Messages - SMS Texting App

"List of Installed App: When you install our App, we may collect information from your device, that may include a list of your installed Apps. This data may contain identity information and therefore we treat it as Personal Data. Call log and Contacts: As part of our dialer feature which is provided to certain Apps of ours, you will be required to provide us permissions to your call log and contacts. Bluetooth and Network: We may collect through your Bluetooth and network permissions list of devices and networks your device "see" and connection history of your device. Health Data: Our Apps may access and process certain health related data."

An SMS app collects an extraordinarily broad range of device data — installed apps, call logs, contacts, Bluetooth device lists, network connection history, calendar data, and even health data — far exceeding what core SMS functionality requires.

"Certain features may require access to your GPS location permissions. In addition, in certain features we will use your "Access Fine Location" permission in the background while you are using the App so that we are able to locate the wifi networks and connection to provide the Services. Please note that this information can run in the background of your mobile device, and show you an applicable list of WIFI networks."

The app uses fine/precise GPS location in the background, ostensibly to show WiFi networks — a function that is unusual and arguably unnecessary for an SMS texting application.

"The Advertisers are advertising Service Providers. Their targeted advertising SDKs collect information about your browsing activity across multiple websites and online services in order to provide you with relevant advertisements on the App and Services of third parties. The information collected using these advertising SDK does not disclose your identity, and helps us analyze the effectiveness of our advertising."

The app embeds SDKs from over a dozen advertising partners (AdMob, AdColony, Applovin, Facebook Audience Network, PubMatic, etc.) that collect data directly from the user's device about browsing activity across multiple websites and services.

"Their targeted advertising SDKs collect information about your browsing activity across multiple websites and online services in order to provide you with relevant advertisements on the App and Services of third parties. Our partners will process this data to manage and deliver advertisements more effectively and personally, including contextual, behavioral and interests-based advertising based on your activity, preferences or other data available to us or to our business partners and advertisers, including for re-targeting purposes."

Multiple advertising SDKs embedded in the app track user behavior across websites and services to build behavioral profiles for interest-based and retargeting advertising.

"We reserve the right to amend this Policy from time to time, at our sole discretion. The most recent version of the Policy will always be posted on the website. Any amendments to the Policy will become effective within 30-days upon the display of the modified Policy. We recommend you review this Policy periodically to ensure that you understand our most updated privacy practices."

The company can change the privacy policy unilaterally at any time at its sole discretion, with changes becoming effective automatically after 30 days — placing the burden on users to periodically check for updates.

"In general, we retain the Personal Data we collect for as long as it remains necessary for the purposes set forth above, all under the applicable regulation, or until you express your preference to optout, where applicable. Please note that except as required by applicable law, we will not be obligated to retain your data for any particular period, and we may delete it for any reason and at any time, without providing you with prior notice if our intention to do so."

There is no specific retention timeline — data is kept as long as deemed "necessary" with broad exceptions for legal, regulatory, tax, accounting, and litigation reasons, giving the company effectively indefinite discretion over retention.

"If you would like to delete your Personal Data please fill in this form: link. You do not need to create an account with us to submit a request to know or delete. We may deny your deletion request, in full or in part, if retaining the information is necessary for us or our service provider(s) for any of the following reasons: (1) Complete the transaction for which we collected the Personal Data... (7) Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us."

Data deletion requires filling out a separate form and emailing support rather than offering a simple in-app self-service option, and the company lists eight broad reasons it can deny deletion requests in full or in part.