Privacy Policy

Updated October 10, 2026 · Русская версия

In short: no account is needed and we don't ask for your name. The iPhone and Android apps work with an anonymous device identifier. You enter your card on the payment provider's page — the app never sees it.

Who processes the data

The КупиСим service (iPhone and Android apps, the kupisim.app website). Contact for any data question: [email protected].

What we collect

Device identifier — a random number the app creates on first launch. Your purchases and eSIMs are tied to it; it is not linked to your identity. On iPhone it is kept in the secure Keychain. On Android it is kept in the app's storage, and so that purchases survive a reinstall or a move to a new phone, the system keeps it in your Google account backup (Android Backup and Block Store).
Purchase data — which plan, when, for how much, the eSIM status and data used. Needed to show “My eSIMs”, widgets and to process refunds.
Technical data — app version, the store it was installed from, phone model, whether it supports eSIM, the connection IP address and environment signals (modified system, debugger, emulator, installed outside a store). The payment provider needs the IP to verify the transaction; the rest is for compatibility and fraud prevention.
Device attestation — so purchases cannot be made on your behalf, the app creates a key in the phone's secure chip and sends us its public part with the manufacturer's confirmation: Apple App Attest on iPhone, Android Key Attestation on Android. It contains no personal data.
Notification token — if you allow notifications (“eSIM is ready”, “data is running low”), the device gives the app a technical token to deliver them. On iPhone notifications are delivered by Apple, on Android by Google (Firebase Cloud Messaging; its library creates its own installation ID). You can turn notifications off in the phone's settings — the app keeps working.
Ideas and suggestions — if you write to us via “Suggest an idea”, we receive the text and a photo if you attach one. The message arrives in our support chat in Telegram.
Usage statistics and crashes (iPhone only) — the iPhone app sends anonymized usage events (such as “eSIM installed”) and crash reports to AppMetrica (Yandex) so we can find and fix bugs. The Android app has no analytics or crash reporting.

What we don't collect

Name, address, date of birth, documents.
Your location: the app does not request location access.
Your traffic: we cannot see which sites you open over the eSIM.
Contacts, camera and microphone.
Advertising identifiers: there are no ads and no cross-app tracking.

Payment and card data

You enter your card details on the page of the payment provider CloudPayments: on iPhone it opens in Safari, on Android in a window inside the app. Only CloudPayments sees the card; neither the app nor our server receives it.

You can give your email for the receipt on the same page — CloudPayments receives it to send the receipt required by Russian law (54-FZ). When paying via SBP (Faster Payments System) you confirm the payment in your bank's app.

Who we share with

CloudPayments (payment provider) — amount, order number, device identifier and IP; you enter the card and the email for the receipt on its page yourself.
The eSIM supplier — only technical information about the plan order. Your personal data is not shared with it.
Apple (iPhone) — the notification token and text at the moment of sending; App Attest device attestation.
Google (Android) — the notification token and text at the moment of sending (Firebase Cloud Messaging). Key Attestation is verified on our side; Google receives no data about you in the process.
Yandex (AppMetrica, iPhone only) — anonymized events and crash reports.
Telegram — the text and photo of a “Suggest an idea” message, to our support chat.

These services process data on our behalf and only for the purposes listed. We do not sell data or share it with third parties for advertising.

How long we keep it

Purchase and eSIM information — as long as needed for support and accounting. Security records (one-time request keys) are deleted automatically within a day.

Your rights

You can ask us at any time to delete the data tied to your device — see how below.

Data deletion

How to delete your КупиСим (KupiSim) app data, iPhone and Android:

Email [email protected] with the subject “Data deletion”.
Include your device ID: in the app, open the Settings tab, row “Device ID” — the button next to it copies it in full.
We delete the data within 30 days and confirm by reply.

What is deleted: the device ID and everything tied to it on our side — the list of eSIMs and orders in the app, the notification token, the device attestation key and ideas you sent. An installed eSIM keeps working until it expires, but it will no longer appear in the app and can no longer be topped up.

What is kept: records of completed payments and fiscal receipts — with CloudPayments and in our accounting for 5 years as required by law, without a link to the device.

Changes

If the policy changes, we will update the date at the top of the page; significant changes will be shown in the app.