MerkurSMS respects your privacy. This policy explains what data the app uses, why, and how it is handled.
(1) Data that NEVER leaves your phone: call log, contacts, SMS messages and conversations, rules, availability calendar, phone calendar and all settings. They are processed only locally on the device and are never sent to our servers or to third parties.
(2) Account data, only if you voluntarily sign in with Google: email address, unique account identifier (user ID), days balance, coupons, purchase records and notifications. They are stored on Google Firebase servers so your days and coupons stay tied to your account. You can delete them at any time.
(3) Technical identifiers for notifications (guests included): Firebase Cloud Messaging creates an anonymous installation identifier and a device token so the app can receive push notifications.
(4) Usage statistics and ad measurement (guests included): Google Analytics for Firebase counts installs and app usage and records where the install came from, and the Meta SDK tells Meta when the app is installed and opened, so we can measure our Facebook and Instagram ads. This uses anonymous app identifiers and technical device data, never your messages, calls or contacts. The Advertising ID is not collected.
Signing in is not required: without signing in you use the app as a guest with 3 free days, and with Google sign-in you get 14 days.
MerkurSMS uses these permissions to detect a missed call and the caller’s number, so it knows who to send the automatic SMS to. It also checks the call log to see whether that number has called you before (the “new numbers only” option, on by default) and counts today’s missed calls for the home screen. The call log is processed locally on the device and is never uploaded to our servers or shared with third parties.
MerkurSMS uses SEND_SMS to send the automatic reply to a missed call, follow-up messages based on the rules you set, and messages you write yourself in the chat. It uses RECEIVE_SMS to recognize a caller’s reply at the moment it arrives: if a message comes from a number MerkurSMS has already messaged, the app stores it in the local conversation history and checks whether it contains one of your follow-up keywords. Messages from all other numbers (personal messages) are ignored and not stored. MerkurSMS does NOT request the READ_SMS permission and does not read the SMS messages stored on your phone. Message content is never sold, shared or uploaded to our servers. SMS is sent through your mobile carrier and charged at its rates.
The Chats tab shows only conversations started by the app: messages MerkurSMS sent and callers’ replies to them. This history is stored only in the app’s storage on your phone (a limited number of the most recent messages), is not backed up and is not sent to any server. It is deleted when you uninstall the app or clear the app’s data in your phone settings.
The “send only to numbers not in contacts” option is on by default, so MerkurSMS never messages family and friends. For this the app only checks whether the caller’s number is saved in your contacts. The check is done locally on the device; contacts are never read in bulk, uploaded to our servers, sold or shared with third parties.
Requested only when you turn on Call back or Use phone calendar, or book an appointment from a conversation. MerkurSMS then adds to your phone’s calendar a reminder to call the caller back (with their number) and the appointments you book, removes the reminder once you call that caller back, and reads only the times of busy events (not titles or descriptions) so it does not offer callers days when you are busy. Everything is processed locally; your calendar is never sent to our servers or to third parties. If the calendar on your phone syncs with your Google account, these events sync like any other event you add yourself.
If you turn on Silence phone, you grant MerkurSMS Do Not Disturb access in system settings. The app uses it only to turn on Do Not Disturb or vibrate during the time you set and to turn the ringer back on afterwards. It does not read your notifications.
Google sign-in goes through Firebase Authentication and is not required. If you sign in, we receive your email address and a unique account identifier (user ID) created by Firebase. We use them only to tie your days, purchases and coupons to your account, so they are not lost when you reinstall the app or change phones. Signing in gives you a 14-day trial. Without signing in you use the app as a guest (3 free days) and no account data is collected. You can sign out or delete your account at any time.
• Firebase Authentication: Google sign-in and a unique account identifier (user ID).
• Cloud Firestore (database), for signed-in users only: account profile (email, account creation and trial start date, access end date, number of granted days, number of codes created and redeemed, and days earned through codes), coupons you create, records of coupons you redeem, purchase records (purchase identifier, product, order ID and date), in-app notifications (bell) and device tokens for notifications. The app also reads a public configuration from Firestore (new version notice) that contains no personal data.
• Cloud Functions (server): account and trial creation, creating and redeeming coupons, verifying purchases with Google Play, account deletion and sending notifications.
• Firebase Cloud Messaging: push notifications. For every device (guests included) an anonymous installation identifier and token are created; the device subscribes to a shared topic for general announcements (e.g. promotions and new versions), and for signed-in users the token is stored with the account for personal notifications (e.g. when someone redeems your coupon).
• Google Analytics for Firebase: anonymous usage statistics, such as app installs and first opens, the source of the install (for example a link on our website), app version, device model, OS version, language and approximate country. It uses an app-instance identifier and is not linked to your email, messages, calls or contacts. We use it only to know how many people install and use the app.
• Meta (Facebook) SDK, App Events only: when the app is installed and opened, it sends Meta Platforms Ireland an app event with technical device data (app version, device model, OS version, language) so we can measure our Facebook and Instagram ads. The Advertising ID is not collected. Meta processes this data under its own policy; it is not linked to your messages, calls or contacts.
Your SMS messages, conversations, contacts and call log are NOT stored on Firebase servers. The app does not show ads and does not sell or share data for advertising.
On Android 13+ the app asks for permission to show notifications about coupons, promotions and important announcements. This permission is optional; you can decline it or turn it off later in the app or phone settings without affecting automation.
INTERNET and ACCESS_NETWORK_STATE: sign-in, account sync (days and coupons), purchases, notifications, usage statistics and ad measurement; automation itself works without internet. com.android.vending.BILLING: buying days through Google Play. RECEIVE_BOOT_COMPLETED is also used by the app itself: after the phone restarts, it reschedules silencing. WAKE_LOCK, RECEIVE_BOOT_COMPLETED and FOREGROUND_SERVICE are also added by system libraries (Android WorkManager and Firebase) for reliable scheduled sending and receiving notifications. None of these permissions is used to send your messages, calls or contacts to any server.
On the device (locally): settings, rules, automation schedule, availability calendar, history of conversations started by the app, and the trial state for guests. Call log, SMS messages and contacts remain in the phone’s system and the app only checks them.
On the server (Google Firebase), only if you are signed in: the data listed in section 6.
On the server, for all users: an anonymous installation identifier and notification token (Firebase Cloud Messaging), anonymous usage statistics (Google Analytics for Firebase) and install/app-open events (Meta).
With Android Auto Backup enabled, only basic app settings (e.g. which rules are enabled) and technical records of credited purchases are stored on your private Google Drive. Purchased days are tied to your account, not to the phone.
We do not sell your data. Account data is processed by Google Firebase (Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging) as our processor, on our behalf and according to our instructions. Usage statistics are processed by Google (Google Analytics for Firebase). Install and app-open events are sent to Meta Platforms Ireland to measure our ads; Meta processes them under its own data policy. Payments are processed by Google Play; MerkurSMS never sees your card details. We do not share your messages, calls or contacts with anyone; the only exception is the SMS that the app, according to your rules, sends to the recipient through your mobile carrier.
You can permanently delete your account data in the app: Settings → Account → “Delete account and data”. This deletes from the server your profile (including email), all your codes, redemption records, your notifications, saved device tokens and the app’s Google/Firebase account itself. Purchase records (purchase identifier, product, order ID and date) are kept to prevent double crediting and for legal obligations, but are no longer linked to your email. You can also request deletion by email at kontakt.merkursms@gmail.com or via the web form at https://merkursms.com/en/delete-account/.
You delete local data (conversations, rules, settings) by uninstalling the app or via phone Settings → Apps → MerkurSMS → Storage → Clear data.
A guest (not signed in) gets 3 days of free use; a signed-in user gets 14 days. Each purchase through Google Play adds 31 days of access; it is a one-time purchase, not a subscription, and does not renew automatically. Signing in is required to buy days; purchased days are tied to the account on the server and restored on another device or after reinstalling.
Permissions are requested only when you turn on automation, after an explanation of what they are for, and you can revoke them at any time in your phone settings (automation then stops working). Signing in is voluntary; you can sign out or delete your account at any time. You have the right to request access to, correction or deletion of your data.
This section applies to our website merkursms.com, not to the app. We use Google Analytics 4 and the Meta Pixel (Facebook), both loaded through Google Tag Manager, to understand how the site is used (for example page views, approximate location by IP, device and browser type, and referring source) and to measure our advertising. These analytics and marketing cookies are set only after you accept them in the cookie banner. If you decline, nothing is loaded and no such cookies are set. This data is processed by Google (Analytics) and by Meta Platforms Ireland (Meta Pixel) as our processors; we do not use it to identify you personally. You can change your choice at any time () or block cookies in your browser.
For privacy questions and deletion requests: kontakt.merkursms@gmail.com
