Privacy Policy
Effective Date: October 14, 2026
1. Introduction
DiddySMS ("we," "us," or "our") operates the website at diddysms.com and our public developer APIs (collectively, the "Service"), through which you rent temporary US phone numbers to receive SMS verification codes. The Service offers US numbers only. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Service.
This policy applies to all users of DiddySMS, whether you interact with us through the website or the public API. By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please discontinue use of the Service immediately.
Important note regarding third-party services: When you use a phone number rented through DiddySMS to verify your identity with a third-party service (such as a social media platform, email service, or messaging app), that third party's own privacy policy governs how they collect and process the data associated with that verification. We have no control over and assume no responsibility for the privacy practices of third-party services.
2. Information We Collect
Information you provide directly:
- Your email address and username, which identify your account and either of which you can use to sign in
- Your password, which we store only as a salted one-way hash and never in readable form
- A record of your agreement to the Terms of Service and this Privacy Policy when you create an account: the time you agreed and the version (effective date) of the documents you agreed to
- Legacy account identifiers, such as a username or display name, for accounts created on an earlier version of the Service
- Account preferences and settings you configure within the Service
- Payment and billing information processed through third-party payment processors (we do not store full payment credentials)
- Messages and communications you send to our support team
- Account linking data, for accounts that connected more than one sign-in identity on an earlier version of the Service
- API keys generated for programmatic access to the Service
Information generated through use of the Service:
- Phone numbers you rent and your rental history, including service type, duration, and status
- Transaction data including deposits, charges, refunds, and balance changes
- Your IP address and browser user-agent (the string that identifies your browser and device type). Our servers receive them with every request. We store them with each sign-in session, where they are shown to you on your Account → Sessions page, and in security logs that record sign-ups, sign-ins, failed sign-in attempts, session renewals, and sign-outs
- Historical interaction data from an earlier version of the Service, such as commands issued and the timestamps of those interactions
Information from third parties:
- SMS messages, verification codes, and delivery status for your rented number, received from the telecommunications carriers, networks, and technology services that deliver messages to it
- Payment status and transaction confirmations from payment processors
- Publicly available profile information previously supplied by a third-party sign-in platform used by an earlier version of the Service
3. How We Use Your Information
Service provision and operation: We use your information to create and manage your account, process phone number rental orders, manage your account balance, deliver SMS verification codes, handle refunds, and maintain your transaction history. This is the core purpose for which we collect your data.
Communication: We use your information to respond to support inquiries, send service-related notifications (such as order status updates, balance alerts, and rental expirations), and inform you of material changes to our Terms of Service or this Privacy Policy.
Security and fraud prevention: We enforce rate limits and monitor for abuse to protect the integrity of our platform for all users. We use the IP address and browser user-agent recorded with your sign-ins and sessions to protect your account, to show you where you are signed in, and to detect and investigate unauthorized access.
Service improvement: We use aggregated statistics, including the cookieless web analytics described in Section 7, to understand how the Service performs and how visitors find it.
Legal compliance: We may use your information as necessary to comply with applicable laws and regulations, respond to lawful requests from government authorities, enforce our Terms of Service, and protect our legal rights and the rights of our users.
5. Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. The specific retention periods are as follows:
- Active accounts: Your account data is retained for the duration of your account's existence. You may request account deletion at any time.
- After account termination: Following account closure or deletion request, your personal data is purged within 90 days, except where retention is required by law or a longer period is stated below.
- Sign-in sessions: Each session record, including the IP address and browser user-agent stored with it, is deleted 90 days after the session expires or is ended.
- Security logs: Records of sign-ups, sign-ins, failed sign-in attempts, session renewals, and sign-outs, including the IP address and browser user-agent recorded with each, are deleted 12 months after they are recorded. They are kept for that period even if you close your account, so that unauthorized access and abuse can still be investigated.
- Transaction and payment records: Retained for 7 years to comply with tax, accounting, and financial regulatory obligations.
- Support records: Retained for 2 years from the date of the last interaction to provide continuity of support and resolve recurring issues.
- SMS message text: The full text of messages received on a rented number is deleted 30 days after it arrives. The verification code and the order details stay in your order history.
- Backups: Backup copies of data may persist for up to 90 days after the primary data is deleted, after which they are permanently purged.
6. Your Privacy Rights
Depending on your jurisdiction, you may have certain rights regarding your personal information. We are committed to honoring these rights and making it easy for you to exercise them.
- Right to access: You may request a copy of the personal information we hold about you, including your account data, transaction history, and any associated metadata.
- Right to correction: You may request that we correct any inaccurate or incomplete personal information we maintain about you.
- Right to deletion: You may request the deletion of your personal information. We will process deletion requests within 30 days, subject to exceptions where retention is required by law, necessary for fraud prevention, or needed to complete ongoing transactions.
- Right to opt out of marketing: You may opt out of receiving promotional communications from us at any time. Service-related notifications (such as order confirmations and security alerts) are not subject to opt-out as they are necessary for the operation of the Service.
- Right to object: You may object to the processing of your personal information in certain circumstances, including processing based on legitimate interests.
Web session options: You can sign out of all active sessions at any time from your Account → Sessions page at diddysms.com/account/sessions. Signing out does not automatically delete your account data from our systems; to request account deletion, please contact us.
To exercise any of these rights, open a support ticket at diddysms.com/support, contact us from your account at diddysms.com/account, or email us at . We may need to verify your identity before processing your request.
8. Security
We take the security of your personal information seriously and implement reasonable administrative, technical, and physical safeguards to protect it against unauthorized access, alteration, disclosure, or destruction.
- Encryption in transit: All data transmitted between your device and our servers is encrypted using Transport Layer Security (TLS). API communications and webhook payloads are similarly encrypted.
- Access controls and authentication: Access to user data is restricted to authorized personnel on a need-to-know basis. API keys are hashed using SHA-256 before storage; we never store raw API keys.
- Regular security assessments: We conduct periodic reviews of our security practices, infrastructure, and codebase to identify and remediate vulnerabilities.
- API key security: You are responsible for safeguarding your API keys. Do not share your API key with unauthorized parties, commit it to public repositories, or embed it in client-side code. If you believe your key has been compromised, regenerate it immediately from your account on the website.
Despite our efforts, no method of electronic storage or transmission over the Internet is perfectly secure. We cannot guarantee the absolute security of your information. In the event of a data breach that affects your personal information, we will notify you and any applicable regulatory authorities without unreasonable delay, in accordance with applicable law.
9. Children's Privacy
DiddySMS is intended for use by individuals who are at least 18 years of age. We do not knowingly collect, solicit, or maintain personal information from children under the age of 13 (or the applicable age of consent in your jurisdiction).
If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will take immediate steps to delete that information from our systems. If you believe that a child under 13 has provided us with personal information, please contact us immediately so we can take appropriate action.
10. International Data Transfers
Your personal information may be stored and processed in countries other than the country in which you reside. These countries may have data protection laws that differ from the laws of your jurisdiction. By using the Service, you consent to the transfer of your information to these countries.
Where we transfer personal data outside of your jurisdiction, we implement appropriate safeguards to ensure that your information receives an adequate level of protection. These safeguards may include standard contractual clauses approved by relevant regulatory authorities, reliance on adequacy decisions, or other legally recognized transfer mechanisms.
For users in the European Union or European Economic Area, we ensure compliance with GDPR Chapter V requirements for international data transfers. You may contact us to obtain a copy of the safeguards we have put in place for any specific transfer.
11. GDPR Rights (EU/EEA Users)
If you are located in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) provides you with additional rights regarding your personal data. We process your data under the following legal bases:
- Consent: Where you have given explicit consent to the processing of your personal data for one or more specific purposes.
- Contractual necessity: Where processing is necessary for the performance of a contract to which you are a party (i.e., providing the SMS rental service).
- Legitimate interests: Where processing is necessary for our legitimate interests (such as fraud prevention and service improvement), provided those interests are not overridden by your fundamental rights and freedoms.
- Legal obligations: Where processing is necessary for compliance with a legal obligation to which we are subject.
Under the GDPR, you have the following specific rights:
- Right of access (Article 15): You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to access that data along with supplementary information about how it is processed.
- Right to rectification (Article 16): You have the right to have inaccurate personal data corrected and incomplete data completed.
- Right to erasure (Article 17): You have the right to request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, or where you withdraw consent.
- Right to restriction of processing (Article 18): You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest its accuracy.
- Right to data portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
- Right to object (Article 21): You have the right to object to processing based on legitimate interests or for direct marketing purposes.
- Right to lodge a complaint (Article 77): You have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement if you believe that our processing of your personal data violates the GDPR.
To exercise any of these rights, please contact us using the methods described in Section 14. We will respond to your request within 30 days, or within the timeframe required by applicable law.
12. CCPA/CPRA Rights (California Users)
If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information. This section describes those rights and how to exercise them.
Categories of personal information we collect:
- Identifiers: email address, username, legacy account identifiers, API key identifiers, IP address.
- Commercial information: Transaction history, purchase and rental records, account balance information.
- Internet or other electronic network activity: browser user-agent, and records of your sign-ups, sign-ins, failed sign-in attempts, session renewals, and sign-outs, with the time and IP address of each.
We do not sell personal information as defined by the CCPA/CPRA. We do not share personal information for cross-context behavioral advertising purposes.
Your California privacy rights:
- Right to know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purpose for collecting it, and the categories of third parties with whom we share it.
- Right to delete: You have the right to request the deletion of your personal information, subject to certain exceptions provided by law.
- Right to opt out of sale: Although we do not sell personal information, you have the right to opt out of any future sale should our practices change.
- Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you the Service, charge you different prices, provide a different quality of service, or retaliate in any way for exercising your rights.
To submit a verifiable consumer request, open a support ticket at diddysms.com/support, contact us from your account at diddysms.com/account, or email us at . We will verify your identity before processing your request and respond within the timeframes required by the CCPA/CPRA.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will revise the "Effective Date" at the top of this page.
For material changes that significantly affect how we collect, use, or share your personal information, we will provide prominent notice through one or more of the following methods: a banner on our website, an in-app notification on diddysms.com, or an email to the address associated with your account (if available). We will endeavor to provide such notice at least 30 days before the changes take effect.
Your continued use of the Service after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you should discontinue use of the Service and request deletion of your account before the changes take effect.
14. Contact
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, you can reach us through the following channels:
- Website: diddysms.com
- Support tickets: diddysms.com/support (signed-in customers — the fastest route for account-related requests)
- Email: (for account-related privacy requests, data access/deletion requests, and general privacy questions)
For data rights requests (access, correction, deletion, or portability), please contact us at or through the contact methods listed above. We will acknowledge your request promptly and respond within 30 days. For complex requests that require additional time, we may extend the response period to 45 days, in which case we will notify you of the extension and the reason for it.
If you are unsatisfied with our response to your privacy concern, you may have the right to lodge a complaint with your local data protection authority or supervisory body.