ZROtext SMS Gateway Privacy Policy

Effective October 15, 2026.

Elysra LLC operates ZROtext. The initial pilot is for adults aged 18 and over in the United States. We monitor support@zrotext.com and privacy@zrotext.com for support, privacy and deletion requests; both addresses reach our support mailbox.

What this policy covers

This policy covers our Android SMS Gateway pilot and associated hosted account, dashboard and relay service. The pilot supports phone pairing, connection tests and restricted SMS testing and receiving modes. Hosted registration is currently closed and dispatch is disabled. A complete phone-to-browser SMS inbox is not currently available. If you use your own relay, its operator controls that server's access, storage and retention.

Information on your phone

With phone-state permission, the app lists active SIM subscriptions and checks the selected line using subscription/card identifiers, SIM type, permission and network state. It also checks the default messaging app's classification to explain possible RCS limitations.

With sending permission, an armed controlled test can send a recipient number and message through the selected SIM after server authorization. Permission approval alone does not send a message. Carrier charges may apply.

With receiving permission, the app inspects newly received SMS in the background, including when closed, to recognize STOP or review requests and prevent further sending. Replies within an approved pilot reply window can be stored encrypted on the phone. Local records include suppression state, encrypted sender information, timestamps, event identifiers and SIM and message status.

The app does not request SMS inbox-history, contacts, call-log, location, microphone or camera permissions. It does not receive RCS chats. Pairing and selected-line settings are stored locally; signing and local encryption keys use Android Keystore. Android application backup is disabled. Messages held by your normal SMS app, carrier or recipient are separate.

Information processed by the service

Pairing and connections exchange ticket claims, public keys, signed device proof, identifiers, heartbeats and readiness or delivery status. The inbound metadata pilot uploads signed event identifiers, classification, timestamps, multipart counts and sequence information; that upload excludes the locally encrypted reply body. A separately controlled opt-out synchronization mode can upload the withdrawing sender's number and withdrawal metadata. Controlled outbound testing uses the recipient number and test message on the server.

The service processes account email, password hashes, verification/reset records, sessions, enabled MFA/recovery information, account/device identifiers, pairing and revocation history, approvals, opt-outs, usage and delivery records, and configured webhook destinations and delivery records. Connections expose IP addresses and traffic information to the service and network providers. Security mechanisms and operational logs process service activity. Support email includes your email address and whatever you supply.

We use information to authenticate accounts and phones, identify the approved line, maintain connections, operate the pilot, report outcomes, prevent duplicate or uncertain sends, enforce opt-outs, protect the service and respond to requests. Elysra does not sell ZROtext message or account data or use that data for advertising or AI training. The Android app contains no advertising SDKs. The app includes Google's code scanner for optional pairing QR scans. Google's SDK documentation describes processing of device and application information, installation or device identifiers, feature events, performance metrics and errors for diagnostics and usage analytics. Scanner images are processed on your device; Google states that it does not store the images or scan results. Manual pairing remains available without opening the scanner. Some bundled scanner SDK components initialize when the app starts, including when you use manual pairing.

Elysra operates the service storage and handles support and privacy email. Cloudflare handles public edge/tunnel traffic. Cloudflare derives an approximate country from connection IP addresses for traffic analytics. Carriers and recipients process normal SMS messages. Authorized account users and owner-selected webhook recipients can receive information permitted by their role or configured feature. Production billing is disabled. Storage and backups are operator-controlled; this policy makes no US-only storage or processing guarantee.

Security

App-server connections use HTTPS/WSS, pairing uses signed proof, eligible local reply/sender records use Keystore-backed encryption, and hosted backup archives are encrypted. These protections do not mean all server records use a user-only encryption key or that the pilot provides end-to-end encrypted SMS synchronization. Normal SMS can be read by carriers and recipients. No service can guarantee absolute security.

Retention

Settled or quarantined phone evidence becomes eligible for bounded pruning after seven days. Unacknowledged records, unresolved sending outcomes and local STOP blocks can remain longer. Revoking permission does not erase stored records.

The hosted service uses these configured cleanup eligibility periods:

Idempotency keys: 7 days.
Terminal message content: 30 days after the relevant terminal state update, subject to linked evidence and processing dependencies.
Message events: 90 days after receipt, subject to the parent message becoming eligible.
Terminal webhook history: 30 days after the relevant state update.
Eligible inbound content: 30 days after receipt, subject to related webhook processing.
Sealed inbound content, if enabled: 30 days after receipt.

Cleanup is asynchronous and bounded. Pending webhooks, unresolved sends and associated processing can retain data longer. Sent-message recipient and payload linkage can remain until the associated event/reply window expires, extending effective retention beyond 30 days. Content redaction retains identifiers, digests, timestamps and status for replay protection. Suppression and protected identity/audit records are not removed by ordinary content cleanup. Account and support records have no fixed automatic expiry currently.

Encrypted snapshots are scheduled hourly. Origin archive cleanup runs after successful backups using a file-age rule rather than an exact deletion deadline. Off-host backup copies currently have no automatic expiry. Deleting live data does not guarantee removal from those copies. Local container logs have size and rotation limits; no fixed time-based expiry is established for system journals or network-provider traffic records.

Your choices and deletion requests

You can decline disclosures, deny permissions or revoke them in Android settings. Pairing and connection tests do not require SMS permission. Pause stops the connection but does not revoke receiving permission or erase records; local opt-out processing can continue while receiving permission remains enabled. Owners can revoke devices in the dashboard.

For access, export, account deletion or associated-data deletion requests, email support@zrotext.com or privacy@zrotext.com and identify your account. Do not send passwords, recovery secrets or private keys. We may need to verify your identity before handling the request.

Complete automated account erasure can be blocked by protected identity, approval, audit or trust records. When blocked, that operation deletes nothing. Application-database erasure does not erase backup, carrier or recipient copies. We review requests through the monitored mailbox; this policy does not promise a fixed response deadline or unconditional complete erasure. Uninstalling the app does not delete service or third-party copies.

Changes

We will update this policy to describe material changes in processing. Actual phone-to-browser message-content synchronization would require updated disclosures and consent before enabling that new behavior. The effective date above identifies this version.