accessed. The RuStore version does not contact Google Play.

4. Why the app needs its permissions

5. Legal basis

We process data: to provide the features you use (backup, “seen” marks, themes, scheduled messages); on the basis of your consent, which you give by starting a backup or sending feedback and can withdraw at any time; and on the basis of our legitimate interest in keeping the app stable and secure (crash reports, statistics). Where a law requires consent for a specific processing, we rely on consent.

6. Who receives the data

• Google LLC (Firebase, Google Analytics, Crashlytics, Google Play) as our service provider (data processor). Google’s privacy policy: policies.google.com/privacy.

• Authorities, only when we are required to by law.

We do not sell personal data and do not share it for advertising.

7. Where data is stored and how long

Firebase stores data on Google servers in the United States and in other countries where Google operates. By using cloud features you understand that your data is transferred outside your country. Google applies its standard contractual and technical safeguards.

All transfers use encrypted connections (HTTPS/TLS). Access to the database is restricted by Firebase security rules.

8. Your rights

Depending on the law of your country, you can ask us to tell you what data we hold about you, correct it, delete it (including your cloud backups), restrict its processing, and withdraw your consent. Withdrawing consent does not affect processing that took place before it.

Write to info@sms-inbox.ru from the Google account used for the backup, or tell us how to identify your data. We reply within 30 days. You can also complain to your data protection authority.

Country-specific information

• India (Digital Personal Data Protection Act, 2023): when the app’s region is India, crash reports, usage statistics and “seen” marks stay off until you allow them in the consent window shown at first launch; you can change your choice at any time in Settings → Privacy. You may contact our grievance officer above; if you are not satisfied with the reply you may complain to the Data Protection Board of India. You may nominate another person to exercise your rights in the event of death or incapacity.

• Indonesia (Law No. 27 of 2022 on Personal Data Protection): you have the rights of access, correction, deletion and withdrawal of consent described above.

• Malaysia (Personal Data Protection Act 2010): you may request access to and correction of your data and limit its processing.

• Philippines (Data Privacy Act of 2012): you may also lodge a complaint with the National Privacy Commission.

• Russia (Federal Law No. 152-FZ): you may withdraw consent and send requests to the contact above; you may also contact Roskomnadzor.

• Brazil (Lei Geral de Proteção de Dados, Law No. 13,709/2018): you have the rights to confirmation of processing, access, correction, anonymisation, blocking or deletion, portability, information about sharing and withdrawal of consent. The contact above also acts as our data protection officer (“encarregado”). You may also petition the National Data Protection Authority (ANPD).

• Mexico (Federal Law on the Protection of Personal Data Held by Private Parties): you may exercise your rights of access, rectification, cancellation and opposition (ARCO rights) and revoke your consent by writing to the contact above.

• Argentina (Law No. 25,326) and Colombia (Law 1581 of 2012): you have the rights of access, rectification, updating and deletion of your data; you may also contact your country’s data protection authority.

• European Economic Area and UK: you also have the right to data portability and to object to processing based on legitimate interest. You may complain to your supervisory authority, for example the AEPD in Spain or the CNPD in Portugal.

9. Children

Smsinbox is not intended for children under 13, or under the age at which your country allows a person to consent to data processing (for example, 18 in India). We do not knowingly collect data from children. If you believe a child has used cloud backup or sent us feedback, contact us and we will delete the data.

10. Changes to this policy

We will publish any changes on this page and update the effective date. If a change significantly affects how we use your data, we will also tell you in the app or in the store release notes.

11. Contact

Smsinbox developer (individual) E-mail: info@sms-inbox.ru