Privacy Policy

1. The short version

Textly is an SMS app, and it keeps what it handles on your phone. Your messages, your contacts and the search index Textly builds over them are processed on your device and nowhere else.

The app has no internet permission. Android enforces what that means: without it, an app cannot open a network connection, whatever its code does. So there is no server of ours that your messages could reach, and nothing is sent to one. There is no Textly account, no advertising and no analytics or tracking SDK.

Only an email you write to support yourself can reach us. Your own email app sends it. Section 3 describes what it contains.

This policy describes Textly as it is in the store today. If a later update needs data the app does not collect now, this policy changes with it, here, with a new date, when that update is released, and not before.

2. Who is responsible

The controller responsible for data processing in connection with the Textly app and this website within the meaning of Art. 4(7) GDPR can be reached at hi@gettextly.app.

Write to that address for the controller's full name and postal address, and for anything else in this policy.

No data protection officer has been appointed. The statutory thresholds for appointing one are not met.

3. Data processed in the app

SMS and MMS

On Android, when you select Textly as your default SMS application, the system grants it access to the SMS database. (On iOS this does not apply, because Apple provides no SMS access to third-party apps.) Textly reads your existing conversations in order to display them, writes messages you send, and stores incoming messages in that same system database. All of this happens locally. Message content is never transmitted to us.

Contacts

If you grant contacts permission, Textly matches phone numbers against your address book so that conversations show names rather than numbers. Contact data is read on the device and is not copied anywhere.

Textly's own database

Anything Textly stores beyond the system message store, such as the index that makes your messages searchable, is kept in a database on your device that is encrypted with SQLCipher. Its key is held in the Android Keystore, the device's hardware-backed key storage. Search runs against that index on your phone. There is no machine-learning model in the app, and nothing is sent anywhere to be analysed.

Textly excludes its data from Android's cloud backup, so it is not copied to your Google account either.

Emails to support

If you write to support@gettextly.app, we receive your email address and everything you put in the email.

Versions of Textly with Help & contact in their settings can prepare that email for you. The app opens your own email app with the email filled in. Below the space for your message it lists the app version, the edition of Textly, the Android version, the maker and model of your device and the language of the app. Textly sends nothing itself. You see every line before you send the email from your own account. You can change or remove any of it. The email contains no phone number, none of your messages and none of your contacts unless you type them in.

We use these emails only to answer you and to find the cause of a problem you report. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering your request). The mailbox is provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. We keep an email to support until your request is resolved and for at most 12 months after that. If you ask us to, we delete it sooner.

4. Permissions and why they are needed

• Default SMS app role (Android only). Required by Android for any app that sends, receives and manages SMS. iOS has no equivalent and Textly does not handle SMS there.
• SMS and MMS (read, receive, send), Android only. To display your conversations, receive new messages, including MMS, and send yours.
• Contacts (read). Optional. Used only to show names instead of numbers and to pick recipients.
• Notifications (posting). To alert you about incoming messages.
• Phone state (read). To tell your SIM cards apart, so you can see which one a message arrived on and choose which one to send from.
• Network state (check only). A scheduling library the app uses declares that it may check whether a network is available. It gives no network access, and nothing is sent.
• No internet permission. Textly does not request internet access. That is not a promise about our servers: it means the app has no way to send anything anywhere. You can check it in the app's permission list on Google Play.

5. Data we do not collect

• We do not collect or store the content of your messages on any server.
• We do not collect your phone number, your contacts or your address book.
• The app creates no user account and no user profile.
• We do not use advertising identifiers and we do not show ads.
• We do not sell, rent or share personal data with third parties.
• The app does not track your usage across apps or websites.

6. Third parties

• Google Play. The app is distributed through Google Play. When you download, install or update Textly, Google processes data as an independent controller under the Google Privacy Policy. We receive only aggregated, anonymised statistics such as install counts through the Play Console.
• Your mobile network operator. Sending and receiving SMS and MMS is carried out by your carrier, who processes that data as an independent controller under its own terms.
• The provider of our support mailbox. IONOS SE (Montabaur, Germany) receives and stores the emails you send to support (section 3) on our behalf.

Beyond these, Textly integrates no third-party services: no analytics, no crash reporting SDK, no advertising network.

7. This website

Hosting and server logs

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and served from its Frankfurt region. Vercel is a US company, so a transfer of connection data to the United States cannot be ruled out. For technical operation and security, the host records standard server log data: IP address, date and time of the request, the requested resource, referrer, browser and operating system version. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, reliable operation). Logs are deleted after 30 days.

The waitlist

If you join the waitlist, we collect your email address. We also store when you signed up and on which page. We send you one email to confirm your address. When you can start earning with Textly, we send you one more.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time. Every email has a link to unsubscribe. Once you use it, we send you nothing more. To have your address deleted, write to hi@gettextly.app and we delete it. Otherwise it is deleted with the waitlist, as described below.

We process the address with Customer.io. Customer.io is operated by Peaberry Software Inc., 921 SW Washington St., Suite 820, Portland, OR 97205, USA. It acts as our processor under a data processing agreement. The address is stored in Customer.io's EU region. Its data centre is in Belgium. Peaberry Software Inc. is a US company and is certified under the EU-U.S. Data Privacy Framework.

To stop the form from being flooded, it counts sign-ups per IP address for ten minutes. That count is held in memory and is not stored.

We delete the waitlist once we have sent the email that earning has started.

Cookies and analytics

This website sets no cookies and loads nothing from Google until you answer the banner about the Google tag. Your answer is then kept in your browser's local storage, so that we do not ask again on every page. It never leaves your device. Storing it is necessary to respect your choice (§ 25(2) No. 2 TDDDG; for visitors in France, Art. 82 para. 2 of the Loi Informatique et Libertés).

If you accept, the website loads the Google tag of our Google Ads account, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before that it is not loaded at all, and your browser sends Google nothing. With your consent the tag sets cookies on your device and reads them. For each page you view it sends Google a signal with your IP address, the page address and your browser's user agent. When you arrived from one of our ads, the signal also carries the identifier of that click. We use this only to measure whether our own advertising brings people to this website. Ad personalisation and analytics storage stay switched off. We do not use the tag to build a profile of you or to show you ads. Google may process this data in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework.

The legal basis is your consent under Art. 6(1)(a) GDPR, and for storing and reading information on your device § 25(1) TDDDG and Art. 5(3) of the ePrivacy Directive, which in France is Art. 82 of the Loi Informatique et Libertés. If you decline, the tag is not loaded. You can withdraw your consent at any time with effect for the future, under Cookie settings at the bottom of every page. The tag's consent is then switched back off, and the cookies it set on this website are deleted. Details: Google Privacy Policy.

Fonts and external resources

All fonts and assets are served from this website's own server. No requests are made to third-party CDNs, so no data is transferred to font or CDN providers when you visit. The one exception is the Google tag described above. It loads only if you accept it.

8. Legal basis (GDPR)

• Art. 6(1)(b). Processing on your device necessary to provide the messaging functionality you requested.
• Art. 6(1)(a). Consent, for optional permissions such as contacts, for the waitlist, and for the Google tag on this website (see Cookies and analytics).
• Art. 6(1)(f). Legitimate interest, for the secure operation of this website and for answering emails you send to support (see section 3).

9. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future.

Because your messages and everything Textly derives from them never leave your device, the only data from the app that we could disclose or delete is an email you sent to support. Requests concerning data on your own device can be fulfilled by you directly, by deleting conversations or uninstalling the app.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the member state of your residence, workplace or the place of the alleged infringement.

10. Retention and deletion

Data stored on your device remains there until you delete it or uninstall the app. Uninstalling removes Textly's encrypted database.

Uninstalling Textly does not delete your SMS: on Android they remain in the system message storage and are available to your next default SMS app.

Emails you sent to support are not on your phone, so uninstalling does not remove them. We keep them as section 3 describes, and we delete them sooner if you ask.

11. Children

Textly is not directed at children under the age of 16, and we do not knowingly collect personal data from them.

12. Changes to this policy

We may update this policy to reflect changes in the app or in legal requirements, for example when an update changes what the app collects (see section 1). The current version is always at this address, with the date of the last update shown at the top. Material changes affecting your rights will be communicated in the app.

13. Contact

Questions about privacy or this policy: hi@gettextly.app. We aim to respond within 5 business days.

Help with the app: support@gettextly.app (see section 3).