Privacy Policy

textbee is an open-source SMS gateway built and run by Nuver Labs (“textbee”, “we”, “us”). This policy explains what information we collect when you use the hosted service, why we collect it, and the choices you have.

The hosted service includes textbee.dev, the dashboard at app.textbee.dev, the textbee API, and the textbee Android app when it is connected to the hosted service.

If you host textbee yourself, your instance does not send us any data. The person or company that runs a self-hosted instance is responsible for the data in it.

Information you give us

• Account details: your name, email address, password and, if you add it, your phone number. We store your password only as a one-way hash, so nobody can read it.
• Google sign-in: if you sign in with Google, we receive your name, email address, profile picture and Google account id.
• Support requests: what you write to us by email, in the support chat or in the dashboard, and your contact details.
• Payment details: you enter these at checkout with our payment provider, Polar. We receive your plan, subscription status and billing address, never your card number.

Information from your phones

When you connect a phone, the textbee app sends us what it needs to deliver messages and to show you the phone's status:

• Device details: the name you give the phone, brand, manufacturer, model, Android version and build, app version and a push notification token.
• SIM details: carrier and SIM name, SIM slot, network country, SIM card identifier, signal level and roaming state.
• A status report about every 30 minutes and when you change app settings: battery level and charging state, network type, uptime, free memory and storage, time zone and language, app permissions, power-saving state and app settings.

The app does not read your phone number, contacts, call history, location, photos or the messages already in your inbox. It uses the camera only to scan the QR code during setup, and it does not save or send images.

Messages and webhooks

• Messages you send: the recipient, the text, the SIM used, the status and any error, with timestamps.
• Messages you receive: only when you turn on receiving in the app. We store the sender, the text, the time and the SIM. Your filter settings in the app decide which messages are forwarded.
• Webhooks: the addresses you set up and a history of each delivery, including what we sent, the response code and the start of the response.

Information collected automatically

• Connection details: your IP address, the country it belongs to and the name of the tool or library that calls the API.
• Browser details: your device type, operating system and browser when you sign up and sign in.
• Usage: numbers of messages, devices and API keys, your plan usage, and steps such as your first message.
• How you found us: the campaign link, referring website and landing page that brought you to textbee. See Cookies and analytics.

• To run the service: send and receive messages, connect your phones, call your webhooks and show your history in the dashboard.
• To keep accounts safe and stop abuse: sign-in, email verification, bot checks, rate limits, and spam and scam detection.
• To manage your plan, limits, payments and invoices.
• To answer your support requests.
• To email you. Service emails cover verification, password resets, usage limits and payment problems. Product emails cover setup tips, new features and offers, and each one has an unsubscribe link.
• To improve textbee, using usage statistics, analytics and app crash reports.
• To see which websites and campaigns bring people to textbee.
• To meet legal duties and to enforce our Terms of Service.

We use your information for one of these reasons:

• We need it to provide the service you asked for.
• We have a legitimate interest in keeping textbee secure and making it better.
• The law requires it.
• You agreed to it.

The messages you send and receive, and the phone numbers in them, belong to you and the people you text. We handle them for you, to deliver them, show them to you, send them to your webhooks, and protect and improve the service.

• Only authorized members of our team can access message data, and only to fix problems with the service, give support you ask for, investigate abuse, or when the law requires it.
• We use automated checks to find spam and scams. These checks can include AI models run by our service providers. They receive the message text only, without phone numbers or account details.
• You are responsible for having permission to text the people you message. Our Terms of Service explain the rules.
• If someone you texted contacts us, we may pass their request on to you, or review the account if they report abuse.

We do not sell your personal information. We share it only with service providers that help us run textbee, and only what each one needs:

Cloud hosting and database providers

Run our servers and store the service data.

Google Firebase Cloud Messaging

Delivers send requests to your phone, including the message text and recipient.

Google Firebase Crashlytics and Analytics

Crash reports and basic usage data from the Android app, with the device model and app version. Firebase Analytics can also read the phone’s advertising ID.

Google Sign-In

Signs you in when you choose to use your Google account.

Cloudflare

Network security and the bot check on our forms. It also tells us which country a connection comes from.

Polar

Payments, subscriptions and tax. At checkout it receives your name, email address, IP address, account id and how you found textbee.

Amazon Web Services

Sends our emails to you.

SupportHQ

Our support chat, also built by Nuver Labs. An AI assistant answers first and our team can take over. It receives what you write and, when you are signed in, your account id, name, email address and phone number.

AI model providers

Help us screen messages for spam and scams. They receive message text only.

Analytics providers

Google Analytics and other analytics tools. See Cookies and analytics.

Your webhook endpoints

Receive the message events you subscribe to.

We also share information in these cases:

• When the law requires it, or to protect people from fraud, scams or harm. This can include sharing with law enforcement, mobile carriers and the people affected.
• If textbee is part of a merger, acquisition or sale. The new owner must respect this policy.
• When you ask us to, or agree to it.

This section covers the hosted service only. A self-hosted instance loads none of these tools unless its operator adds them.

We use cookies and similar technologies to keep you signed in, remember your settings, and understand how people find and use textbee.

• Essential cookies keep you signed in and protect our forms. The dashboard does not work without them.
• Preferences, such as your theme, stay in your browser. If you enter an API key in the API playground, your browser keeps it for up to 30 days.
• Analytics: we use Google Analytics, and we may use other analytics tools, to count visits and see how people use our pages so we can improve them.
• Marketing measurement shows us which websites and campaigns bring people to textbee.

These tools can receive information such as the pages you visit, your device and browser details, your IP address and, in some cases, account details such as your email address.

You can block or delete cookies in your browser settings, and tracking protection or an ad blocker stops most analytics tools. textbee works normally either way, except that the dashboard needs its sign-in cookies.

Account and message data

While your account is open. This includes messages, devices, webhooks and their delivery history.

Connection records

IP addresses are removed 180 days after we last see them. The list of countries your account was used from stays with your account. Support requests and payment records keep the IP address they came from.

Deleted devices, API keys and webhooks

They stop working right away. We may keep relevant metadata about them for security and support.

Emails we send you

A copy stays with your account so we can confirm delivery and help with support. Verification links, password reset links and codes, and unsubscribe links are removed from the copy.

Support conversations

As long as we need them to help you and keep a record.

Payment records

As long as tax and accounting rules require.

Server logs

Kept for troubleshooting and security.

You can delete your account from your account settings in the dashboard. We then delete your account data within 30 days, except what we must keep for legal, tax, security or fraud-prevention reasons. Backup copies expire on their normal schedule.

• All traffic to textbee uses encrypted connections (HTTPS). Webhook deliveries are encrypted when your webhook address starts with https.
• We store passwords as one-way hashes. We store API keys in hashed form, plus the first few characters so you can tell keys apart. We show the full key only once, when you create it.
• Only authorized team members can access account data.
• Bot checks and rate limits protect sign-in and the API.

You can help: use a strong password, keep your API keys secret and delete keys you no longer use. No system is perfectly secure. If a security incident affects your data, we tell you as the law requires. To report a security issue, email security@textbee.dev.

In the dashboard

• Update your name and phone number.
• Delete devices, API keys and webhooks.
• Delete your account.

Emails and cookies

Every product email has an unsubscribe link. Service emails, such as password resets and payment notices, continue while your account is open. To control cookies, see Cookies and analytics.

Your rights

Depending on where you live, you can ask us to:

• Give you a copy of your personal information.
• Correct information that is wrong.
• Delete your information.
• Send your information to you in a portable format.
• Stop or limit some uses of your information.
• Withdraw a consent you gave earlier.

To make a request, email support@textbee.dev from the email address on your account. We may ask you to confirm your identity. We reply within 30 days and do not treat you differently for using these rights. You can also complain to the data protection authority where you live.

textbee serves people around the world. We and our service providers process data in several countries, which may be different from yours. We give each provider only the data it needs for its job.

textbee is for adults and is not directed at children. We do not knowingly collect information from anyone under 18. If you think a child has given us information, contact us and we will delete it.

We update this policy when our service or the law changes. The date at the top shows the latest version. If a change is significant, we tell you by email or in the dashboard before it applies.

For questions about this policy or your information, email support@textbee.dev.