Privacy Policy

Effective: November 6, 2026

HeroSMS Companion App ("Hero SMS", "the app") is an independent iOS app for managing a HeroSMS account. This policy explains what happens to your data when you use it.

The short version

The app has no analytics, advertising, tracking or third-party SDKs.
Your API key is stored on your device, in the iOS Keychain.
The app talks directly to HeroSMS, the service you already use.
Code notifications are optional. If you turn them on, a small relay run by the developer delivers them. It never stores your messages or codes, and it keeps your API key, encrypted, only while a number is waiting for a code and you're away from the app (30 minutes at most).
Without notifications, the developer does not collect, store or see any of your data.

Data stored on your device

Data	Where	Why
Your HeroSMS API key	iOS Keychain	To connect to your HeroSMS account
Favorites, recently used services and countries, settings	App preferences on your device	To personalise the app
The HeroSMS service and country list	App cache on your device	To load the app faster

You can delete all of this at any time by signing out in the Account tab or deleting the app.

Data sent to HeroSMS

To show your balance, numbers, codes and history, the app sends your API key and your requests (for example, "buy a number for this service in this country") directly to HeroSMS over an encrypted connection (HTTPS). Service logos are loaded from HeroSMS's image server. HeroSMS processes this data under its own privacy policy and terms, available at https://hero-sms.com.

Apart from the optional notification relay described below, the developer of Hero SMS does not operate any server and never receives this data.

Code notifications (optional)

Notifications are off until you turn them on, from the card on the Numbers screen or in Account › Notifications. When they're on and a number is waiting for an SMS while you're away from the app, a small relay server checks HeroSMS for the code every few seconds. When the code arrives, the relay sends it to your iPhone as a notification.

The relay is run by the developer of Hero SMS on Cloudflare Workers. Cloudflare hosts it and processes this data on the developer's behalf. Apple delivers the notifications through the Apple Push Notification service (APNs). The relay has no analytics, tracking or ads.

What the relay stores

Your API key is covered separately below. Apart from that, the relay stores:

Data	Why	Deleted
A one-way account identifier: an HMAC of your API key, which can't be turned back into the key	To link your devices to your account	When the account's last device is removed
For each device: its APNs push token, a random install ID and the push environment	To send notifications to that device	When you turn notifications off or sign out on that device
Service names	For notification titles	When the account's last device is removed
While a number is being watched: its phone number, activation ID and service name	To label the notification	When the watch ends: the app returns to the foreground, the number is finished or cancelled, 60 seconds after it expires, or after 30 minutes at most
HeroSMS activation and message IDs, and one-way hashes of the message content	To prevent duplicate notifications	48 hours after they were last used

Your API key

It's sent over HTTPS when notifications are turned on, so the relay can confirm it once a day and derive the account identifier. It isn't stored then.
It's stored only while the app is in the background and at least one number is waiting for a code. During that time it's encrypted with AES-256-GCM.
It's deleted as soon as nothing is waiting, when the app returns to the foreground, or after 30 minutes at most.

Your messages and codes

SMS text and codes pass through the relay to build the notification and are never stored. To prevent duplicate notifications, the relay keeps only the IDs and one-way hashes listed above, never the text or codes, and deletes them 48 hours after they were last used.

Webhook (optional)

Account › Notifications shows your personal webhook URL. If you paste it into your hero-sms.com profile (Webhooks), HeroSMS sends new messages straight to the relay, so codes arrive instantly, including for numbers you buy on the website. The relay handles them the same way: it uses them to build the notification and never stores them. You can remove the webhook from your hero-sms.com profile at any time.

Deleting your data

Turning notifications off, or signing out, deletes your device's record from the relay. When an account's last device is removed, everything the relay holds for that account is deleted. To remove your data from the relay, turn notifications off or sign out before you delete the app.

Children

The app is not directed at children under 13 and does not knowingly collect data from them.

Changes

If this policy changes, the updated version will be posted at this address with a new effective date.

Contact

Questions about this policy: itemscenter@icloud.com