Privacy Policy

Diaz SMS is a self-hosted SMS gateway. Your phone sends and receives text messages on your behalf, and this server relays requests to it. This page explains what is stored and where it goes.

What we collect

• Account data — your name, email address, and a hashed password. Passwords are stored as bcrypt hashes and are never readable by us.
• Device data — the phone name, model, Android version, battery level, network type, SIM inventory, and a heartbeat timestamp. This is what lets the dashboard show whether a gateway is online.
• Message metadata — sender and recipient numbers, message body, and delivery status for messages sent or received through the gateway.
• API keys — stored only as a SHA-256 hash. The plaintext key is shown once at creation and cannot be recovered later.

Where it is stored

All of the above lives in a MongoDB database on infrastructure operated by Diaz Agents. Message contents are not sent to any third party by this server.

What leaves this server

• Webhooks — if you configure one, the message events you subscribe to are POSTed to the URL you supply.
• Push notifications — this instance is configured without Firebase. Your phone polls the server over HTTPS for pending messages instead, so message contents never transit Google.

Retention

Message history is kept so the dashboard can show delivery status and so the phone can recover messages whose push failed. Deleting a device or your account removes its stored records.

Your choices

• Revoke any API key from the dashboard at any time.
• Disable or remove a device; it stops receiving work immediately.
• Request account deletion from the dashboard, or by emailing support@diazagents.com.

Security

Traffic to this service is encrypted with TLS. Access requires an API key or a dashboard session. No system is perfectly secure; if you believe your account has been compromised, revoke your keys and contact us.