Privacy Policy

Last updated: September 20, 2026

Ucode ("we," "us," or "our") operates the Ucode mobile applications (Android and iOS) and the website ucode.uk (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By using Ucode, you consent to the data practices described in this policy. If you do not agree, please discontinue use of the Service immediately.

1. Information We Collect

1.1 Information You Provide

• Account Information — email address, display name, and profile photo when you register or sign in via Email, Google Sign-In, or Apple Sign-In. Some older app versions may have sent a date of birth; that field is optional and is not required to create or use an account.
• Payment Information — when you purchase credits, payment details are collected and processed directly by our payment partners (Apple App Store, Google Play, Stripe). We do not store your credit card number, bank account, or billing address on our servers.
• Referral Code — if you enter or share a referral code, we record the code and the referral relationship.
• Support Communications — if you contact us for support, we collect the content of your message, email address, and any attachments.

1.2 Information Collected Automatically

• Device Information — device model, manufacturer, operating system version, unique device identifiers (Android ID, Identifier for Vendor), language, and timezone.
• Advertising Identifier — Google Advertising ID (Android) or Identifier for Advertisers (iOS), subject to your device settings and App Tracking Transparency authorization.
• Usage Data — services browsed, virtual numbers rented, SMS verification history (service name and status only — we do not read or store the content of verification codes), credit balance changes, and timestamps.
• Log Data — IP address, browser type, referring/exit pages, operating system, date/time stamps, and clickstream data.
• Push Token — Firebase Cloud Messaging (FCM) or Apple Push Notification Service (APNs) token for delivering notifications.

1.3 Information from Third Parties

• Authentication Providers — when you sign in with Google or Apple, we receive your name, email, and profile photo as permitted by those services.
• Payment Platforms — Apple, Google, and Stripe may share transaction identifiers, purchase status, and refund information with us.
• Install Attribution — Google Play Install Referrer data (UTM parameters) to understand how you discovered Ucode.

2. How We Use Your Information

Purpose	Data Used
Provide and operate the Service	Account info, device info, usage data
Process transactions and manage credits	Account info, payment transaction IDs
Send service notifications (SMS received, rental expiry, credit updates)	Push token, account info
Prevent fraud, abuse, and unauthorized access	Device identifiers, advertising ID, IP address, referral metadata
Operate the referral program	Referral code, device fingerprint, IP address
Improve the Service and user experience	Aggregated usage and analytics data
Respond to support requests	Communications, account info
Comply with legal obligations	As required by law

3. Information Sharing & Disclosure

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We may share information in the following limited circumstances:

• Service Providers — trusted third parties that perform services on our behalf (see Section 4), under contractual obligations to protect your data.
• Legal Requirements — when required by law, regulation, legal process, or enforceable governmental request.
• Safety & Fraud Prevention — to protect the rights, property, or safety of Ucode, our users, or the public; to detect and prevent fraud.
• Business Transfers — in connection with a merger, acquisition, or sale of assets, in which case your data would remain subject to this Privacy Policy.
• With Your Consent — when you explicitly authorize disclosure.

4. Third-Party Services

Ucode integrates the following third-party services, each governed by their own privacy policies:

Service	Purpose	Privacy Policy
Firebase (Google)	Authentication, analytics, crash reporting, push notifications	firebase.google.com/support/privacy
Google Sign-In	Account authentication	policies.google.com/privacy
Apple Sign-In	Account authentication	apple.com/legal/privacy
Stripe	Web payment processing	stripe.com/privacy
RevenueCat	In-app purchase management and subscription tracking	revenuecat.com/privacy
Cloudflare	Content delivery, DDoS protection, DNS	cloudflare.com/privacypolicy

5. Data Retention

• Account Data — retained as long as your account is active. Upon account deletion, personal data is removed within 30 days, except where we are required to retain it for legal or fraud-prevention purposes.
• Transaction & Credit History — retained for up to 3 years for accounting, dispute resolution, and legal compliance.
• SMS Verification Records — service name and status are retained for your history; we do not store the content of verification codes after delivery.
• Analytics Data — aggregated and anonymized data may be retained indefinitely.
• Fraud Prevention Data — device identifiers and IP addresses associated with referral or fraud-prevention checks may be retained for up to 2 years.

6. Data Security

We implement industry-standard security measures to protect your data, including:

• SSL/TLS encryption for all data in transit
• Encrypted storage for sensitive data at rest
• Firebase Authentication with secure token management
• Rate limiting and IP-based fraud detection
• Regular security reviews of our infrastructure

No method of transmission or storage is 100 % secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

7. Your Rights & Choices

Depending on your location, you may have the following rights:

All Users

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your account and personal data.
• Withdraw Consent — where processing is based on consent, you may withdraw it at any time.
• Opt-Out of Push Notifications — disable notifications in your device settings at any time.

European Economic Area (GDPR)

• Right to data portability
• Right to restrict processing
• Right to object to processing
• Right to lodge a complaint with a supervisory authority

California Residents (CCPA/CPRA)

• Right to know what personal information is collected and how it is used
• Right to delete personal information
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your privacy rights

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. Advertising, Tracking & Analytics

App Tracking Transparency (iOS) — On iOS 14.5 and later, we request your permission before accessing the Identifier for Advertisers (IDFA) via Apple's App Tracking Transparency framework. If you decline, we do not access the IDFA. This does not affect core app functionality.

Website cookies (UK GDPR / PECR) — On ucode.uk we use Google tag G-86S9DR8XP8 (Google Analytics 4) and Google Ads AW-11118090357 to measure visits and completed credit purchases. Advertising and analytics cookies stay off until you choose Accept all or Analytics only in the cookie banner. If you reject, Google Consent Mode v2 may still send cookieless pings so we can measure in aggregate without storing advertising cookies. You can change this at any time with Cookie settings.

Purchase measurement — After you buy credits on the web, we send a Google purchase event with the order value, currency, and a unique transaction ID so we can attribute advertising to real payments. If you accepted advertising cookies, we may send a hashed email for Enhanced Conversions. We do not send card numbers.

Firebase Analytics — We use Firebase Analytics to understand app and web-app usage patterns. On the website it follows the same cookie choice as Google Analytics. In the iOS app, collection is enabled only when you authorize tracking; otherwise it is limited to anonymous aggregate data. You can reset your advertising identifier or opt out of personalized ads in your device settings.

Session replay — We do not use session replay or session recording. Any analytics configuration keeps session replay off by default, and form fields (including passwords and payment inputs) are masked so typed values are not captured if a recording SDK is added later.

Fonts — Website typefaces are hosted on our own servers. We do not load fonts from Google Fonts or other third-party font CDNs.

We do not serve third-party display advertisements inside the Ucode apps.

9. Push Notifications

We send push notifications for important service events: SMS verification codes received, rental expirations, credit updates, and referral rewards. You can disable push notifications at any time through your device's system settings. Disabling notifications will not affect other features of the app.

10. Children's Privacy

Ucode does not restrict accounts by age and does not collect date of birth at signup. If you have questions about a child’s use of the Service, please contact us at [email protected].

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including countries that may not provide the same level of data protection. When we transfer data internationally, we rely on appropriate safeguards such as standard contractual clauses. By using the Service, you consent to such transfers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or by posting a prominent notice on our website. The "Last updated" date at the top reflects the most recent revision. Continued use of the Service after changes constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at:

Email: [email protected]
DMCA: [email protected] · Designated agent
Website: https://ucode.uk