Privacy Policy

From everyone

• Phone number — required to send and receive SMS through Textiton
• Display name — a name you choose to be shown to people you communicate with
• Account email — optional for Members, required for Originators (for billing and account recovery)
• IP address and basic device information — collected automatically for security and fraud prevention
• Standard web logs — pages visited on textiton.com, timestamps, user agent

From Originators (paid accounts)

• Legal business name, address, EIN or tax ID — required for A2P 10DLC registration and Stripe billing
• Billing information — payment card or bank account is collected and stored by Stripe, Inc.; we never see or store full card numbers
• Profile content — accent color, hero image, welcome intro text, topics you create

From Members

• Phone numbers of your shared contacts — only when you choose to forward a Textiton message to someone you know. We use these to deliver that message. We never add the recipient to anyone else's list and we never message them again on someone else's behalf.

Message content

The body of every SMS message you send or receive through Textiton is stored so that you and your recipients can view it later in the web interface, so we can deliver it reliably, and so we can investigate abuse reports.

We use the information we collect to:

• Deliver SMS messages and replies to and from the right recipients
• Run, secure, and improve the Textiton service
• Process payments and send billing receipts (Originators)
• Send service-related notifications (e.g., account updates, security alerts)
• Comply with the Telephone Consumer Protection Act, A2P 10DLC carrier rules, CAN-SPAM, and other applicable laws
• Investigate fraud, abuse, and Terms of Service violations
• Respond to legal process

We do not use your information for advertising. We do not run a "feed" or algorithmic ranking. We do not profile users for marketing.

We share information only in these limited cases:

• Telecommunications providers (currently Twilio, Inc. and/or Telnyx LLC) — to deliver SMS and process replies. They are bound by their own privacy policies and applicable law.
• Stripe, Inc. — to process subscription payments and calculate sales tax. They store your billing information.
• Vercel, Inc. and Supabase, Inc. — to host the application and database.
• Government, court, or law enforcement — when we are legally required to comply with valid process, or to protect the rights, property, or safety of Textiton, our users, or the public.
• A successor entity — if Textiton is acquired or merged, your information may transfer to the acquiring entity under the same protections described here, and we will give notice before that happens.

What we never do:

• We never sell your phone number, email, or any personal data
• We never share data with advertisers or data brokers
• We never share Member lists with other Originators
• We never add anyone to anyone else's contact list without explicit permission

You may opt out of any Textiton message at any time by replying NOT FOR ME. We will instantly stop further messages and offer you choices about which level of opt-out you want (the specific message thread, the Originator, the friend who shared with you, both, or all of Textiton).

You may also delete your account at any time from your account settings. Account deletion removes your profile, messages you sent, and your subscription. Carrier and system logs may be retained for a short period as required by law and for fraud prevention, and certain backups may take up to 60 days to be fully purged.

Depending on where you live, you may have rights under:

• California Consumer Privacy Act (CCPA / CPRA) — right to know, delete, correct, and opt out of "sales" of personal information. Textiton does not sell personal information.
• Virginia, Colorado, Connecticut, Utah, and other state privacy laws — similar rights to access, correct, delete, and port your information.
• General Data Protection Regulation (GDPR) — if you are in the European Economic Area, you have rights to access, correct, delete, restrict, port your data, and to object to processing. Textiton currently operates in the United States only and does not target EEA users, but you may contact us if you believe you have GDPR rights you'd like to exercise.

To exercise any of these rights, email hello@textiton.com from the account email of the account in question, or reply NOT FOR ME from your registered phone.

Textiton is not intended for and may not be used by anyone under 18. We do not knowingly collect information from minors. If we learn that we have collected information from a minor, we will delete it.

We use industry-standard measures to protect your information, including encrypted connections (HTTPS/TLS), encrypted-at-rest database storage via Supabase, role-based access controls, signed webhook validation, and a small number of trusted employees with access. No method of transmission or storage is 100% secure, but we work hard to protect what you trust us with.

Textiton stores data primarily in the United States. If you access Textiton from outside the United States, your data will be transferred to the U.S. for processing.

We may update this Privacy Policy from time to time. Material changes will be communicated by email or SMS at least 30 days before they take effect. You can always see the current version at https://textiton.com/privacy.

Questions, concerns, or requests about your privacy? Contact us at hello@textiton.com.