# Messaging Policy

Source: https://jointextkit.com/messaging-policy
Index: https://jointextkit.com/llms.txt

**Last updated: October 29, 2026**

> **The short version**
>
> - Text people only after they asked you to, and only about what they
>   asked for.
> - Keep proof of that consent for at least four years.
> - Stop the moment they say stop, in any words. We enforce this for you.
> - Say who you are, keep to daytime hours, and do not hide behind rotating
>   numbers or public link shorteners.
> - Some content is never allowed (phishing, sexual content, firearms,
>   tobacco, cannabis, gambling, payday loans, crypto). Some needs our
>   approval first (alcohol, debt collection, political campaigns).

This Messaging Policy is our acceptable use policy. It is part of the
[Terms of Service](/terms) and applies to every message sent through
TextKit, by you or by anyone you let use your account. It reflects the
TCPA and FCC rules, the CTIA Messaging Principles and Best Practices, and
carrier codes of conduct. Carriers enforce these rules independently of us,
so a violation can get traffic filtered or numbers blocked even before we
act.

## 1. Consent

**1.1 Get the right consent first.**

- **Informational and transactional messages** (order updates,
  appointments, account alerts, verification codes) require the recipient's
  prior express consent, typically given when they provide their number to
  you for that purpose.
- **Marketing and promotional messages** require prior express *written*
  consent: a signed (electronic is fine) agreement that clearly authorizes
  you to send marketing texts to that number, and that is not a condition of
  purchase.
- **Conversational replies.** A person who texts you first has consented to
  a reply about what they asked, not to ongoing messages or marketing.

**1.2 Consent is specific.** Consent covers the brand and the kind of
messages it was given for. It cannot be bought, sold, rented, shared, or
transferred, and consent given to one business does not cover another.
Separate consent for texts from consent for email or calls, and never bury
it in general terms or pre-check the box.
A number someone posted publicly (in a marketplace or classified listing, a
directory or a website), or one on a bought, rented or scraped list, has
not consented to texts from you. Before we file a registration or a
toll-free verification we check its description, opt-in and example
messages, and we do not file one built on numbers from those sources.

**1.3 Disclose at opt-in.** Wherever you collect consent, disclose your
program or brand name; what messages to expect and how often (or "message
frequency varies"); "Message and data rates may apply"; "Reply STOP to
cancel" and "Reply HELP for help"; and links to your privacy policy and
terms. We review these disclosures during campaign registration and may
require changes before activating a campaign. Our registration tool checks
the public pages you give it for these disclosures automatically and
suggests wording, and checks the example messages you give us against a
fixed set of rules, including the content rules every live message is
screened with (§4 below); it can also fill in your business details from your
website for you to review ([Privacy §4](/privacy)). In the console you
always choose what you send and write your own example messages. Our public
texting plan page ([/plan](/plan)) suggests texts a business could send and
draft wording for them; those drafts are ours, not your examples, and are
never filed. It is a
convenience, not legal advice: what it suggests can be wrong, you are
responsible for what you submit, and passing it
does not guarantee that carriers approve a campaign. The example messages
on your registration must be real examples of what you will send: we file
them as yours, and we keep a copy of exactly what was filed.

**1.4 Keep records.** Keep evidence of every consent: the number, the date
and time, the method (web form, keyword, paper, checkout), the exact
disclosure language shown, and, for online forms, the IP address and page.
**Keep it for at least four years after your last message to that number**
(the TCPA's limitation period), and produce it within five business days if
we ask (Terms §3.3). You may store this evidence with us through the consent
API's opt-in proof, by recording it through the console (on a contact's
page, or when a message is refused for having none), or by including opt-in
status, date, and source columns when you import contacts; we keep it with
your consent records and include it
in your consent export, but keeping complete evidence remains your
responsibility. Importing a contact list does not create consent, and an
import never opts anyone back in. If you use an opt-in page we host for you,
each sign-up is recorded with this evidence automatically and is double
opt-in: once your number for that program is approved and your account is
live, we text the person asking them to reply YES, and the sign-up counts as
an opt-in only when they do (within 7 days); until then, or if no text could
be sent, it is kept as a request, not consent. The page is a convenience
written from your registration, not legal advice. It links your own terms
and privacy policy, which you write and keep current: we don't write them
for you. A sign-up from a number that has opted
out does not opt it back in and gets no text (only a START from that number
does). An
opt-in you record for a registration whose use case is marketing (or mixed)
must carry this evidence: the method, when it was collected, and the page
for a web form or the inbound message for a keyword reply; the consent API,
the console and a contact import refuse one without it, and record nothing.
The console does not offer an opt-in given out loud for such a registration:
marketing texts need written consent. Keyword
opt-ins and sign-ups on a page we host record their evidence themselves.

**1.5 We look for an opt-in before we send.** We send a marketing message
(§6 says which messages count as marketing) only to a number with an opt-in
on file with your account: one you recorded through the consent API or the
console, a contact import that marks the number opted in, or the person texting START
or another opt-in keyword to your number, and not withdrawn since. A
recurring message that is not marketing (a receipt, an alert, a reminder)
from a number linked to a registration needs an opt-in on file too; you can
record how you collected it with the message itself. One-time codes, and a
reply to someone who texted that number in the last four hours, need none.
Otherwise the message is refused before it is sent, with an error that says
why, and is not charged. Your own phone and the numbers you have verified
with us are exempt so you can test. This checks that a record exists, not
that it is valid consent: getting and keeping the consent §1.1 to §1.4
describe remains yours, and we do not check non-marketing messages from a
number that has no registration.

*Consent is per registration.* Carriers treat consent as given to one
business for one kind of message: the registration your number sends
under. So a message from a number linked to a registration (other than a
one-time code) goes only to a number with an opt-in on file **for that
registration**: one you
recorded for that registration (through the consent API with its id, or in
the console), a contact import that names it, a
START or YES reply to one of its numbers, or a sign-up on an opt-in page we
host for it, once confirmed by a YES reply. From a number with no registration behind it, any opt-in on
file with your account counts, and transactional messages are not checked.
An opt-out is never narrower than your account: STOP to any of your numbers
stops every registration.

*Re-confirmation.* Some carriers require that a person who has not heard
from a marketing program for 30 days confirms they still want it before the
next marketing message. So, by default, a marketing message from a number
linked to a registration to someone that number has not messaged in 30
days is held, and we first send one re-confirmation text in your business's
name, with STOP and HELP. If the person replies YES within 7 days we send
the held message; if not, we drop it, record it in your message log as not
confirmed, and refuse marketing to that number until they opt in again. We
never charge for a held or dropped message. An administrator may turn this
off in the console after acknowledging that your account handles it
itself; the acknowledgment is recorded in your audit log. Transactional
messages, one-time codes, and your own verified numbers are never held.

## 2. Who You May Text

- **Do Not Call.** Marketing messages are subject to the National Do Not
  Call Registry and to state lists. Unless you have prior express written
  consent or another exemption the law recognizes, do not send marketing to
  numbers on those lists, and keep your own internal do-not-contact list.
- **Reassigned numbers.** Phone numbers change hands. Remove numbers you
  learn have been disconnected or reassigned (for example from carrier
  deactivation files or the FCC's Reassigned Numbers Database) promptly, and
  do not keep texting a number whose new owner never consented.
- **Minors and age gating.** Do not direct age-restricted content (alcohol)
  to anyone under the legal age, and age-gate opt-in for those programs by
  asking for the person's date of birth (carriers do not accept a yes/no
  question as an age gate).

## 3. Opt-Outs and Help

- **Any reasonable means.** A recipient can revoke consent in any reasonable
  way: a keyword, a plain-language reply ("please stop texting me"), a phone
  call, an email, or a form. You must honor a revocation however it reaches
  you, within the time the law requires and in any case **within 10 business
  days**, and we recommend immediately.
- **What we enforce for you.** On every number, the replies STOP, STOPALL,
  UNSUBSCRIBE, CANCEL, END, QUIT, OPTOUT, REVOKE, and ARRET opt the sender
  out of your messages immediately, also when spaced out or hyphenated
  ("S T O P", "STOP ALL"), commonly misspelled ("STP", "STOPP"), or "SPAM".
  We also detect plain-language revocations and treat them the same way. HELP, INFO, and AIDE receive your
  help reply, including from a number that has opted out. These replies
  identify your business, not us: a number sending under an approved
  campaign uses the help and opt-out messages that campaign registered. Opt-outs reach you through the API and webhooks; record
  revocations that reach you by other channels in your own systems and via
  the opt-out API.
- **One confirmation, then silence.** After an opt-out, at most one message
  confirming it, with no marketing in it, may be sent. Nothing else may be
  sent to that number until it opts back in, for example by replying START.
  A message you try to send to an opted-out number is refused, not delivered
  and not billed, and the refusal is recorded in that number's consent
  history and in your message log. A recipient who opts back in by keyword receives one message
  confirming it.
- **Bring your opt-outs with you.** An opt-out given to you through another
  provider or tool still applies when you send through us. Import those
  numbers before you send to them. When you move an account to us with our
  import tool, it asks for that list, or for your confirmation that there is
  none, before it runs. We cannot obtain the list for you, and importing it
  remains your responsibility.
- **Never re-add.** Do not re-import, re-upload, or otherwise re-subscribe an
  opted-out number without a new, documented opt-in. Importing contacts never
  lifts an opt-out: an opted-out number stays opted out, and a row your file
  marks as unsubscribed is recorded as an opt-out. Contacts that arrive from
  a tool you connect follow the same rules: an opt-in is recorded only when
  that tool records SMS consent, and an unsubscribe there is recorded as an
  opt-out here. An opt-out the person gave themselves (by text, or one
  you imported from another provider) is permanent: only they can lift it,
  by texting START to one of your numbers. To opt back in a number you
  opted out yourself through the consent API or the console, or one opted
  out through our report form (which cannot confirm who filed the report),
  record that new opt-in's evidence, collected on or after the opt-out,
  unless the person has since texted STOP themselves; in the console only
  an admin can.
- **Subscription topics.** You can let recipients stop one kind of message
  (for example marketing) and keep another (for example account alerts). A
  broadcast sent on a topic skips anyone unsubscribed from it. Topics only ever narrow who you text: an opt-out still stops every
  message, and subscribing someone to a topic does not opt them back in.

## 4. Prohibited Content and Uses

These are never allowed, with or without approval:

- Content that is illegal where it is sent or received, including illegal
  drugs and the sale of prescription drugs without a valid prescription.
- **Fraud and deception:** phishing, smishing, and impersonation of any
  person, brand, government agency, or bank; requests for a recipient to
  send back a security code; fake prize, refund, or delivery notices;
  romance and advance-fee scams; and simulated phishing, even for training.
- **Sexual or adult content**, including links to it.
- **Firearms, ammunition, and explosives**, and their parts or accessories.
- **Tobacco and vaping products**, including e-cigarettes.
- **Cannabis, CBD, kratom, and psychedelics**, even where legal.
- **Gambling, sweepstakes, giveaways, and lotteries.**
- **High-risk financial services:** payday, short-term high-interest, and
  title loans; auto and mortgage loans from anyone but the direct lender;
  student loans and student-loan relief; debt relief, consolidation,
  settlement, or credit repair; cryptocurrency promotions; and stock alerts
  or trading tips.
- **Get-rich-quick, multi-level marketing, and work-from-home offers**, and
  risky investment schemes.
- **Job postings**, unless you are the employer hiring.
- **Profanity.**
- Hate speech, harassment, threats, and content that promotes violence or
  self-harm.
- **Third-party lead generation, affiliate marketing, and referral or
  reseller schemes**, and any use in which phone numbers or consent are
  collected to be sold, rented, or shared.
- Spoofing or misrepresenting the sending number or sender identity.
- Malware, and links to it.
- Traffic with no human purpose: SMS pumping, artificially inflated traffic,
  or any scheme that generates messages for revenue share.
- **Receiving verification codes for other services:** using our numbers to
  receive one-time codes that create, verify, or recover accounts on
  services you do not own, or offering numbers to others for that purpose.
- Messages to emergency numbers, or any attempt to use the Service as an
  emergency service.

## 5. Restricted Content

These categories need our approval in advance, which we give in writing for
your account or for a specific registration, and only where the carriers
allow the use case. Our content screen blocks alcohol automatically until
you are approved; sending any of them without approval violates this
policy even where a message gets through.

- Alcohol (age-gated opt-in with the date of birth required, §2).
- Debt collection, which must also comply with the FDCPA and Regulation F.
  Carriers may refuse debt-collection messages even after we approve them.
- Political and advocacy campaigns, which must also be registered with the
  carriers and include the disclosures election law requires.

## 6. Sending Practices

- **Identify yourself.** Each conversation must identify your brand, and you
  may not impersonate anyone, including in the `app_name` of verification
  messages. An `app_name` must be a name: letters, numbers, spaces and
  basic punctuation, with no links or phone numbers, and it passes the same
  content rules as any message. An automatic reply is checked when it is
  sent, like any other message, and is not sent when a check refuses it.
  Name your business in the first message to each person, and include
  opt-out wording ("Reply STOP to opt out") in marketing messages: in the
  first one to each person and at least every 30 days. **What we do by
  default:** from a number linked to a registration, when a person's first
  message from that number does not name your business, we put your
  business name and a colon in front of it; and when a marketing message
  that is due opt-out wording has none, we add " Reply STOP to opt out." at
  the end. We do not add either to a one-time code or to a reply sent within
  a few hours of a message from that person. The message you receive back
  from the API, your message log and the `message.sent` event show the text
  as sent and what we added. The added words can make a message longer (one
  more segment), and each segment is billed at the published rate plus its
  carrier fee (Terms §4.3). Including the right wording yourself remains your responsibility.
- **Quiet hours.** Do not send messages before 8 a.m. or after 9 p.m. in
  the recipient's local time, or outside any narrower window a state
  requires (several states end at 8 p.m. and limit messages per day).
  **What we do:** a message that falls outside 8 a.m. to 9 p.m. (8 p.m. for
  a number with a Florida, Maryland or Oklahoma area code) is refused,
  or held and sent at 8 a.m., using the time zone of the area code of the
  recipient's number; a number whose area code does not show a time zone
  is held to the hours of every time zone in the contiguous United States.
  This applies to every kind of message and cannot be turned off. The only
  messages sent at night are one-time codes, replies within a few hours of
  a message from that person, the one text our hosted opt-in page sends
  right after someone signs up there to ask them to reply YES, and messages
  to your own verified test numbers. For a number with a Florida, Maryland
  or Oklahoma area code we also refuse, or hold, a fourth marketing message
  from your account within 24 hours, whatever it is about; replies within a
  few hours of a message from that person and messages to your test numbers
  do not count. **What that does not cover:** an area code shows where a number
  was issued, not where the person is, and we apply the 8 a.m. to 9 p.m.
  window everywhere and those three states' rules only, not any other
  state's narrower hours or daily limits. You remain
  responsible for sending only at the hours the law allows wherever your
  recipients are, and for consent. This is a safeguard. It is not a
  guarantee that a message complies with the law.
- **Stay within your registration.** Carriers approve a registration for
  one kind of message, and treat anything outside it as a violation. So the
  sending number's registration and the message's wording decide what a
  message is, not a label you give it: a label can make a message count as
  marketing, never the reverse. A message from a two-factor registration
  must be a one-time code; one from a registration that is not for
  marketing (account alerts, customer care, delivery notifications and the
  like) may not carry promotional wording (an offer, a discount, a promo
  code) or be labelled marketing; everything from a marketing registration
  is marketing; and on a mixed or low-volume registration a message is
  marketing unless it is a one-time code or you label it transactional and
  it has no promotional wording. From a number with no registration, a
  broadcast or batch, promotional wording, or a marketing label makes a
  message marketing. **What we do by default:** we refuse a message outside
  the sending number's registration before it is sent, and do not charge
  for it. Our check reads the wording with fixed rules; then, for a number
  linked to a registration, an automated classifier compares each new kind
  of message (its text with names, numbers and links masked) with the
  registration as filed: its use case, description and example messages. A
  kind that clearly does not match is refused; promotional content on a
  mixed or low-volume registration counts as marketing; and a kind the
  classifier cannot place is held for our team to review first (§9). It can
  only make a message stricter, never looser, and messages from a
  two-factor registration are checked by the fixed rules alone. If you
  think it refused a kind of message wrongly, contact us and our team can
  approve it. A registration also says whether its messages contain phone
  numbers; if it says they do not, we refuse a message with a phone number
  written in it. These checks can miss things; sending only what your
  registration covers remains your responsibility.
- **Sending speed.** Carriers limit how fast a registration may send. We
  pace queued messages (batches, broadcasts, scheduled messages) to each
  registration's limit and refuse a faster direct send with an error that
  says when to retry. A carrier may also refuse messages past a daily limit
  for your business. **What we do by default:** we stop registered traffic
  under one business tax ID (EIN), across all its accounts, at the
  carriers' daily cap (2,000 messages a day unless the business's carrier
  vetting score allows more and our team raises it); in an account's first
  30 days of live sending, we cap the different people it may text a day at
  the larger of 200 and three times the daily volume it told us to expect;
  and we refuse more than 10 messages from one account to one person in 5
  minutes (25 while that person is texting back). Over a daily cap, a queued
  message waits for the next day (UTC) and a direct send is refused with an
  error that says when to retry. Your own verified test recipients are not
  limited. Refused messages are not charged.
- **No filter evasion.** Do not spread traffic across numbers to avoid
  per-number limits or filtering ("snowshoeing"), replace numbers that
  carriers filter or block with new ones ("number cycling"), deliberately
  misspell words, or alter content to evade carrier filters. **What we do
  by default:** we watch for the same message spread across many of your
  numbers or across accounts, for many numbers bought in a day, and for
  several registrations for one use case under one business, and our team
  reviews what we find; and when a number carriers were filtering is
  released and another is bought within 7 days, we hold new number
  purchases on your account until our team has reviewed it (your existing
  numbers keep working). We also refuse a message to a person your account
  texted from two of its other numbers in the last 24 hours (a reply to
  someone who texted that number is never refused).
- **Links.** Use links on a domain you own. Public URL shorteners (shared
  bit.ly-style domains) are blocked, because carriers filter them as a
  phishing signal. **What we do by default:** from a number linked to a
  registration, or a toll-free number verified through our form, a message
  may link only to the website domain on its registration or verification
  (and its subdomains), a domain in the example messages or links filed with
  the carriers, or a domain our team has added for it at your request; a
  link elsewhere, or one that redirects elsewhere, is refused, and so is
  any link when the registration or verification says its messages carry
  none. A link to a
  domain made to look like another (a well-known brand's, or your own) is
  refused as phishing. We check where each link leads once for each kind of
  message, by visiting it and following its redirects without reading the
  page. Your own test recipients are exempt.
- **Register before you text the public.** A US local number may text the
  public only once it is linked to an approved registration. Until then it
  can text only phone numbers you have verified with us as your own, so you
  can test; a message to anyone else is refused before it is sent, with an
  error that says why, and is not charged. A toll-free number is verified
  with the carriers instead, for one business and use case: you fill in the
  form in the console or through the API, a person on our team checks it,
  we file it, and the same limit applies to it until its
  verification is approved. You can buy a toll-free number before your
  account has live access; until the account has it, live messages (from
  the console or with a live API key) can go only from that toll-free
  number and only to phone numbers you have verified with us as your own,
  billed like any live message, and anything else is refused before it is
  sent and not charged. Once approved its messages must come from, and
  name, the business it was verified for, and its business and use case
  cannot be changed: to send something else, add another toll-free number
  and verify it for that. Canadian numbers cannot be
  registered through us yet, so the same limit applies to them. One
  registration covers up to 49 numbers.
- **We verify your business before we file.** Carriers accept registrations
  only from real, identified businesses, so before we first file a
  registration for a business, a person authorized to act for it (its
  authorized representative, or someone else who can act for it) must sign a
  short statement that they are authorized, that the business details match
  the business's tax records, and that the business will text only people
  who agreed to it and will follow this policy. The representative you name
  must work for the business and use an email address at the business's own
  domain, not a free mailbox or a shared inbox, and the registered address
  must be a street address. We then check the business and the
  representative ourselves, usually within 1 business day, and file the
  registration only once we have verified the business; a business we cannot
  verify has its registrations returned with the reason, and we may ask for
  documents. We verify each business once; changing its legal details or its
  representative means signing and verifying again. A toll-free verification
  form is signed the same way when you submit it; our team checks the form
  before we send it to the carriers, and when the carriers verify it, we
  treat the business named on it as verified by us too (unless we have
  already declined that business, or our sanctions-list check needs a
  closer look) and your account gets live access. Live access to the
  Service requires a verified business. Signing for a business you are not
  authorized to act for, or giving false business details, is a breach of
  these terms (Terms §2.2 and §3.5), and we report it to carriers and registries
  on request.
- **Match your registration.** Messages must fit the use case you registered
  for the campaign and the example messages you filed with it; register a
  new campaign before sending a different kind of message.
- **Watch your rates.** For each registration we count, over the last 24
  hours, the messages carriers accepted from its numbers and the people who
  opted out by texting them. Above 0.5% (with at least 200 sent) we warn you
  and review it. Above 4% (with at least 100 sent) we pause marketing
  messages from that registration's numbers, refusing them before they are
  sent and without charge, until we have reviewed its consent with you and
  resumed it; transactional messages are not paused. We may also pause a
  campaign whose complaint or carrier-filtering rate is well above industry
  norms while we review its consent.
- **Sensitive data.** Do not send payment card numbers, account passwords,
  government ID numbers, or protected health information (Terms §6.5).

## 7. Sending on Behalf of Others

If you run a platform, agency, or reseller business that sends for other
businesses:

- Each end business must be registered as its own brand and campaign with
  accurate information. Do not send one business's traffic under another's
  registration.
- Each end business must obtain its own consent and follow this policy, and
  you must flow these obligations down in your contract with them.
- You must be able to identify, on our request, the end business behind any
  message, and to stop any end business's traffic promptly. Assigning each
  end business's numbers to a customer in the API is the simplest way to do
  both, though it is not required.
- You are responsible for their traffic as if it were your own (Terms §2.4).

## 8. Canada

Messages to Canadian recipients must also comply with CASL (express consent,
sender identification, and an unsubscribe mechanism in each commercial
message, honored within 10 business days) and with French-language
expectations: ARRET and AIDE work on every number.

## 9. How We Enforce This Policy

We screen messages automatically before they are sent and inbound replies as
they arrive, using rules and machine-learning classifiers, for the
prohibited and restricted content above, for scam patterns, and for
opt-outs. A live message is sent only once our screen has checked it: if
the screen cannot run, the message is refused and not charged (a batch or
scheduled message waits and tries again for about 15 minutes first). We verify a business before we first file a registration for it,
and we file no registration for a business we have not verified; our team
checks each toll-free verification form before we send it, and the
carriers' verification of it verifies the business (§6). We also refuse
messages to the public from a number that is not
yet linked to an approved registration or whose toll-free verification is
not approved, and, before your account has live access, any live message
other than one from your toll-free number to a number you have verified
(§6); we refuse a message outside the
sending number's registration, using fixed rules and, for each new kind of
message from a registered number, an automated classifier (§6, "Stay within
your registration"); a message we could not check that way is not sent, like
one the screen could not check. We
refuse or hold messages outside 8 a.m. to 9 p.m. (8 p.m. in Florida,
Maryland and Oklahoma) in the recipient's local time, and a fourth
marketing message in 24 hours to a person in those three states, as
described in §6, and we refuse a marketing message
to a number with no opt-in on file with your account, for the sending
number's registration where it has one, and a recurring message from a
registered number to a number with no opt-in on file for its registration
(§1.5), and hold a marketing message to a number a registered
sender has not messaged in 30 days until the person confirms (§1.5), and we pause marketing on a
registration whose opt-out rate passes 4% (§6). During your account's first
30 days of live sending, a person on our team reviews each new kind of
message from a number linked to a registration, or a toll-free number
verified through our form, before it goes out
(messages that differ only in names, numbers, amounts or links are one
kind): those messages are held and not charged, and are sent once we approve
the kind; a kind we do not approve is refused, then and later, and a held
message we have not reviewed within 3 days is dropped. At any age of the
account, a new kind of message the classifier could not place is reviewed
the same way. We may keep
reviewing an account for longer, or stop sooner, and record that in your
audit log. A closed or suspended
account sends nothing at all. We never silently drop or change
a message: a blocked or held send returns an error that names the reason, is
recorded in your message log with that reason (updated if a held message is
later sent or dropped), and is not charged; and the only change we make to a
message is adding your business name or opt-out wording where §6 ("Identify
yourself") says we do, which the API response and your message log show. These checks do not
verify that consent is valid, and they do not check whether a number has been reassigned
or appears on any do-not-call or litigant list; those remain yours.
We may also pause campaigns,
including every message from a registration's numbers while we review it,
suspend accounts, keys or numbers, request consent evidence, and share
information with carriers and registries (Terms §3.5); each such step, an
approval of restricted content for a registration (§5), and each review
decision on a kind of message, is recorded in your audit log with the
reason. Carriers run their own filtering,
which we do not control.

**Strikes and the automatic pause.** A message our checks block as
phishing, impersonation or fraud, a kind of message our team rejects in
review, texting people from a third number (§6 "No filter evasion") on
three or more people in a day, or abuse our team confirms, is a strike
against the account. The same message to the same person counts once a
day, and one person's messages add at most two strikes a day. **Three
phishing, impersonation or fraud strikes involving two or more people
within 7 days pause all of the account's live sending at once,** pending
our review: your keys, data and numbers keep working, batches and
scheduled messages wait instead of failing, a direct send is refused with
an error that says why, and we email you. Reply to appeal. Our team then
lifts the pause, which clears the strikes, or suspends the account (Terms
§3.5). Strikes are kept 30 days.

**The enforcement ladder.** Over each rolling 7 days we look at each
registration's complaint rate (replies like "spam" or "wrong number", and
verified reports, §10), the share of its messages carriers filter, its
opt-out rate, its strikes and the kinds of message our team rejected, and a
number of it that carriers filter almost every time. Past our thresholds
it moves up a step: **a warning** (complaints over 0.1%, filtered over 5%,
opt-outs over 0.5%, or one strike), then **half speed** (complaints over
0.3%, filtered over 15%, opt-outs over 2%, or two strikes or rejected kinds
of message in 7 days: the registration sends at half its pace and half its
business's daily cap), then **paused** (complaints over 0.5%, opt-outs over
4%, or a number filtered almost every time: its numbers send nothing). Rates
count only once a registration has sent 200 messages in the 7 days. Each
step emails you, sends a `compliance.flagged` or `compliance.paused`
webhook event, shows in the console, and is recorded in your audit log; you
can appeal from the console. Only our team moves a registration back down,
with a reason.

## 10. Report Abuse

Received an unwanted text from a number on TextKit? Reply STOP to that
number, then report it at [/report](/report), or email
abuse@joinsimplesms.com with the number that texted you and the date. We
investigate every report, and we act on phishing and scam reports first.
When the form's report matches a text we sent you from that number in the
last 30 days, you are opted out of that business's texts at once and the
report counts against it as a complaint (a scam report also as a strike,
§9). We use your number only to check the report and stop the texts, and
never share it with the business.
