Privacy notice

Updated 27 September 2026

This notice describes how the Candy SMS application handles information when you create an account, sign in, add funds, or order virtual numbers.

Information used by the service

The application stores account email, username, password hashes for password accounts, balances, deposit and payment records, order details, virtual numbers, and received SMS or verification codes. Operational logs can include request IP addresses and activity associated with accounts and orders.

Google sign-in

If you choose Google, Google sends a verified account identifier and email to authenticate you. The requested scopes are openid, email, and profile. Candy SMS stores the Google identifier linked to your account and your email; it does not store your Google password, Gmail messages, Drive files, Google access tokens, or refresh tokens. Google sign-in does not give access to your mailbox or files.

Sessions and browser storage

Google sign-in uses a secure session cookie lasting up to one day and a short-lived cookie to protect the sign-in process. Password login uses a Candy SMS session token in your browser’s local storage. Signing out removes the active browser login; payment retry information may be held in session storage.

Service providers

Google processes Google sign-in. Render hosts this service. SMS providers process number orders and received messages. NOWPayments processes online cryptocurrency payments when enabled. The page also loads interface libraries from third-party content delivery networks. These providers receive the information required for their services and handle it under their own policies. Cryptocurrency transactions may also be visible on public blockchains.

Storage and access

Account and transaction information is stored in the service database. Administrative tools allow the operator to review accounts, orders, deposits and balances. This application does not currently provide an automatic account-deletion feature or a fixed automatic retention schedule. Signing out does not delete account or transaction records.

Questions and requests

For account or data requests, contact the Candy SMS operator through the support channel provided to you. Never send your password, Google password, or private wallet keys. This page will be updated when the service’s data-handling features change.