Privacy policy

Data and purposes

To provide the service, we process account email and login credentials, number ownership and notes, eSIM activation details, receiving requests, message contents and receiving times, credit batches, expiry, redemption and invitation reward records, purchase orders and manual payment review records, and payment evidence or support requests you choose to submit.

This data is used for account verification, number management, receiving and displaying messages, credit accounting, payment review, support, and necessary security notifications. Passwords are stored as salted hashes; activation details and relevant credentials are encrypted. Login, operation, and security records may contain times, source addresses, browser information, and reference numbers to prevent abuse and investigate problems.

Google login and necessary cookies

If you choose Google login, Google provides a stable identity identifier, email, and verification status for registration, login, linking, and security confirmations you request. We do not request Gmail, contacts, or Drive access, and do not save Google passwords, access tokens, or refresh tokens. Google's own handling is subject to its Privacy policy.

The platform uses necessary login cookies, short-lived Google round-trip cookies, and temporary page state to maintain sessions, validate requests, and return to the original page. Voucher codes are handled only in current page memory and are not kept in persistent browser storage. Registration records the accepted policy version, time, and method. Registering with an invitation code saves the invitation relationship and both rewards to determine eligibility and monthly limits; the inviter sees only a masked friend email and reward status. An invitation link or entered code may be temporarily saved in the current tab to continue after refreshing or Google login, and is cleared after login or registration completes.

Public pages use the language of their URL. Customer pages initially follow the browser's preferred language. After a manual choice, the preference is saved only in this browser's local storage (feimao.locale), so customer pages can keep that choice. This does not add an account language setting and is not used for advertising profiles. You can still browse if browser storage is unavailable.

Sharing and external recipients

After a payment declaration or additional evidence is submitted, order reminders are sent to the administrator's configured DingTalk or Feishu robot and email fallback channels. They include the account email, order number, package, amount, and status for manual payment review. Payment evidence stays on the platform for authorized administrators reviewing that order.

Account verification codes, security notices, and credit delivery notices are sent through the configured email service to the account email.

We do not sell account or message data or use it for advertising profiles. The cloud host, email services, and Google each process the data needed for their function. When complying with lawful requests, we provide data only within the necessary scope.

Retention, backups, and cross-border processing

Cloud and the edge device keep the data needed for the service and exchange encrypted disaster recovery copies. Message text is kept for three months, calculated as 90 days from the original receiving time. Syncing, delayed delivery, retries, or restoration do not extend that period. After expiry, viewing and export stop. Message text and raw message copies are cleared under controlled procedures, while necessary content-free deduplication, credit, and unresolved task facts are retained.

Encrypted backups are used only for controlled recovery, with hourly and daily rotation. They are normally deleted after leaving the most recent 24 hours of hourly copies and 14 days of daily copies. Backups are not used to reopen expired messages; current retention rules apply before restored data is made available. Unresolved tasks, lawful preservation, and required security records follow their respective requirements and are not treated as normally readable messages.

Account, number, transaction, and support records are handled according to service delivery, dispute handling, and applicable retention requirements. Removal from the card does not immediately delete every platform record. Necessary network security records are archived separately, with a different retention period from ordinary diagnostic logs and message text.

Accessing the platform, cloud-to-edge syncing, disaster recovery, and external services may involve data transfers and processing between countries or regions. General acceptance of terms does not replace separate notice, consent, or other safeguards where required by law.

Your choices and requests

You can change email and manage login methods in Account, and delete an individual SMS or clear all messages for the selected number in Messages. Set a backup password before unlinking Google if it is your only login method. Viewing the original activation QR code also requires an email verification code.

To request access, export, correction, deletion, restriction, or raise an objection, use the administrator contact at the top after logging in or account help and support. We first verify account identity and explain any unfinished business, security requirements, or data that must remain in restricted backups. Do not include passwords, complete activation codes, or unrelated third-party data in your request.

Significant changes to handling rules will update this page and be explained through appropriate account notifications. Your specific rights and request requirements depend on the applicable rules.