This app is a default-SMS-replacement app for Android that organizes your incoming messages into a calm, categorized inbox. This policy describes exactly what data leaves your device, why, and who processes it. Nothing here is boilerplate — every claim below reflects the app's actual code.
The short version
- No account. No cloud. The app has no backend. Your text messages, contacts, and phone state are read from your device's own storage (Android's system SMS provider + your phone contacts) and processed in an on-device Room database that lives inside the app's sandbox. Uninstall the app and every byte it stored is gone with it.
- Nothing leaves your phone by default. The app does not upload, sync, or transmit the content of your messages, the numbers you text, or the codes you receive. Ever.
- We show ads. The app is ad-supported. The Google Mobile Ads SDK loads a banner, an interstitial (frequency-capped), and native rows from Google's servers. These requests carry your device's Advertising ID and standard ad-request metadata (IP address, coarse device type, language). We do not sell or share your data with any third-party advertiser directly.
- We collect anonymous crash + usage counts via Firebase Crashlytics and Firebase Analytics. Neither captures the content of your messages or your contacts. Both are disabled in debug builds.
What the app reads from your device (never uploaded)
| What | Source | Why |
|---|---|---|
| SMS and MMS messages | Android system SMS provider (content://sms, content://mms) | To display and organize your inbox |
| Contact names + numbers | Android system contacts (ContactsContract) | To resolve numbers to names in your inbox |
| Notification preferences | Android system notification channels | To let you tune per-category ringing |
All of this is read from Android's own APIs, held in memory or in the app's on-device database, and used only to render the UI. None of it is sent to any server we control (because we have no server).
What the app sends over the network
Four categories of traffic leave your device — all to Google-operated services. Nothing else.
1. Ad requests — Google Mobile Ads (AdMob) and, if you consent, Google's ad partners via UMP consent.
- Data sent: Advertising ID (a resettable device identifier), IP address, coarse device / language / country info, the ad slot being loaded.
- Not sent: any message content, phone number, contact name, call information, or app-specific behavioral data.
- Consent: In the EEA and UK, the app shows Google's UMP consent form on first launch. Personalized ads are only requested if you consent. In other regions, ads are non-personalized by default unless you enable otherwise.
- Google's handling: https://policies.google.com/privacy and https://support.google.com/admob/answer/6128543
2. Anonymous analytics + crash reports — Firebase.
- Firebase Analytics: event counts (screen viewed, feature used, message sent, tab changed). No message content, no phone number, no contact name.
- Firebase Crashlytics: stack traces and device model when the app crashes. No user-content in the payload.
- Firebase's handling: https://firebase.google.com/support/privacy
3. Feature-flag config — Firebase Remote Config.
- Data sent: your Firebase Installation ID (a resettable per-install identifier managed by Google's Firebase SDK), plus standard SDK metadata (app version, SDK version).
- Not sent: any message content, phone number, contact name, or app-specific behavioral data.
- Purpose: fetch a small JSON key-value blob that toggles features and tunes runtime parameters (ad frequency, notification behavior, kill switches). Applied to the app's runtime config; not stored beyond that fetch.
- Frequency: once at cold start + occasionally in the background (Google's default cadence, at most once per hour).
- Google's handling: https://firebase.google.com/support/privacy
4. In-app announcements — Firebase Cloud Messaging (FCM).
- Data sent: your device's FCM registration token (managed by Google's Firebase SDK) is registered with Google. No server we control stores it (we have no server).
- Data received: occasional short announcement pushes (new feature notices, app-update tips) from the app owner via Firebase Console's Cloud Messaging → Campaigns UI.
- Delivery target: a dedicated "Announcements" notification channel, separate from your SMS notifications. You can disable announcements from Android Settings → Apps → Messages → Notifications → Announcements → Off, without affecting SMS notifications.
- Not sent: any message content, phone number, or contact information.
- Google's handling: https://firebase.google.com/support/privacy
That's it. No third-party analytics SDKs, no marketing tracker outside Firebase's own push channel, no cloud backup of your messages.
What we do NOT collect
- Your name, email, phone number, or any account identifier — the app has no sign-in.
- The text content of any message you send or receive.
- The numbers you text.
- Your location. The app does not request location permission. Google's ad service may infer approximate location from your IP address on its side; that's covered under Google's policy above, not ours.
- Your browsing history, other apps installed, or any cross-app data.
Where the data lives, and for how long
Everything the app creates is inside your app sandbox on this device:
- The Room database of your categorized messages
- Your notification-channel preferences and OTP purge interval
- The list of senders you blocked
Retention: as long as you have the app installed. Uninstalling deletes all of it in a single system operation.
The two external services (AdMob and Firebase) retain data under their own retention policies:
- AdMob impressions: up to 26 months (Google's default).
- Firebase Analytics: up to 14 months (Google's default), anonymized.
Your rights
Because the app doesn't create an account or upload identifiable data, "delete my data" is effectively "uninstall the app" — see [Delete your account](./delete-account) for the exact steps. If you have questions about the Advertising ID or the anonymous data Google receives from your ad requests, use Android Settings → Google → Ads → Delete advertising ID (or Reset advertising ID). This applies system-wide across all your apps and Google honors it for this app's ad requests going forward.
If you are in the EU/UK (GDPR), California (CCPA/CPRA), or another region with equivalent rights, the on-device-only design means most requests (access, correction, deletion, portability) are answered by opening the app — the data is right there in your inbox. For the small anonymized analytics stream Firebase receives, Google is the data controller; use their portal at https://policies.google.com/privacy to exercise those rights.
Children
The app is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has been using the app and you'd like their data removed, since everything is stored on-device, uninstalling is the complete answer.
Changes to this policy
If we materially change what the app does with data (e.g. we add cloud sync or a new SDK), we will post the updated policy here and bump the "Last updated" date at the top. Because the app is on-device only and has no auth, there is no in-app notification mechanism — please check this page after major updates.
Contact
Questions about this policy or how the app handles data?
Email: vatsalmungara14@gmail.com
We read every message.