SMS verification
Last updated: September 4, 2026
This page explains exactly what text messages Jopi sends, who receives them and how users request them. We publish it so that anyone — users, mobile carriers or our messaging provider — can verify how we use SMS.
In one line
Jopi sends a single type of message: a 6-digit, one-time verification code that the user requests from the app by tapping a button. We send no advertising, promotions or newsletters by SMS.
Who receives the messages
Only the person who types their own Colombian mobile number into the Jopi app and taps the button to request the code. Nothing else sends a message.
We never buy or import lists
We do not purchase phone number databases, we do not import contact books and we do not receive numbers from third parties. A number enters the system only when its own owner types it into the app.
Colombian mobile numbers only
The server rejects any number that is not a 10-digit Colombian mobile starting with 3. It is normalised to +57 and everything else returns an error before any send is attempted. Jopi operates in Colombia only.
One message per request
There are no recurring, scheduled or automatic messages. Every SMS corresponds to an action the user has just taken with their finger on the screen.
When it is sent
There are exactly three moments when a user can receive an SMS from Jopi:
Creating a customer account
People signing up to request services verify their mobile number before the account exists. This lets the service provider call them, and keeps one account per person.
Registering as a service provider
Professionals offering services verify their mobile during registration, for the same reasons and because their number is the contact channel with the customer.
Adding a phone to a Google account
People who signed in with Google have no phone number attached. When they complete their profile and add the number, they verify it once with the same code.
How the user requests it
The SMS is never sent on its own. These are the exact steps inside the app, and the message goes out only after step 4:
- 1
The user opens the Jopi app and chooses to create an account.
- 2
A sheet titled “Verifica tu celular” (Verify your mobile) appears, explaining why the number is needed: “We need it so your service provider can call you, and so each person has a single account.”
- 3
The user types their own 10-digit number into a field with a fixed +57 prefix.
- 4
The user taps the button labelled “Enviarme el código” (Send me the code). This is the explicit action that authorises and triggers the send.
- 5
The SMS arrives with the 6-digit code, and the user types it into the app to finish verifying.
Exact message text
There is only one template. The only thing that changes between messages is the 6 digits of the code:
123456 es tu codigo de Jopi. Vence en 4 minutos. No lo compartas.
The Spanish text carries no accents on purpose. An SMS with accented characters is encoded as UCS-2, which drops the limit from 160 to 70 characters — splitting the message in two and doubling its cost.
Frequency and limits
These caps live on the server and apply to everyone equally. They exist to protect users from messages they did not ask for, and to prevent SMS pumping fraud:
| Minimum wait between requests | 60 seconds |
|---|---|
| Consecutive requests before the long wait | 2 |
| Wait after those two requests | 15 minutes |
| Maximum per number every 24 hours | 5 messages |
| Requests per IP address | 5 per minute |
| Code validity | 4 minutes |
| Attempts allowed per code | 3 |
| Destination countries | Colombia only (+57) |
What we never send
No marketing whatsoever
We send no advertising, promotions, discounts, surveys, newsletters or commercial reminders by SMS. Every message is transactional.
No subscription list
There is no mailing list to subscribe to, so there are no campaigns to unsubscribe from. Stop requesting codes and you stop receiving messages.
App alerts use a different channel
App notifications — provider offers, job status, payments — are delivered as push notifications inside the application, never by SMS.
How we handle the code and the number
The code is stored hashed
It is never stored in plain text: we keep a bcrypt hash of it, the same way a password is stored. Not even we can read the code that was sent.
Generated with a cryptographic RNG
The 6 digits come from the system's cryptographic random generator, not a predictable function, so seeing several codes does not help anyone guess the next one.
Deleted after 24 hours
Code records are removed automatically after one day. A used or expired code is worthless and is not retained.
The number is never written in full to logs
Server logs mask the phone number, showing only the first and last digits.
Questions or opt-out
If you received a code you did not request, or you want us to block your number so it never receives messages from Jopi, write to us and we will take care of it:
soporte@jopiapp.com