Privacy Policy

Last updated: October 19, 2026 · Applies to www.smsduo.com (SMS Duo)

1. Information we collect

Account: username, email address and your password (stored only as a bcrypt hash).
Sign-up context: IP address at registration, browser language and time zone (fraud and affiliate-abuse prevention, regional statistics).
Service data: orders, the numbers you use and the SMS they receive (shown to you during the session), balance and transaction ledger, support messages.
Payments: top-up amount, method, status and the payment transaction / order IDs. We never receive card numbers or wallet private keys.
First-visit source: landing page, referring website (origin and path only), utm_* parameters and, if you arrived through a Google ad, the Google Ads click ID (gclid, gbraid or wbraid). This is saved with your account when you register.

2. Cookies and local storage

Name	Set by	Purpose
`pn_token` (local / session storage)	SMS Duo	Keeps you signed in
`pn_lang`, `smslai_theme`	SMS Duo	Language and light/dark theme
`pn_ft`	SMS Duo	First-visit source and ad click ID (sent once with registration)
`sd_vid` (cookie + local storage)	SMS Duo	Random visitor ID used to count new visitors; the server stores only a hash, never your IP
`smsduo_did` (cookie)	SMS Duo	Random device ID to prevent abuse of the free trial credit
`sd_consent` (cookie + local storage)	SMS Duo	Your cookie choice (EU/EEA, UK, Switzerland)
`_gcl_aw`, `_gcl_au` and other Google cookies	Google	Google Ads click and conversion measurement (see section 3)

3. Google Ads tag and conversion tracking

Every page loads the Google tag (gtag.js, ID AW-18517979418) from googletagmanager.com. It tells Google that a page was viewed and that a visitor came from one of our ads, and it can set the Google cookies listed above. We report two conversions to Google: a sign-up (only an internal ID such as su-123) and a credited top-up (the USD amount and our internal order ID). A top-up is reported only after the payment provider has confirmed it. We do not send your name, email address, phone number or SMS content to Google. Google processes this data under its own policy: Google Privacy Policy · How Google uses information from sites that use its services.

4. Consent (EU/EEA, United Kingdom, Switzerland)

For visitors in these regions Google Consent Mode v2 starts with all ad and analytics storage denied, and a banner asks you to Accept or Reject. Until you accept, Google cookies are not used for ads. The tag may still send cookieless signals without identifiers, with ad data redaction on. Your choice is remembered in sd_consent. You can withdraw or change it at any time:

Outside these regions the tag runs by default. You can block cookies in your browser, use a content blocker, or manage ad personalisation at adssettings.google.com.

5. Payment processors

Alipay top-ups are handled by a third-party payment aggregator, and crypto top-ups by Plisio or NOWPayments. These providers receive the amount, our order ID and whatever you enter on their payment page. We receive only the payment status, amount and transaction IDs.

6. Risk-check tools

When you use Tools (email, phone number or IP risk check), the value you enter is sent to our third-party risk-check service provider to produce the result. We keep only a masked form and a keyed hash of the input in the usage record, never the full input.

7. How we use and share data

To provide and secure the service, process payments, prevent fraud and abuse, answer support requests and measure our advertising. We do not sell personal data. We share data only with the providers named above, as needed for their task, or when required by law.

8. Retention

Account, order and conversion records: as long as your account exists. You can ask us to delete your account.
Payment and ledger records: as long as needed for accounting and fraud prevention.
Anonymous visitor records (sd_vid hash): deleted after 400 days without a visit.
Cookies: see your browser. Our own cookies expire after at most about 13 months.

9. Security

All traffic uses HTTPS. Passwords are hashed with bcrypt and never stored in plain text.

10. Your rights and contact

To access, correct or delete your data, or to ask anything about privacy, email cuiyy40@gmail.com or contact our Telegram support.