Privacy Policy & Data Governance
SMSRiver enforces strict privacy-by-design standards: automated short-lived data retention, zero surveillance, and complete transparency on public temporary phone numbers.
Messages received by public inboxes are retained for a maximum duration of 24 hours. Automated background workers permanently delete and scrub message contents from disk and memory.
Public temporary numbers are visible to any visitor. Never use public numbers for personal banking, confidential credentials, health records, or sensitive private accounts.
We do not sell personal data, profile visitors, or deploy third-party advertising tracking beacons. We operate exclusively as technical developer infrastructure.
1. Telephony Data Processing & Message Retention
SMSRiver receives inbound SMS messages transmitted via telecom carrier networks (SMPP, SS7, and REST webhook peering). Each message received includes metadata such as sending number, recipient virtual line, timestamp, and message body.
Our automated data retention lifecycle enforces a strict 24-hour retention ceiling for all temporary inbox messages. After 24 hours, raw payloads are permanently excised from D1 SQLite databases and edge caches.
2. Intended Technical Testing Use Case
Public phone numbers provided on SMSRiver are designed exclusively for technical testing, QA automation, and non-sensitive verifications.
Because public inboxes are open to any visitor, users must never send sensitive personal authentication codes, financial 2FA, or confidential data to public lines. For isolated, private verification workflows, developers should utilize private numbers provisioned within their dedicated workspace.
3. Developer Accounts & API Security
When registering for a developer account, we collect only your primary contact email and workspace identification. API keys are hashed and stored using Argon2id cryptographic hashing. We never store plain-text API secrets.
Session cookies are strictly host-only (__Host- prefix) and restricted to HTTPS connections to prevent cross-site request forgery and credential leakage across domains.
4. GDPR & International Compliance Rights
Under the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA), users have the right to request access, rectification, or immediate deletion of any associated account records.
To submit a data subject request or request expedited message removal, contact our privacy operations team at mgmt@adstim.net. Requests are completed within 48 hours.