Privacy policy

Ninja SMS is an independent online service. When this policy says “we” or “us”, it means the people who run Ninja SMS and decide how your data is used.

• Your email address and a hashed password (we cannot read your password).
• Your purchases: the service, country, number, status, any code received, prices and refunds.
• Your balance history: deposits, charges and refunds, and your deposit and payment references.
• Your IP address, used briefly to limit repeated attempts and stop abuse. It is not stored with your account; an address is only kept if it is blocked for abuse.
• Your support messages and, if you turn it on, your two-factor settings (stored encrypted).
• Your recent sign-ins: the time, a device label (for example “Chrome on Windows”) and a shortened network address (the last part removed), so you can spot a sign-in that was not you.
• If you connect Discord notifications: the channel webhook link you give us. Your codes and deposit amounts are then posted to that channel, which Discord stores under its own terms.
• If you use the contact form: the email address you give, your message, our reply, and the IP address it was sent from (to stop abuse). This is used only to answer you.

To run your account, deliver codes, process deposits and refunds, answer support requests, prevent fraud and abuse, and meet legal and accounting obligations. We do not sell your data.

Staff see it to operate and support the service. Your support tickets (the subject, your messages and the order they are about, but not your email address) are shown to our support team in a private Discord channel, which Discord stores under its own terms. Number supply and payment confirmation involve third-party providers, who receive only what they need to do that job. We disclose data where the law requires it.

We use only cookies the service needs to work, so there is no cookie banner to accept. There is no advertising and no analytics tracking.

• njsms_session: keeps you signed in. Removed when you sign out.
• njsms_reauth: staff only; remembers a password re-check for 15 minutes.
• site_lang: remembers the language you chose for the website, for up to a year.
• Cloudflare Turnstile may set a cookie during the security check on the sign-up and recovery forms, to tell people from bots.

We also keep a few small preferences in your browser’s local storage, such as a dismissed notice. If we ever add analytics or advertising, we will ask for your consent first.

We keep account and ledger records while your account exists and for as long afterwards as the law or legitimate security needs require. When an account is closed, its email address is removed and the account can no longer sign in, but its purchase and payment records are kept as our financial record. Short-lived data is deleted automatically: used or expired password-reset and email links after 7 days, read notifications after 90 days, unpaid payment windows after 30 days, contact-form messages 90 days after they are answered or closed, and sign-in history after 90 days.

You can download a copy of your data, or close your account, yourself at any time from Settings → Account. For a correction or anything else, use our contact form and we will action your request within 30 days. Some records, such as financial history, may have to be kept.

We may update this policy; the date above shows the latest version. Questions about it: use our contact form.