Privacy policy

AI Text-a-roo (“we”, “us”) runs aitextaroo.com and the AI Text-a-roo service, which gives your AI agent a phone number so you can text it and it can text you back. We're based in Ontario, Canada, and we handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Our privacy officer is accountable for this policy and handles privacy questions, requests and complaints. Reach them at hello@aitextaroo.com.

• We carry your texts; we don't keep them. What your texts say is never written to our database or logs, and is held in memory for at most five minutes.
• We keep what the service needs to work: mainly your phone number, plus your settings and a few counts and times.
• We don't sell personal information, show ads, or use analytics or tracking on our website.
• Companies that run parts of the service for us process data in the United States.
• You can see and remove your keys, connected apps and forwarding anytime, and ask us to delete your account.

Here's each kind of personal information we handle and what it's for. How long we keep each one is under “How long we keep it”, below.

• Your phone number. It's how you sign in, how we recognize your texts, and where your AI's texts go. Our service stores it encrypted, with a keyed hash (HMAC-SHA256) to recognize your texts without decrypting anything. If you sign up on our website, the sign-up step saves it unencrypted, and our service encrypts it within the hour.
• Account basics. Your AI's phone number, your plan, when your account was created, when you last confirmed your phone, and when you last used “Sign out everything”. We need these to run your account and keep it secure.
• Sign-in codes. When we text you a 6-digit code, we keep only a keyed hash of it, next to a keyed hash of your number, so we can check the code you enter. A code works once, for a short time. On our website, Supabase makes and checks the codes.
• Website sign-in records. If you sign in on aitextaroo.com, Supabase Auth, which runs that sign-in for us, keeps your phone number (not encrypted by us, on storage Supabase encrypts), when you signed up and last signed in, and records of your signed-in sessions, including the IP address and browser they came from. It never keeps a password: we've set it up so none can be saved.
• API keys. For each key your agents use: a keyed hash to check it, the name you gave it, its last four characters, and when it was created and last used, so you can tell your keys apart. A key is shown once, when it's made, and can't be retrieved.
• Connected apps. If you connect an app like Claude or ChatGPT by signing in with your phone, we keep a record of that sign-in: which app, which website it signed in from if we could check, when it was last used, and whether it was removed. Not the tokens themselves.
• Your security PIN, if you set one, as a bcrypt hash. We can check a PIN; we can't read it back.
• Forwarding settings, if you or your agent set up forwarding: the web address (webhook) your texts go to, which key or app set it up and when, and an optional Authorization header, stored encrypted.
• Billing IDs. If you upgrade to Pro, your Stripe customer and subscription IDs. Your card and the billing details you give Stripe stay with Stripe; we never see your card number.
• Usage counts. How many texts counted toward each day's limit, and when we sent that day's limit alert. Just numbers and times, never content.
• Security-check times. When PIN checks, PIN and forwarding changes, disconnections and a few security texts happened, so their limits hold. Just the time and kind.
• What your texts say. We carry texts between you, your agent and, on Pro, your contacts. What they say is never written to our database or logs. It's held in memory for at most five minutes, so an agent that briefly loses its connection can catch up, and then it's gone.
• Request details. Like any website or online service, our hosting providers record basic details of each request, such as the IP address, the time, and the page or API address requested. We also use IP addresses, in memory only, to limit abuse, such as one network asking for too many sign-in codes. Our own logs note events like errors and settings changes against a shortened account ID, never what your texts say.
• Emails you send us, with your email address, so we can answer them.

We don't collect your conversation history: it lives with your agent, and if you use our bridge, it's saved as files on your own computer (~/.aitextaroo/sessions/). We never see your contact list, your location or your card number.

• What your texts say: at most five minutes, in memory only.
• Your phone number, account basics, usage counts and billing IDs: while your account is open.
• Sign-in code records: hashes only, deleted a day after the code expires.
• Website sign-in records (Supabase): while your account is open.
• API keys: until you remove a key, which deletes it at once, or close your account.
• Connected-app records: deleted 30 days after the app is signed out or its sign-in expires.
• Your PIN: until you change or remove it.
• Forwarding settings: until forwarding stops, when they're deleted.
• Security-check times: up to two days.
• Your contacts' numbers: only in memory, never in our database. Forwarding their replies ends an hour after the last text to them, and a keyed hash of their number counts toward daily limits for a day; both are then cleared out.
• Request and sign-in logs: up to 30 days, with our hosting providers, including Supabase's sign-in logs.
• Emails you send us: as long as we need to deal with them, and no more than two years after.

When you close your account, we delete your information within 30 days, including your website sign-in record. Backups kept by our database provider expire on its schedule, and Stripe keeps payment records as the law requires it to.

On Pro, your AI can text other people for you, and their replies come to your phone. Those people haven't signed up with us, so here's exactly what we hold about them:

• Their number, encrypted, with a keyed hash to recognize their replies, plus its last four digits and the name your AI gave them, if any. These live only in our service's memory, never in our database or logs. We stop forwarding their replies an hour after you or your AI last texted them, and the entry is cleared out of memory after that, or whenever our service restarts.
• A keyed hash of their number, also only in memory, which counts their texts toward the daily limits for a day.
• What they say goes straight to your phone and is never written to our database or logs. Your agent is told that they replied, and the name it gave them, but not what they said.

Texts to our numbers from anyone who isn't an account holder or a contact replying are dropped, not stored.

If you got a text from an AI Text-a-roo number and don't want more, reply STOP, or email hello@aitextaroo.com.

We use personal information only to:

• run the service: sign you in, deliver texts between you, your agent and your contacts, forward your texts where you've asked, and check your PIN;
• keep your account safe: text you when a key is added, an app connects, or your PIN or forwarding changes, and limit PIN guesses and changes;
• enforce plan limits and stop abuse, such as fraud that sends floods of sign-in codes;
• bill Pro subscriptions, through Stripe;
• answer your messages and requests; and
• meet our legal obligations.

We don't sell or rent personal information, use it for advertising, or use it to train AI models.

We text you only about the service (sign-in codes, security notices and limit alerts), plus whatever your own AI sends you. We won't send you marketing texts unless you've agreed to get them.

By signing up, you consent to these uses. You can withdraw your consent anytime: see Your choices and rights.

Service providers. These companies run parts of AI Text-a-roo for us. Each gets only what it needs to do its job, and handles it under its terms with us and its own privacy policy:

• Telnyx, our SMS carrier, sends and receives every text, including what it says and the numbers involved.
• Supabase hosts our database and runs website sign-in, on Amazon Web Services in the United States (us-east-1).
• Railway hosts our API, which handles your texts in memory, in the United States (us-east4).
• Vercel hosts this website, including your dashboard.
• Stripe processes Pro payments. We keep only your Stripe customer and subscription IDs.

The agents and apps you connect. An agent you connect (such as ChatGPT, Claude, Grok or OpenClaw) gets the texts you send it, and can use the abilities it's given, like texting you, texting your contacts or setting up forwarding. What it does with your texts is covered by its own privacy policy, not ours.

Where you forward your texts. If you or your agent set up forwarding, each text you send your AI goes to that web address.

Your contacts. When your AI texts someone for you, they get that text from your AI's number.

When the law requires it, such as a valid court order, or when it's needed to protect someone's safety or to stop fraud or abuse of the service.

If the business changes hands. If AI Text-a-roo is sold or merged, personal information may pass to the new owner, who must keep honoring this policy.

We never share your mobile number or texting consent for anyone's marketing: see Text messages.

We're in Canada, but our service providers process and store data in the United States, and some may handle parts of it elsewhere. While it's there, it's subject to the laws there, and that country's courts, law enforcement and national security authorities may be able to access it.

Our website has no analytics, ads or tracking, and no third-party scripts or cookies. We use cookies only to sign you in:

• Dashboard sign-in. Supabase's sign-in cookies keep you signed in to your dashboard until you sign out.
• App sign-in. When you connect an AI app, the sign-in page it opens (on api.aitextaroo.com) sets one cookie that expires after 10 minutes, to keep that sign-in secure.

Stripe's checkout and billing pages are on Stripe's own website and use Stripe's cookies, under Stripe's policies.

• See and remove what's connected. Your dashboard lists every API key and app sign-in, when each was last used, and where your texts are forwarded. You can remove any of them, stop forwarding, set or remove your PIN, or sign out everything at once.
• Stop forwarding by text. Text UNHOOK to your AI's number anytime.
• Access and correction. Ask us what personal information we hold about you, how we've used it and who we've shared it with, and ask us to correct anything that's wrong. We answer within 30 days, at no charge.
• Deletion. Email us to close your account and delete your information. Your bridge's conversation files are on your own computer, so delete those yourself.
• Withdrawing consent. You can withdraw your consent anytime, subject to legal or contractual limits: disconnect your agents, stop forwarding, cancel Pro, or close your account. We can't run the service without your phone number, so withdrawing consent to its use means closing your account.

To make a request, email hello@aitextaroo.com with the phone number on your account. We'll confirm it's yours, for example by texting it a code, before we act.

Complaints. If you have a concern, email us first and we'll do our best to fix it. You can also complain to the Office of the Privacy Commissioner of Canada.

We protect personal information with safeguards that fit how sensitive it is: encryption for phone numbers and forwarding headers, keyed hashes for lookups, bcrypt for PINs, a PIN for sensitive agent actions, short retention, and access limited to the people and systems that need it. Security & privacy has the details.

Text messages aren't end-to-end encrypted, like all SMS, so never text passwords, card numbers or one-time codes for other services.

If a breach of our safeguards creates a real risk of significant harm to you, we'll tell you and the Privacy Commissioner, as the law requires.

Found a security problem? Email hello@aitextaroo.com with “Security” in the subject, and tell us what you found and how to reproduce it. Please don't access other people's data, disrupt the service, or make the problem public before we've had a fair chance to fix it. Our security.txt lists the same contact.

• How you opt in. You opt in by signing up with your own mobile number (on our website, in an AI app or through your agent) and confirming it with the code we text you, or by texting your AI's number.
• What we send. Sign-in codes, security notices and limit alerts, plus the texts your AI writes to you. Message frequency varies with how you and your AI use the service.
• Message and data rates may apply.
• Reply STOP to opt out, and START to opt back in. For help, see our docs or email hello@aitextaroo.com.
• Carriers aren't liable for delayed or undelivered messages.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties.

The full texting terms are in our terms of service.

AI Text-a-roo is only for adults 18 and over. We don't knowingly collect information from anyone younger. If you think someone under 18 has signed up, tell us and we'll delete their account.

We'll update this policy as the service changes, and change the date at the top. If a change significantly affects how we use information we already hold, we'll tell you before it takes effect, by text or on our website, and ask for your consent where the law requires it.

Questions, requests or complaints about privacy: hello@aitextaroo.com. AI Text-a-roo, Ontario, Canada.