--- title: "Privacy — what we hold, and for how long" description: "What Shared MFA Inbox holds: authenticator setup keys, SMS messages and activity records. How access works and what is erased." canonical: "https://sharedmfainbox.com/privacy" --- # What we hold, and for how long > What Shared MFA Inbox holds: authenticator setup keys, SMS messages and activity records. How access works and what is erased. What we store, why we need it, and what you control. - [Create free account](https://app.sharedmfainbox.com) _No credit card required. Your first authenticator account is free._ [See pricing](https://sharedmfainbox.com/pricing) > **This page is a summary, not a legal document** This describes the product today and still needs legal review before launch. Open questions are listed below. ## Privacy questions ### What information do you store? We store what your team needs to get codes, read texts and manage access. ### How is that information used? It runs the inbox, checks access, records activity and supports billing. ### How long do messages stay? Text and codes are erased after 72 hours by default. An administrator can change this. ### What can my team control? You choose who can read each number and how long its message text stays. ### What do you track on the website and app? We use support, analytics and advertising tools. The full details, including browser privacy choices, are below. ### Which privacy details are still unsettled? Data location, some provider details and parts of our retention and cancellation policy remain open. - **Authenticator account details and setup keys.** We store the account name, service and code settings with a key in encrypted form. Only people with account access can generate codes, including its creator and team admins. The saved key is not returned to teammates. The service reads it to generate codes. - **The text messages sent to your number.** They arrive, they are shown to the people you have approved, and the text of each one is erased on a timer. Whoever sends the message decides what is in it. We do not control that, and neither do you. - **Your numbers, and who can see each one.** Access is a named list of people. Administrators can see every number on the team; everybody else sees only the numbers they have been given. - **The name and email address of each person on your team.** That is what lets a colleague sign in as themselves instead of sharing one password around the office. - **A record of account activity.** Access given and removed, people added and removed, numbers added and released, messages opened and codes copied. It also records authenticator account changes and code generation, without logging the setup key or generated code. An administrator can review it. > A text message can contain anything the sender chose to put in it, including things you would rather it did not. If a service is texting something to your number that should not be read by everyone with access, that account belongs somewhere other than a shared inbox. It is used to generate authenticator codes, deliver your messages, work out who has access, to keep the record of account activity, and to take payment for the numbers on your account. **Signup protection.** We use Cloudflare Turnstile in invisible mode to help prevent automated account creation. Cloudflare processes browser and connection signals for this check. See the [Cloudflare Turnstile Privacy Addendum](https://www.cloudflare.com/turnstile-privacy-policy/) for details. **Your connection to the service uses HTTPS.** What passes between your browser and your inbox is encrypted on the way. **We do not claim your messages are encrypted in a way that stops us reading them.** They are not. The service has to be able to show you a message, so the service can read the message. Anyone weighing this up for genuinely sensitive material should factor that in. The [security page](https://sharedmfainbox.com/security) sets out what we do and do not claim. **Administrators can see every number on the team.** That is what makes somebody an administrator, and it is worth knowing before you make one. Keep the list short and give everyone else only the numbers they need. > Where your information is stored, and which other companies help us run the service, are on the list of things still being confirmed further down this page. **The text of a message, and any code inside it, is permanently erased a set time after the message arrives.** The default is 72 hours, and an administrator can change that setting for your team. The erasure cannot be undone, by you or by us. **The record that the message arrived stays.** Your team can still see who sent it, when it came in and which of your numbers it came to. What goes is the content. This is deliberate rather than a limitation. A login code is useful for a few minutes and a liability for the rest of its life, so the product does not keep one lying around. > How long the record of account activity is kept, and what happens to your information after you cancel, have not been settled yet. Both are in the list below. - **Who can read each number.** An administrator gives access one person at a time and can take it away at any time. Removing one person changes nothing for anybody else, and no password has to be reset. - **How long message text survives.** 72 hours is the default. A shorter window means less sitting around waiting to be read by the wrong person; a longer one means more history for your team to look back at. - **Which accounts point at your number.** Nothing arrives unless somebody has entered the number somewhere, so you decide which company accounts send texts to it. - **Whether the number exists at all.** You can release a number at any time and its billing stops. There is no contract. What you cannot control is what a sender puts in a message. That decision belongs to the service doing the sending. - **Our own website script sets two cookies.** One holds a random visitor identifier; the other holds a short-lived PostHog session identifier. Neither holds a name, email address or anything you typed. They are readable by the website script so the page you viewed, the button you clicked and the account you create can be joined without sharing a cookie with the app subdomain. - **You can refuse it.** If your browser sends Global Privacy Control or Do Not Track, this site does not load the browser measurement tags, counts nothing in PostHog and sets no cookie. Most browsers have GPC behind a privacy setting, and some send it by default. - **Visits and page speed are counted in PostHog.** Ordinary HTML pageviews and Core Web Vitals are sent from your browser; Markdown and answer-engine views are counted on our server because they do not run the browser script. What is recorded is the page you were on, whether the visitor read as a person or as a bot, and, when your browser sends one, the website that linked you here. Not your IP address. Nothing after the `?` in the address is forwarded either, with one exception: if you arrived from a campaign link we read the `utm_` labels and ad click identifiers that name the campaign and advertising platform — a shared link can carry things that are none of our business. - **Ad visits and number purchases are measured by Google Ads and Microsoft Advertising.** When your browser has not refused as above, this website loads Google Ads tag `AW-16737742601` and Microsoft UET tag `187273102` so the ads we run can be measured; those tags may set or read their own ad measurement cookies. After a real number purchase succeeds in the app, the same tags receive the purchase amount, currency and billing cadence, and Microsoft Advertising receives the signed-in purchaser email for enhanced conversions. We do not send a personal phone number because the app does not collect one, and the shared inbox number being bought is not the purchaser's phone. They do not receive the bought number, the internal number id, message text or codes. - **Support chat is handled by Crisp.** The website and the app load Crisp's chatbox so you can ask for help without leaving the page. Crisp receives the technical information needed to run the chat and whatever you type into it. In the app, when you are signed in, we also send Crisp your name or email, user id, active team id/name, role, auth mode and billing-manager status so support can identify the account. We do not attach phone numbers, message identifiers, message text or codes to Crisp. - **A link into the app passes the page you came from.** Clicking one of the buttons that opens the app goes through this site first, so we can tell which page persuaded you and connect it to the account you then create. It carries the page you were on and the same random visitor identifier as the cookie — and neither, if you have refused as above. Never anything you typed. - **In the app, product actions are recorded against your account.** Which features are used, by you and by your team — that is how a question like "did anyone use this" gets an answer. Nothing about a message, and never a code: the parts of the app that show one deliberately turn off session recording and click capture, because those would put a live passcode into somebody else's database. - **Crashes are reported in Sentry.** Browser and server failures are sent so they can be fixed. The address it happened at is reduced to the page, the query string is dropped, browser breadcrumbs are not kept, and the report carries no message content — that is enforced in code and tested, not merely intended. - **Five outside services see browser support or measurement data.** Crisp runs the support chat, PostHog counts product usage, Sentry receives crash reports, and Google Ads and Microsoft Advertising receive ad measurement from this website and purchase conversion measurement from the app. None receives the text of a message from us. Product analytics and crash reporting are not sold. The ad tags are there to measure ads we run, not to put message content into an advertising system. - **Where your information is stored**, and whether we can promise it stays in a particular country or region. - **The full list of other companies that help us run the service**, and what each of them can see. The two that receive usage and crash information are named above; the rest — where the service runs, who delivers the messages — are not written down yet. - **A written data processing agreement**, for teams whose own policies require one before they can sign up. - **How long the record of account activity is kept.** - **What happens to your information after you cancel**, including whether you can take a copy with you and how to ask for deletion. - **Any independent audit or certification.** We have none to point at, and we are not going to imply otherwise. - **Whether picture messages are supported.** Assume text only for now. If one of these is the question that decides whether your team can use the service, email support@sharedsmsinbox.com before you rely on it. An honest “not yet” is more use to you than a confident answer that turns out to be wrong. ## Need more? - [Security](https://sharedmfainbox.com/security) — Access and data storage. - [Pricing](https://sharedmfainbox.com/pricing) — Prices and billing details. - [Help](https://sharedmfainbox.com/help) — Setup and account support. --- Canonical: https://sharedmfainbox.com/privacy Every page of this site is also available as Markdown. Site map: https://sharedmfainbox.com/llms.txt