Dostum SMS — Privacy Policy

Last updated: 14 October 2026 · Data controller: Dostum Amigo SL (CIF B76188499)

1. Who we are

The Dostum SMS app is published by Dostum Amigo SL — full legal name DOSTUM AMIGO SOCIEDAD DE RESPONSABILIDAD LIMITADA, a company registered in Spain, and the data controller for this app. Our registered address is Calle Princesa Teguise 27, Puerto del Carmen, 35510 Tías, Las Palmas, Spain. Our CIF/Tax ID is B76188499. For privacy-related questions you can write to privacy@dostumamigo.com.

This policy covers the Dostum SMS Android application only. The general Dostum Amigo company privacy policy — covering our website, IT services and software projects — is published at dostumamigo.com/privacy-policy/. Where the two policies overlap, the app-specific terms below apply to the app.

2. What the app accesses, and why

• Incoming SMS (message text, sender, time received) — read at the moment each message arrives, using the Android RECEIVE_SMS permission. This is required for the app's core function: detecting and forwarding incoming texts. Without it the app cannot work.
• The destination email address you enter.
• Your own sending email account — the address, outgoing mail server settings and password (or app password) you enter so the app can send your forwards from your own account. Stored encrypted only on your device and used only to send to your chosen destination. It is never sent to Dostum.
• Your Telegram bot token and chat ID, if you choose Telegram — stored encrypted only on your device and used only to post your forwards to your own Telegram chat.
• A device name you optionally set (shown in the forwarded email's subject so you know which phone a text came from).
• Your account email and password — used only to sign you in.

The app does not read your existing SMS history, sent messages, contacts, call logs, or location. It requests only RECEIVE_SMS (plus Internet, notification, boot and battery-related permissions needed to forward reliably) — never READ_SMS, call log, or contacts.

3. Incoming SMS is transmitted off your device

To forward a message, the app transmits the message text, sender and received time off your device. The complete path is:

Email: your phone → your own email provider's outgoing mail server (encrypted, SSL/TLS) → the destination email provider → the destination inbox.

The app connects directly from your phone to the outgoing mail server of the email account you set up in the app, and sends the forwarded email from that account, exactly as if you had sent it yourself. Dostum does not operate a mail server or a sending address in this path.

Telegram forwarding (optional). If you enable Telegram forwarding, you create your own Telegram bot (via Telegram's @BotFather) and provide its bot token and your chat ID. The app then sends a copy of each incoming SMS directly from your phone to Telegram's servers (api.telegram.org) using your own bot, so you can read it in Telegram on your other devices. Your bot token and chat ID are stored encrypted on your device and are never sent to or stored by Dostum. Telegram is a third-party service governed by Telegram's own Privacy Policy.

4. Who receives your data

The parties that handle your data, and what each receives:

• Your own email provider (the account you send from) — receives the forwarded email (sender + message text + received time + device name) and your sign-in to that account. You choose and control this account; it sends the email for you and may keep a copy in your "Sent" folder under its own policy.
• The destination email provider — receives the forwarded email, delivered to the inbox you chose. You select this destination; the email is retained by that provider under its own policy.
• Telegram (only if you choose Telegram) — receives the forwarded message (sender + message text + received time + device name). Delivers it to your own Telegram chat through your own bot; retained by Telegram under its own policy.
• Supabase (authentication) — receives your account email and password for sign-in, never any SMS content. Used only for sign-in, sign-up and account deletion.
• Supabase (sign-up record) — when you create an account: your account email, sign-up method (email or Google), and the IP address and device user-agent of your first sign-in, never any SMS content. A one-time record of how each account was created, kept as security and fraud-prevention evidence. It is never used to block or restrict anyone.
• Slack (our team's internal workspace) — when you create an account: a notification with your account email, account ID, sign-up method, and the IP address of your first sign-in with the approximate location (city, region, country and network provider) we derive from it on our own server, never any SMS content. Tells our team about each new account. Slack acts as our processor. The IP-to-location lookup uses an offline database on Dostum's server; your IP is not sent to any lookup service.

5. Does Dostum receive or store your SMS?

No. Dostum's own servers never receive or store your SMS content, sender, timestamps, or delivery status. There is no Dostum backend in the forwarding path — the phone talks directly to your own email provider's mail server or to Telegram. If you create an account, our authentication service stores your account email and a one-time sign-up record (see "Who receives your data"); none of it is ever associated with any message. Guest use (without an account) sends nothing to our servers.

6. On-device storage and retention

• A recent-activity history (sender, time, and message text of forwarded messages) is kept only on your device, in the app's private storage, so you can see recent forwards.
• It is retained on your device until you delete your account in the app, clear the app's data, or uninstall the app. It is never uploaded to Dostum.
• The destination email, device name, your sending email account settings (including its password) and any Telegram details are stored in encrypted on-device storage until you change them, clear the app's data, uninstall, or delete your account.
• The sign-up record is kept while your account exists and is deleted automatically when you delete your account.
• Failed sends are retried locally on your device (the phone re-attempts the SMTP send); no server is involved in retries.

7. Data that remains in your email inbox

Once forwarded, the emails stay in the inbox of the email provider you chose. They are outside the app's control. To remove them, delete them in your email account — deleting your Dostum account does not remove emails already delivered to your inbox.

8. Encryption

In transit: the email send uses SSL/TLS to your provider's mail server, Telegram uses HTTPS, and sign-in uses HTTPS. At rest: the on-device history is in the app's private storage; account tokens and settings are stored using Android's encrypted preferences.

9. What we never collect

No analytics, no advertising, no advertising ID, no device identifiers, no location, no contacts, no call logs. No battery, network or diagnostic data is sent off your device (apart from the one-time sign-up record, which is created only if you make an account and sent when you first sign in). We do not sell your data, share it for advertising, or use it to train AI models.

10. Your controls

You can pause forwarding at any time, revoke the SMS permission in Android Settings (which stops the app receiving messages), change your destination email, and delete your account and on-device data from inside the app.

11. Account and data deletion

In the app: Settings → Delete account removes your account on our authentication service and wipes the app's on-device history and settings. You can also request deletion at https://sms.dostumamigo.com/delete-account/. Because no SMS content is stored on Dostum's servers, deletion removes your account record and its sign-up record (and local data on the device you use to delete). Emails already in your inbox must be deleted from your email account separately.

12. Your rights (GDPR)

You may request access, rectification, erasure, restriction, portability, or object to processing, and lodge a complaint with the Spanish AEPD. Contact privacy@dostumamigo.com. Legal basis: performance of the service you request (forwarding your messages) and your consent, given in-app before SMS permission is requested. The sign-up record is kept on the basis of our legitimate interest in preventing fraud and securing the service.

13. Use only on your own phone

Dostum SMS is designed for personal use on a phone you personally own. Install it only on a phone you own, and only set the destination to an email address you personally control. Scammers exploit shared SMS codes to take over bank, email, and messaging accounts — never install this app on someone else's phone, and never set the destination email to an address you do not trust.

14. Children

Dostum SMS is a general-audience tool for the phone's owner and is not directed at children.

15. Changes to this policy

We will update this page and the "Last updated" date when the app's data handling changes.

16. Contact

Privacy questions: privacy@dostumamigo.com
General support: support@dostumamigo.com
Postal address: Dostum Amigo SL, Calle Princesa Teguise 27, Puerto del Carmen, 35510 Tías, Las Palmas, Spain