Privacy Policy

1. Controller and scope

OnaySepeti and the SMS ONAY app are operated by CAGLAR DIGITAL SOLUTIONS LLC, acting as controller/business where applicable.

This policy covers account creation/sign-in, SMS verification and number rental, balances/payments, rewarded ads, support and security.

2. Data we collect or process

• Account/identity: username, email and password hash; for Google Sign-In, Google account identifier and email supplied by Google.
• Service/transactions: provider, service/country code, assigned virtual number, service SMS code/text, status, price, balance movements, cancellations and refunds.
• Rentals: rented number, duration, incoming service messages, start/end times and status.
• Payments: Google Play product/order ID, purchase token or secure hash, verification/payment/refund status and credited amount. We never receive card number, CVV or bank credentials.
• Ads/consent: privacy choices, advertising identifiers, approximate advertising region, interaction, reward session and Google's signed reward verification data; Google Mobile Ads/UMP may process these.
• Technical/security: IP, device model/name, OS/app version, mobile session token, timestamps, network/error data and anti-fraud/security logs.
• Support/web: ticket content/replies/status, essential session cookies, security logs and form submissions.

Data may come from you, your use, Google Sign-In, Google Play, AdMob verification and the number provider fulfilling your request.

3. Android permissions and data we do not collect

The app uses only internet and network-state access. It does not access personal SMS/MMS, contacts, call logs, device phone number/SIM identifiers, precise or sensitive location, camera, microphone, photos, files, calendar or health data. Messages displayed in the service are fetched server-side from the provider of the purchased virtual number, not from your device.

4. Purposes

• Create accounts, authenticate users and maintain secure sessions.
• Place SMS/rental orders, display codes and provide history.
• Calculate and verify prices, balances, payments, rewards, cancellations and refunds.
• Answer support requests and provide service notices.
• Debug, secure the service and prevent fraud/abuse.
• Meet legal duties and resolve disputes.
• Serve ads consistent with your choices and verify rewards where consent is required.

5. Legal bases

We rely on performance of our contract/requested service, legal obligations, legitimate interests in account/service security and consent where required. Advertising consent can be changed at any time. Withdrawal does not affect processing lawfully completed beforehand.

6. Service providers and disclosures

• Number providers such as SMS Hero and GrizzlySMS: service/country codes and transaction identifiers required to fulfill the request; never your password or app session token.
• Google: Google Sign-In, Play Billing/purchase verification, AdMob, User Messaging Platform and rewarded-ad server verification.
• Hosting/database/security providers: limited technical data needed to operate, back up and protect the service.
• Authorities/advisers: only where required by law, valid official request, protection of rights or dispute.

Providers' own processing may be governed by their policies. See the Google Privacy Policy and Google partner technologies. We do not sell personal data or buy it from data brokers.

7. Advertising, consent and OnayPuan

Rewarded ads are optional. In applicable regions, Google UMP asks for personalized/non-personalized ad choices. Reopen these under Profile → Ad privacy choices. We do not directly combine advertising identifiers with your account to create our own ad profile. OnayPuan cannot be cashed out or transferred; live rewards require Google's signed server verification. Transaction/reward-session IDs prevent replay and fraud.

8. Google Play payments

Balance packages are purchased through Google Play Billing. Google processes the payment method; we do not receive card details. Product, order and verification data is used to credit the correct account, prevent duplicate use and handle refunds/chargebacks. Google Play balance is usable only in the Android app.

9. International transfers

Data may be processed in Türkiye, the United States and other countries where providers operate. Contractual, technical and organizational safeguards are used where applicable. Google's transfer practices are described in its policy.

10. Retention

• Account data while active; identity fields are anonymized after deletion.
• Mobile tokens are one-way hashed, normally expire within 30 days and are revoked on logout/deletion.
• Support content is deleted with the account; security/activity logs remain only for a limited necessary period.
• Virtual-number/SMS content is deleted or anonymized on deletion, but may remain while an active service is delivered.
• Limited payment/balance/transaction records may remain for mandatory financial, anti-fraud, refund and legal periods.

Retention considers volume, nature, sensitivity, risk, purpose and legal duties.

11. Security

We use HTTPS/TLS, one-way hashes for passwords/tokens, Android Keystore-backed encrypted storage excluded from backup, access controls, rate limits, transaction verification, logging and single-use payment/reward checks. No method is absolutely secure; safeguards are reviewed regularly.

12. Your choices and rights

Depending on law, you may request access, correction, deletion, restriction, objection, a copy or withdrawal of consent. Contact destek@onaysepeti.com. Reasonable identity verification may be required.

13. Account and data deletion

Use Profile → Delete account or the public Account Deletion page. Identity/email ownership is verified; active SMS/rental operations must finish. Deletion anonymizes account fields, deletes support and service SMS content, revokes sessions and removes unused balances. Limited financial/security records may remain where legally required.

14. Children

The service is not directed to anyone under 18 and we do not knowingly seek children's personal data. Contact us if you believe a child submitted data.

15. Changes and contact

We may update this policy as the service or law changes. The current date appears above and material changes may receive additional notice.

Privacy requests: destek@onaysepeti.com. See Company and Contact Information for operator/address details.