SafeLine

Privacy Policy

Effective date: 11 November 2026

This Privacy Policy explains what personal data is processed when you use the SafeLine mobile app and its servers (together, "SafeLine" or "the Service"), why, who receives it, how long it is kept, and what rights you have.

1. Who is responsible

SafeLine is operated by OB Teknoloji Ltd. Şti., a company registered in Türkiye, under the Codexia brand ("we", "us"). We are the data controller under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where it applies, the EU/UK General Data Protection Regulation ("GDPR"). Contact: support@codexia.app.

2. What SafeLine does

SafeLine lets you use a temporary phone number for about 20 minutes to receive a one-time verification code, so that you do not have to share your own phone number. To do this, our servers obtain a number from a third-party number provider, receive the SMS sent to that number, and show it to you in the app.

3. Data we process

  • Account identifiers. When you first open the app, an account is created automatically without asking for any details. We store a SafeLine account ID and the sign-in ID issued by Firebase Authentication, the date the account was created, the time of your most recent sign-in, and your device platform (iOS or Android).
  • No email, name or phone number. The app does not ask for your email address, name or phone number.
  • IP address. We record the IP address seen by our server when your account is created and when you last signed in, and with each purchase record. Because our servers are behind Cloudflare, this may be a Cloudflare network address rather than your own.
  • Rental history and received messages. For each number you use we store the service and country you selected, the phone number assigned to you, its cost in credits, its status and timestamps, and the full text of the SMS message received on that number (for example, the verification code and any text the sender included). From 11 November 2026 we also store the two-letter country code of the network you connected from, as reported by Cloudflare, to understand where the Service is used. We do not store your precise location.
  • Credits and purchases. Your credit balance and a history of credit changes (purchases, number rentals, automatic and manual refunds, and any bonus credits). Purchase records include the store transaction identifier, the app's user-agent string (app and device information sent with the request) and an IP address. Payments are handled by Apple; we never receive or store your card or bank details.
  • Apple Search Ads attribution. Once per installation on iOS, the app asks Apple's AdServices framework whether the install came from an Apple Search Ads campaign. If it did, the campaign, ad group and keyword identifiers are saved to your purchase profile at RevenueCat so we can see which ads lead to purchases. This uses no advertising identifier (IDFA) and does not track you across other companies' apps or websites, so the app does not show an App Tracking Transparency prompt.
  • Delivery notifications. To show a new message or refund in the app, our server creates a short-lived notification record for your account. It is deleted as soon as the app confirms it, or after at most 3 days if it is never confirmed.
  • Server logs. Our server keeps technical logs of requests (time, address requested, IP address, user-agent and account ID) and service events, which can include the content of received codes. These logs are used for operation, debugging and abuse prevention and are deleted on a rolling basis (see Section 7).
  • Support messages. If you email us, we process your email address, your message and any details you include, such as your User ID.

What we do not collect: SafeLine does not access your contacts, photos, camera, microphone, precise location or your own phone number. It contains no advertising SDK and no third-party analytics SDK, does not show ads, does not use your data for tracking, and we do not sell or rent personal data.

4. Why we use it and our legal bases

  • To provide the Service — create your account, assign numbers, show received messages, keep your credit balance, return credits and answer support requests. Legal basis: performance of our contract with you (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
  • To meet legal obligations — keep purchase and accounting records and respond to lawful requests from authorities. Legal basis: KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c).
  • To keep the Service secure and prevent misuse — detect fraud, abuse and violations of our Terms, and investigate problems with numbers or payments. Legal basis: our legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
  • To understand usage and measure our App Store ads — usage by country and Apple Search Ads attribution, in aggregate. Legal basis: our legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)). You can object at any time (Section 9).

5. Who receives data

We share data only with the service providers we need to run SafeLine, each acting on our behalf or under its own terms for the service it provides:

  • Google Firebase Authentication (Google LLC) — creates and verifies your anonymous account.
  • RevenueCat (RevenueCat, Inc., USA) — processes App Store purchase receipts and your purchase profile (account ID, purchases, Apple Search Ads attribution if any).
  • Apple — processes your payments and refunds, and Apple Search Ads attribution.
  • SMSPool — our phone number provider. Our server asks it for a number for the service and country you selected and receives the incoming SMS from it. We do not send your email, account ID or IP address to the provider, but the provider necessarily processes the number and the messages delivered to it.
  • Cloudflare (Cloudflare, Inc.) — network security and traffic routing for our servers; it handles your IP address and requests in transit.
  • DigitalOcean (DigitalOcean, LLC) — hosts our servers and database in the United States.
  • Zoho Mail (Zoho Corporation) — hosts our support mailbox.

We may also disclose data when required by law, by a court order or by a competent authority, or where needed to protect the rights, safety or property of our users, the public or us, including to investigate fraud or misuse of the Service.

6. International transfers

Our servers are located in the United States, and some of the providers above process data in other countries. This means your data is transferred outside Türkiye and, if you are in the EU/UK, outside the EEA/UK. Where the law requires it, we rely on the transfer safeguards these providers offer, such as standard contractual clauses, in line with KVKK Art. 9 and GDPR Chapter V.

7. How long we keep data

  • Account, credit balance and rental history (including received message text): kept for as long as your account exists, so that you can see your history and so that we can resolve credit and refund questions. You can ask us to delete them at any time (Section 8).
  • Purchase and credit transaction records: kept for as long as needed for the account and, after deletion, for the period required by Turkish tax and commercial law.
  • Delivery notifications: deleted when the app confirms them, or after at most 3 days.
  • Server logs: application logs are deleted after about 7 days and web server access logs after about 14 days.
  • Support emails: kept as long as needed to handle your request and any follow-up.

8. Deleting your account

To delete your account, email support@codexia.app with the subject "Account deletion" and include your User ID (in the app: Settings → tap your User ID to copy it). We will delete your account, rental history, received messages and Firebase sign-in record within 30 days and confirm by email. Remaining credits are lost on deletion. Purchase records that we must keep by law are retained only for the legally required period. Deleting the app from your device does not delete your account.

9. Your rights

Under KVKK Article 11 and, where applicable, GDPR Articles 15–22, you can ask us to tell you whether we process your data and give you a copy; correct inaccurate data; delete your data; restrict processing; receive data you provided in a portable format; and object to processing based on our legitimate interests. You may also object to a result produced solely by automated processing that is to your detriment. To make a request, email support@codexia.app with your User ID. We will reply within 30 days. You also have the right to complain to the Turkish Personal Data Protection Authority (KVKK) or to the data protection authority in your country.

10. Security

Data between the app and our servers is sent over encrypted HTTPS connections, and access to our servers and database is restricted to authorized staff. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Received messages are visible to you in the app and can also be accessed by our authorized staff for support and abuse prevention.

11. Children

SafeLine is not directed to children under 13 (or the equivalent minimum age in your country) and does not knowingly collect personal data from them. The app does not ask for a name, email address or phone number from any user. If you believe a child under that age has used SafeLine, contact us and we will delete the account.

12. Changes to this policy

We may update this Privacy Policy. When we do, we will change the effective date above. If a change materially affects how we use your data, we will take reasonable steps to let you know before it takes effect.

13. Contact

OB Teknoloji Ltd. Şti. (Codexia) — support@codexia.app