Messaging Policy

Last updated: October 29, 2026

The short version

Text people only after they asked you to, and only about what they asked for.

Keep proof of that consent for at least four years.

Stop the moment they say stop, in any words. We enforce this for you.

Say who you are, keep to daytime hours, and do not hide behind rotating numbers or public link shorteners.

Some content is never allowed (phishing, sexual content, firearms, tobacco, cannabis, gambling, payday loans, crypto). Some needs our approval first (alcohol, debt collection, political campaigns).

This Messaging Policy is our acceptable use policy. It is part of the Terms of Service and applies to every message sent through TextKit, by you or by anyone you let use your account. It reflects the TCPA and FCC rules, the CTIA Messaging Principles and Best Practices, and carrier codes of conduct. Carriers enforce these rules independently of us, so a violation can get traffic filtered or numbers blocked even before we act.

1.1 Get the right consent first.

Informational and transactional messages (order updates, appointments, account alerts, verification codes) require the recipient's prior express consent, typically given when they provide their number to you for that purpose.
Marketing and promotional messages require prior express written consent: a signed (electronic is fine) agreement that clearly authorizes you to send marketing texts to that number, and that is not a condition of purchase.
Conversational replies. A person who texts you first has consented to a reply about what they asked, not to ongoing messages or marketing.

1.2 Consent is specific. Consent covers the brand and the kind of messages it was given for. It cannot be bought, sold, rented, shared, or transferred, and consent given to one business does not cover another. Separate consent for texts from consent for email or calls, and never bury it in general terms or pre-check the box. A number someone posted publicly (in a marketplace or classified listing, a directory or a website), or one on a bought, rented or scraped list, has not consented to texts from you. Before we file a registration or a toll-free verification we check its description, opt-in and example messages, and we do not file one built on numbers from those sources.

1.3 Disclose at opt-in. Wherever you collect consent, disclose your program or brand name; what messages to expect and how often (or "message frequency varies"); "Message and data rates may apply"; "Reply STOP to cancel" and "Reply HELP for help"; and links to your privacy policy and terms. We review these disclosures during campaign registration and may require changes before activating a campaign. Our registration tool checks the public pages you give it for these disclosures automatically and suggests wording, and checks the example messages you give us against a fixed set of rules, including the content rules every live message is screened with (§4 below); it can also fill in your business details from your website for you to review (Privacy §4). In the console you always choose what you send and write your own example messages. Our public texting plan page (/plan) suggests texts a business could send and draft wording for them; those drafts are ours, not your examples, and are never filed. It is a convenience, not legal advice: what it suggests can be wrong, you are responsible for what you submit, and passing it does not guarantee that carriers approve a campaign. The example messages on your registration must be real examples of what you will send: we file them as yours, and we keep a copy of exactly what was filed.

1.4 Keep records. Keep evidence of every consent: the number, the date and time, the method (web form, keyword, paper, checkout), the exact disclosure language shown, and, for online forms, the IP address and page. Keep it for at least four years after your last message to that number (the TCPA's limitation period), and produce it within five business days if we ask (Terms §3.3). You may store this evidence with us through the consent API's opt-in proof, by recording it through the console (on a contact's page, or when a message is refused for having none), or by including opt-in status, date, and source columns when you import contacts; we keep it with your consent records and include it in your consent export, but keeping complete evidence remains your responsibility. Importing a contact list does not create consent, and an import never opts anyone back in. If you use an opt-in page we host for you, each sign-up is recorded with this evidence automatically and is double opt-in: once your number for that program is approved and your account is live, we text the person asking them to reply YES, and the sign-up counts as an opt-in only when they do (within 7 days); until then, or if no text could be sent, it is kept as a request, not consent. The page is a convenience written from your registration, not legal advice. It links your own terms and privacy policy, which you write and keep current: we don't write them for you. A sign-up from a number that has opted out does not opt it back in and gets no text (only a START from that number does). An opt-in you record for a registration whose use case is marketing (or mixed) must carry this evidence: the method, when it was collected, and the page for a web form or the inbound message for a keyword reply; the consent API, the console and a contact import refuse one without it, and record nothing. The console does not offer an opt-in given out loud for such a registration: marketing texts need written consent. Keyword opt-ins and sign-ups on a page we host record their evidence themselves.

1.5 We look for an opt-in before we send. We send a marketing message (§6 says which messages count as marketing) only to a number with an opt-in on file with your account: one you recorded through the consent API or the console, a contact import that marks the number opted in, or the person texting START or another opt-in keyword to your number, and not withdrawn since. A recurring message that is not marketing (a receipt, an alert, a reminder) from a number linked to a registration needs an opt-in on file too; you can record how you collected it with the message itself. One-time codes, and a reply to someone who texted that number in the last four hours, need none. Otherwise the message is refused before it is sent, with an error that says why, and is not charged. Your own phone and the numbers you have verified with us are exempt so you can test. This checks that a record exists, not that it is valid consent: getting and keeping the consent §1.1 to §1.4 describe remains yours, and we do not check non-marketing messages from a number that has no registration.

Consent is per registration. Carriers treat consent as given to one business for one kind of message: the registration your number sends under. So a message from a number linked to a registration (other than a one-time code) goes only to a number with an opt-in on file for that registration: one you recorded for that registration (through the consent API with its id, or in the console), a contact import that names it, a START or YES reply to one of its numbers, or a sign-up on an opt-in page we host for it, once confirmed by a YES reply. From a number with no registration behind it, any opt-in on file with your account counts, and transactional messages are not checked. An opt-out is never narrower than your account: STOP to any of your numbers stops every registration.

Re-confirmation. Some carriers require that a person who has not heard from a marketing program for 30 days confirms they still want it before the next marketing message. So, by default, a marketing message from a number linked to a registration to someone that number has not messaged in 30 days is held, and we first send one re-confirmation text in your business's name, with STOP and HELP. If the person replies YES within 7 days we send the held message; if not, we drop it, record it in your message log as not confirmed, and refuse marketing to that number until they opt in again. We never charge for a held or dropped message. An administrator may turn this off in the console after acknowledging that your account handles it itself; the acknowledgment is recorded in your audit log. Transactional messages, one-time codes, and your own verified numbers are never held.

2. Who You May Text

Do Not Call. Marketing messages are subject to the National Do Not Call Registry and to state lists. Unless you have prior express written consent or another exemption the law recognizes, do not send marketing to numbers on those lists, and keep your own internal do-not-contact list.
Reassigned numbers. Phone numbers change hands. Remove numbers you learn have been disconnected or reassigned (for example from carrier deactivation files or the FCC's Reassigned Numbers Database) promptly, and do not keep texting a number whose new owner never consented.
Minors and age gating. Do not direct age-restricted content (alcohol) to anyone under the legal age, and age-gate opt-in for those programs by asking for the person's date of birth (carriers do not accept a yes/no question as an age gate).

3. Opt-Outs and Help

Any reasonable means. A recipient can revoke consent in any reasonable way: a keyword, a plain-language reply ("please stop texting me"), a phone call, an email, or a form. You must honor a revocation however it reaches you, within the time the law requires and in any case within 10 business days, and we recommend immediately.
What we enforce for you. On every number, the replies STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, OPTOUT, REVOKE, and ARRET opt the sender out of your messages immediately, also when spaced out or hyphenated ("S T O P", "STOP ALL"), commonly misspelled ("STP", "STOPP"), or "SPAM". We also detect plain-language revocations and treat them the same way. HELP, INFO, and AIDE receive your help reply, including from a number that has opted out. These replies identify your business, not us: a number sending under an approved campaign uses the help and opt-out messages that campaign registered. Opt-outs reach you through the API and webhooks; record revocations that reach you by other channels in your own systems and via the opt-out API.
One confirmation, then silence. After an opt-out, at most one message confirming it, with no marketing in it, may be sent. Nothing else may be sent to that number until it opts back in, for example by replying START. A message you try to send to an opted-out number is refused, not delivered and not billed, and the refusal is recorded in that number's consent history and in your message log. A recipient who opts back in by keyword receives one message confirming it.
Bring your opt-outs with you. An opt-out given to you through another provider or tool still applies when you send through us. Import those numbers before you send to them. When you move an account to us with our import tool, it asks for that list, or for your confirmation that there is none, before it runs. We cannot obtain the list for you, and importing it remains your responsibility.
Never re-add. Do not re-import, re-upload, or otherwise re-subscribe an opted-out number without a new, documented opt-in. Importing contacts never lifts an opt-out: an opted-out number stays opted out, and a row your file marks as unsubscribed is recorded as an opt-out. Contacts that arrive from a tool you connect follow the same rules: an opt-in is recorded only when that tool records SMS consent, and an unsubscribe there is recorded as an opt-out here. An opt-out the person gave themselves (by text, or one you imported from another provider) is permanent: only they can lift it, by texting START to one of your numbers. To opt back in a number you opted out yourself through the consent API or the console, or one opted out through our report form (which cannot confirm who filed the report), record that new opt-in's evidence, collected on or after the opt-out, unless the person has since texted STOP themselves; in the console only an admin can.
Subscription topics. You can let recipients stop one kind of message (for example marketing) and keep another (for example account alerts). A broadcast sent on a topic skips anyone unsubscribed from it. Topics only ever narrow who you text: an opt-out still stops every message, and subscribing someone to a topic does not opt them back in.

4. Prohibited Content and Uses

These are never allowed, with or without approval:

Content that is illegal where it is sent or received, including illegal drugs and the sale of prescription drugs without a valid prescription.
Fraud and deception: phishing, smishing, and impersonation of any person, brand, government agency, or bank; requests for a recipient to send back a security code; fake prize, refund, or delivery notices; romance and advance-fee scams; and simulated phishing, even for training.
Sexual or adult content, including links to it.
Firearms, ammunition, and explosives, and their parts or accessories.
Tobacco and vaping products, including e-cigarettes.
Cannabis, CBD, kratom, and psychedelics, even where legal.
Gambling, sweepstakes, giveaways, and lotteries.
High-risk financial services: payday, short-term high-interest, and title loans; auto and mortgage loans from anyone but the direct lender; student loans and student-loan relief; debt relief, consolidation, settlement, or credit repair; cryptocurrency promotions; and stock alerts or trading tips.
Get-rich-quick, multi-level marketing, and work-from-home offers, and risky investment schemes.
Job postings, unless you are the employer hiring.
Profanity.
Hate speech, harassment, threats, and content that promotes violence or self-harm.
Third-party lead generation, affiliate marketing, and referral or reseller schemes, and any use in which phone numbers or consent are collected to be sold, rented, or shared.
Spoofing or misrepresenting the sending number or sender identity.
Malware, and links to it.
Traffic with no human purpose: SMS pumping, artificially inflated traffic, or any scheme that generates messages for revenue share.
Receiving verification codes for other services: using our numbers to receive one-time codes that create, verify, or recover accounts on services you do not own, or offering numbers to others for that purpose.
Messages to emergency numbers, or any attempt to use the Service as an emergency service.

5. Restricted Content

These categories need our approval in advance, which we give in writing for your account or for a specific registration, and only where the carriers allow the use case. Our content screen blocks alcohol automatically until you are approved; sending any of them without approval violates this policy even where a message gets through.

Alcohol (age-gated opt-in with the date of birth required, §2).
Debt collection, which must also comply with the FDCPA and Regulation F. Carriers may refuse debt-collection messages even after we approve them.
Political and advocacy campaigns, which must also be registered with the carriers and include the disclosures election law requires.

6. Sending Practices

Identify yourself. Each conversation must identify your brand, and you may not impersonate anyone, including in the app_name of verification messages. An app_name must be a name: letters, numbers, spaces and basic punctuation, with no links or phone numbers, and it passes the same content rules as any message. An automatic reply is checked when it is sent, like any other message, and is not sent when a check refuses it. Name your business in the first message to each person, and include opt-out wording ("Reply STOP to opt out") in marketing messages: in the first one to each person and at least every 30 days. What we do by default: from a number linked to a registration, when a person's first message from that number does not name your business, we put your business name and a colon in front of it; and when a marketing message that is due opt-out wording has none, we add " Reply STOP to opt out." at the end. We do not add either to a one-time code or to a reply sent within a few hours of a message from that person. The message you receive back from the API, your message log and the message.sent event show the text as sent and what we added. The added words can make a message longer (one more segment), and each segment is billed at the published rate plus its carrier fee (Terms §4.3). Including the right wording yourself remains your responsibility.
Quiet hours. Do not send messages before 8 a.m. or after 9 p.m. in the recipient's local time, or outside any narrower window a state requires (several states end at 8 p.m. and limit messages per day). What we do: a message that falls outside 8 a.m. to 9 p.m. (8 p.m. for a number with a Florida, Maryland or Oklahoma area code) is refused, or held and sent at 8 a.m., using the time zone of the area code of the recipient's number; a number whose area code does not show a time zone is held to the hours of every time zone in the contiguous United States. This applies to every kind of message and cannot be turned off. The only messages sent at night are one-time codes, replies within a few hours of a message from that person, the one text our hosted opt-in page sends right after someone signs up there to ask them to reply YES, and messages to your own verified test numbers. For a number with a Florida, Maryland or Oklahoma area code we also refuse, or hold, a fourth marketing message from your account within 24 hours, whatever it is about; replies within a few hours of a message from that person and messages to your test numbers do not count. What that does not cover: an area code shows where a number was issued, not where the person is, and we apply the 8 a.m. to 9 p.m. window everywhere and those three states' rules only, not any other state's narrower hours or daily limits. You remain responsible for sending only at the hours the law allows wherever your recipients are, and for consent. This is a safeguard. It is not a guarantee that a message complies with the law.
Stay within your registration. Carriers approve a registration for one kind of message, and treat anything outside it as a violation. So the sending number's registration and the message's wording decide what a message is, not a label you give it: a label can make a message count as marketing, never the reverse. A message from a two-factor registration must be a one-time code; one from a registration that is not for marketing (account alerts, customer care, delivery notifications and the like) may not carry promotional wording (an offer, a discount, a promo code) or be labelled marketing; everything from a marketing registration is marketing; and on a mixed or low-volume registration a message is marketing unless it is a one-time code or you label it transactional and it has no promotional wording. From a number with no registration, a broadcast or batch, promotional wording, or a marketing label makes a message marketing. What we do by default: we refuse a message outside the sending number's registration before it is sent, and do not charge for it. Our check reads the wording with fixed rules; then, for a number linked to a registration, an automated classifier compares each new kind of message (its text with names, numbers and links masked) with the registration as filed: its use case, description and example messages. A kind that clearly does not match is refused; promotional content on a mixed or low-volume registration counts as marketing; and a kind the classifier cannot place is held for our team to review first (§9). It can only make a message stricter, never looser, and messages from a two-factor registration are checked by the fixed rules alone. If you think it refused a kind of message wrongly, contact us and our team can approve it. A registration also says whether its messages contain phone numbers; if it says they do not, we refuse a message with a phone number written in it. These checks can miss things; sending only what your registration covers remains your responsibility.
Sending speed. Carriers limit how fast a registration may send. We pace queued messages (batches, broadcasts, scheduled messages) to each registration's limit and refuse a faster direct send with an error that says when to retry. A carrier may also refuse messages past a daily limit for your business. What we do by default: we stop registered traffic under one business tax ID (EIN), across all its accounts, at the carriers' daily cap (2,000 messages a day unless the business's carrier vetting score allows more and our team raises it); in an account's first 30 days of live sending, we cap the different people it may text a day at the larger of 200 and three times the daily volume it told us to expect; and we refuse more than 10 messages from one account to one person in 5 minutes (25 while that person is texting back). Over a daily cap, a queued message waits for the next day (UTC) and a direct send is refused with an error that says when to retry. Your own verified test recipients are not limited. Refused messages are not charged.
No filter evasion. Do not spread traffic across numbers to avoid per-number limits or filtering ("snowshoeing"), replace numbers that carriers filter or block with new ones ("number cycling"), deliberately misspell words, or alter content to evade carrier filters. What we do by default: we watch for the same message spread across many of your numbers or across accounts, for many numbers bought in a day, and for several registrations for one use case under one business, and our team reviews what we find; and when a number carriers were filtering is released and another is bought within 7 days, we hold new number purchases on your account until our team has reviewed it (your existing numbers keep working). We also refuse a message to a person your account texted from two of its other numbers in the last 24 hours (a reply to someone who texted that number is never refused).
Links. Use links on a domain you own. Public URL shorteners (shared bit.ly-style domains) are blocked, because carriers filter them as a phishing signal. What we do by default: from a number linked to a registration, or a toll-free number verified through our form, a message may link only to the website domain on its registration or verification (and its subdomains), a domain in the example messages or links filed with the carriers, or a domain our team has added for it at your request; a link elsewhere, or one that redirects elsewhere, is refused, and so is any link when the registration or verification says its messages carry none. A link to a domain made to look like another (a well-known brand's, or your own) is refused as phishing. We check where each link leads once for each kind of message, by visiting it and following its redirects without reading the page. Your own test recipients are exempt.
Register before you text the public. A US local number may text the public only once it is linked to an approved registration. Until then it can text only phone numbers you have verified with us as your own, so you can test; a message to anyone else is refused before it is sent, with an error that says why, and is not charged. A toll-free number is verified with the carriers instead, for one business and use case: you fill in the form in the console or through the API, a person on our team checks it, we file it, and the same limit applies to it until its verification is approved. You can buy a toll-free number before your account has live access; until the account has it, live messages (from the console or with a live API key) can go only from that toll-free number and only to phone numbers you have verified with us as your own, billed like any live message, and anything else is refused before it is sent and not charged. Once approved its messages must come from, and name, the business it was verified for, and its business and use case cannot be changed: to send something else, add another toll-free number and verify it for that. Canadian numbers cannot be registered through us yet, so the same limit applies to them. One registration covers up to 49 numbers.
We verify your business before we file. Carriers accept registrations only from real, identified businesses, so before we first file a registration for a business, a person authorized to act for it (its authorized representative, or someone else who can act for it) must sign a short statement that they are authorized, that the business details match the business's tax records, and that the business will text only people who agreed to it and will follow this policy. The representative you name must work for the business and use an email address at the business's own domain, not a free mailbox or a shared inbox, and the registered address must be a street address. We then check the business and the representative ourselves, usually within 1 business day, and file the registration only once we have verified the business; a business we cannot verify has its registrations returned with the reason, and we may ask for documents. We verify each business once; changing its legal details or its representative means signing and verifying again. A toll-free verification form is signed the same way when you submit it; our team checks the form before we send it to the carriers, and when the carriers verify it, we treat the business named on it as verified by us too (unless we have already declined that business, or our sanctions-list check needs a closer look) and your account gets live access. Live access to the Service requires a verified business. Signing for a business you are not authorized to act for, or giving false business details, is a breach of these terms (Terms §2.2 and §3.5), and we report it to carriers and registries on request.
Match your registration. Messages must fit the use case you registered for the campaign and the example messages you filed with it; register a new campaign before sending a different kind of message.
Watch your rates. For each registration we count, over the last 24 hours, the messages carriers accepted from its numbers and the people who opted out by texting them. Above 0.5% (with at least 200 sent) we warn you and review it. Above 4% (with at least 100 sent) we pause marketing messages from that registration's numbers, refusing them before they are sent and without charge, until we have reviewed its consent with you and resumed it; transactional messages are not paused. We may also pause a campaign whose complaint or carrier-filtering rate is well above industry norms while we review its consent.
Sensitive data. Do not send payment card numbers, account passwords, government ID numbers, or protected health information (Terms §6.5).

7. Sending on Behalf of Others

If you run a platform, agency, or reseller business that sends for other businesses:

Each end business must be registered as its own brand and campaign with accurate information. Do not send one business's traffic under another's registration.
Each end business must obtain its own consent and follow this policy, and you must flow these obligations down in your contract with them.
You must be able to identify, on our request, the end business behind any message, and to stop any end business's traffic promptly. Assigning each end business's numbers to a customer in the API is the simplest way to do both, though it is not required.
You are responsible for their traffic as if it were your own (Terms §2.4).

8. Canada

Messages to Canadian recipients must also comply with CASL (express consent, sender identification, and an unsubscribe mechanism in each commercial message, honored within 10 business days) and with French-language expectations: ARRET and AIDE work on every number.

9. How We Enforce This Policy

We screen messages automatically before they are sent and inbound replies as they arrive, using rules and machine-learning classifiers, for the prohibited and restricted content above, for scam patterns, and for opt-outs. A live message is sent only once our screen has checked it: if the screen cannot run, the message is refused and not charged (a batch or scheduled message waits and tries again for about 15 minutes first). We verify a business before we first file a registration for it, and we file no registration for a business we have not verified; our team checks each toll-free verification form before we send it, and the carriers' verification of it verifies the business (§6). We also refuse messages to the public from a number that is not yet linked to an approved registration or whose toll-free verification is not approved, and, before your account has live access, any live message other than one from your toll-free number to a number you have verified (§6); we refuse a message outside the sending number's registration, using fixed rules and, for each new kind of message from a registered number, an automated classifier (§6, "Stay within your registration"); a message we could not check that way is not sent, like one the screen could not check. We refuse or hold messages outside 8 a.m. to 9 p.m. (8 p.m. in Florida, Maryland and Oklahoma) in the recipient's local time, and a fourth marketing message in 24 hours to a person in those three states, as described in §6, and we refuse a marketing message to a number with no opt-in on file with your account, for the sending number's registration where it has one, and a recurring message from a registered number to a number with no opt-in on file for its registration (§1.5), and hold a marketing message to a number a registered sender has not messaged in 30 days until the person confirms (§1.5), and we pause marketing on a registration whose opt-out rate passes 4% (§6). During your account's first 30 days of live sending, a person on our team reviews each new kind of message from a number linked to a registration, or a toll-free number verified through our form, before it goes out (messages that differ only in names, numbers, amounts or links are one kind): those messages are held and not charged, and are sent once we approve the kind; a kind we do not approve is refused, then and later, and a held message we have not reviewed within 3 days is dropped. At any age of the account, a new kind of message the classifier could not place is reviewed the same way. We may keep reviewing an account for longer, or stop sooner, and record that in your audit log. A closed or suspended account sends nothing at all. We never silently drop or change a message: a blocked or held send returns an error that names the reason, is recorded in your message log with that reason (updated if a held message is later sent or dropped), and is not charged; and the only change we make to a message is adding your business name or opt-out wording where §6 ("Identify yourself") says we do, which the API response and your message log show. These checks do not verify that consent is valid, and they do not check whether a number has been reassigned or appears on any do-not-call or litigant list; those remain yours. We may also pause campaigns, including every message from a registration's numbers while we review it, suspend accounts, keys or numbers, request consent evidence, and share information with carriers and registries (Terms §3.5); each such step, an approval of restricted content for a registration (§5), and each review decision on a kind of message, is recorded in your audit log with the reason. Carriers run their own filtering, which we do not control.

Strikes and the automatic pause. A message our checks block as phishing, impersonation or fraud, a kind of message our team rejects in review, texting people from a third number (§6 "No filter evasion") on three or more people in a day, or abuse our team confirms, is a strike against the account. The same message to the same person counts once a day, and one person's messages add at most two strikes a day. Three phishing, impersonation or fraud strikes involving two or more people within 7 days pause all of the account's live sending at once, pending our review: your keys, data and numbers keep working, batches and scheduled messages wait instead of failing, a direct send is refused with an error that says why, and we email you. Reply to appeal. Our team then lifts the pause, which clears the strikes, or suspends the account (Terms §3.5). Strikes are kept 30 days.

The enforcement ladder. Over each rolling 7 days we look at each registration's complaint rate (replies like "spam" or "wrong number", and verified reports, §10), the share of its messages carriers filter, its opt-out rate, its strikes and the kinds of message our team rejected, and a number of it that carriers filter almost every time. Past our thresholds it moves up a step: a warning (complaints over 0.1%, filtered over 5%, opt-outs over 0.5%, or one strike), then half speed (complaints over 0.3%, filtered over 15%, opt-outs over 2%, or two strikes or rejected kinds of message in 7 days: the registration sends at half its pace and half its business's daily cap), then paused (complaints over 0.5%, opt-outs over 4%, or a number filtered almost every time: its numbers send nothing). Rates count only once a registration has sent 200 messages in the 7 days. Each step emails you, sends a compliance.flagged or compliance.paused webhook event, shows in the console, and is recorded in your audit log; you can appeal from the console. Only our team moves a registration back down, with a reason.

Received an unwanted text from a number on TextKit? Reply STOP to that number, then report it at /report, or email abuse@joinsimplesms.com with the number that texted you and the date. We investigate every report, and we act on phishing and scam reports first. When the form's report matches a text we sent you from that number in the last 30 days, you are opted out of that business's texts at once and the report counts against it as a complaint (a scam report also as a strike, §9). We use your number only to check the report and stop the texts, and never share it with the business.