Key Takeaways
- Write when message bodies die. Metadata (ids, device, status, truncated destination) can live longer than OTP text.
- The Android messaging app, carrier CDRs, and the control plane are three stores. Deleting one does not delete the others.
- Legal hold is a flag on export, not “never delete.”
- Support tickets should carry message ids, not live codes.
- You bring the phone and operator credit. Gateway pricing is devices plus send volume.
Android sms gateway data retention shows up in DPAs and in “can you still see that OTP from March?” The honest answer is: only if you designed it that way. A SIM gateway adds a messy extra copy — the phone’s own SMS store — that SaaS questionnaires like to skip.
Pair with log retention policy and audit logs. You supply the Android and airtime. We meter devices and send volume.
Body TTL vs metadata
Retention is a delete plan
“We keep everything” is not a policy. It is a breach waiting for a laptop. Decide periods per class of data, then automate the delete. If legal needs a hold, freeze a specific export — do not disable deletion globally.
If nobody can point to the job that expires OTP bodies, assume they live in Slack screenshots forever.
What you actually store
- Control plane: message id, device, status, timestamps, optional body.
- Your app: user id, challenge id, the same message id.
- Webhooks: event id + payload you chose to persist.
- Android: native SMS threads unless you lock that down.
- Operator: CDRs you will never fully see.
GDPR-minded handling: GDPR-minded data handling.
Suggested periods
These are starting points for a small SaaS team, not legal advice.
| Class | Suggested TTL | Rationale |
|---|---|---|
| OTP / reset bodies | Minutes to 24h, or never store | Credential material |
| Send metadata | 30–90 days | Support + DLR disputes |
| Privileged actions (keys, pairing) | 1 year+ | Who changed the path |
| Suppression list | As long as you might send | STOP is worthless if you expire it early |
| Verbose Android exports | 7 days after ticket close | Noisy and full of PII |
The handset is a second copy
Dedicated gateway phones should not be used for personal chat. Disable backups of SMS to a consumer cloud account if policy requires it. Physical access is data access — lock the drawer, lock the PIN, inventory the spare.
Device hygiene: profiles caution · setup.
GDPR-minded and hold
Know your roles. You are typically the controller of customer phone numbers you collected; the gateway processes sends you instructed. Do not promise “we never see content” if the panel shows bodies. Be accurate in the DPA.
Erasure requests: delete in your app, suppression list as appropriate, and remember the phone thread. Carrier copies are outside your wipe.
Export vs “the panel remembered it”
If a customer needs seven years, warehouse it. Plan analytics retention is a product limit, not an archive SLA. Export jobs should be audited. Developer Center owns live API shapes for history lookup.
Plans and volume
Storage policy is separate from the send meter. Free: 300 SMS lifetime. Developer: 25,000 SMS per year. Starter / Professional / Business: platform send volume uncapped, devices 2 / 5 / 15. Operator fair-use still applies. Pause on Free/Developer when the allowance is gone.
Checklist
- Written TTLs per class; job that enforces body deletion.
- Tickets use message ids; default redaction in support macros.
- Gateway phone is not backing SMS up to a personal Google account.
- STOP list outlives campaign metadata.
Next steps
Pick the table numbers in a 30-minute meeting, then look at one real OTP row in the panel and decide if that body should exist. Downloads.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
- SMS API documentationLive endpoint reference
- download the Android gateway appGet the APK
