diff --git a/config/routes/api.yaml b/config/routes/api.yaml
index 190f6edb..7e601657 100644
--- a/config/routes/api.yaml
+++ b/config/routes/api.yaml
@@ -104,3 +104,13 @@ api_device_id:
     path: /api/device_id
     controller: App\Controller\APIController:updateDeviceID
     methods: [POST]
+
+api_privacy:
+    path: /api/privacy
+    controller: App\Controller\APIController:privacySettings
+    methods: [POST]
+
+api_resend_code:
+    path: /api/resend_code
+    controller: App\Controller\APIController:resendCode
+    methods: [POST]
diff --git a/src/Controller/APIController.php b/src/Controller/APIController.php
index aab55e4a..9616035e 100644
--- a/src/Controller/APIController.php
+++ b/src/Controller/APIController.php
@@ -1398,4 +1398,63 @@ class APIController extends Controller
         // response
         return $res->getReturnResponse();
     }
+
+    public function resendCode(Request $req)
+    {
+        $required_params = [];
+        $em = $this->getDoctrine()->getManager();
+        $res = $this->checkParamsAndKey($req, $em, $required_params);
+        if ($res->isError())
+            return $res->getReturnResponse();
+
+        // already confirmed
+        if ($this->session->isConfirmed())
+        {
+            $res->setError(true)
+                ->setErrorMessage('User is already confirmed.');
+            return $res->getReturnResponse();
+        }
+
+        // have sent code before
+        if ($this->session->getDateCodeSent() != null)
+        {
+            $res->setError(true)
+                ->setErrorMessage('Can only send confirm code every 5 mins.');
+            return $res->getReturnResponse();
+        }
+
+
+        // TODO: send via sms
+
+        return $res->getReturnResponse();
+    }
+
+    public function privacySettings(Request $req)
+    {
+        $required_params = [
+            'priv_third_party',
+            'priv_promo',
+        ];
+        $em = $this->getDoctrine()->getManager();
+        $res = $this->checkParamsAndKey($req, $em, $required_params);
+        if ($res->isError())
+            return $res->getReturnResponse();
+        
+        // get customer
+        $cust = $this->session->getCustomer();
+        if ($cust == null)
+        {
+            $res->setError(true)
+                ->setErrorMessage('No customer information found');
+            return $res->getReturnResponse();
+        }
+
+        // set privacy settings
+        $cust->setPrivacyThirdParty($req->request->get('priv_third_party'))
+            ->setPrivacyPromo($req->request->get('priv_promo'));
+
+        $em->flush();
+
+        return $res->getReturnResponse();
+    }
 }
diff --git a/src/Entity/Customer.php b/src/Entity/Customer.php
index 641b188c..3390064d 100644
--- a/src/Entity/Customer.php
+++ b/src/Entity/Customer.php
@@ -131,6 +131,16 @@ class Customer
      */
     protected $email;
 
+    /**
+     * @ORM\Column(type="boolean")
+     */
+    protected $priv_third_party;
+
+    /**
+     * @ORM\Column(type="boolean")
+     */
+    protected $priv_promo;
+
     public function __construct()
     {
         $this->numbers = new ArrayCollection();
@@ -152,6 +162,9 @@ class Customer
         $this->phone_fax = '';
 
         $this->email = '';
+
+        $this->priv_third_party = 0;
+        $this->priv_promo = 0;
     }
 
     public function getID()
@@ -379,4 +392,26 @@ class Customer
     {
         return $this->email;
     }
+    
+    public function setPrivacyThirdParty($bool = true)
+    {
+        $this->priv_third_party = $bool;
+        return $this;
+    }
+
+    public function getPrivacyThirdParty()
+    {
+        return $this->priv_third_party;
+    }
+
+    public function setPrivacyPromo($bool = true)
+    {
+        $this->priv_promo = $bool;
+        return $this;
+    }
+
+    public function getPrivacyPromo()
+    {
+        return $this->priv_promo;
+    }
 }
diff --git a/src/Entity/MobileSession.php b/src/Entity/MobileSession.php
index 460ef562..c11986f4 100644
--- a/src/Entity/MobileSession.php
+++ b/src/Entity/MobileSession.php
@@ -79,6 +79,12 @@ class MobileSession
      */
     protected $date_confirmed;
 
+    // date and time that the confirmation code was last sent
+    /**
+     * @ORM\Column(type="datetime", nullable=true)
+     */
+    protected $date_code_sent;
+
 
     public function __construct()
     {
@@ -88,6 +94,7 @@ class MobileSession
         $this->customer = null;
         $this->confirm_flag = false;
         $this->date_confirmed = null;
+        $this->date_code_sent = null;
     }
 
     public function generateKeyID()
@@ -204,4 +211,15 @@ class MobileSession
     {
         return $this->date_confirmed;
     }
+
+    public function setDateCodeSent(DateTime $date)
+    {
+        $this->date_code_sent = $date;
+        return $this;
+    }
+
+    public function getDateCodeSent()
+    {
+        return $this->date_code_sent;
+    }
 }