Privacy policy

Last updated 3 November 2026

Who we are

In this policy, “Sendya”, “we” and “us” means the people who run Sendya. You can reach us by email: Show email address.

Our principles

• Collect only what we need to connect your devices and keep the service fair. Nothing more.
• Never look at what you send. We can't, and we wouldn't want to.
• No accounts. Your device's random code is all we know it by.
• Never sell or rent data, and never use it for advertising.

What we collect

When you use Sendya on the same network

Nothing. Your devices find each other and send directly. Your settings, paired devices and received files stay on your devices.

When you use the Sendya server

When your devices are on different networks, they connect through the Sendya server. What you send is encrypted end to end between your devices: the server passes along data it can't read, and never stores it. To do its job, the server keeps:

• Your device's code — a random identity the app makes when it's installed (not a hardware ID) — and, as it said when it last signed in, the app's version, its system (like Windows or Android) and what kind of device it is (a phone, a tablet or a computer). When we talk about a device (in our replies, say) we use a short support code made from it one way (Settings → This device): nobody can reach your device or pretend to be it with that code.
• The month it first appeared, because the free allowance grows over the first months.
• How much it sent and received through the server this month, and which devices it connected with this month (as codes).
• Its plan, if it has one: a plan number, the plan, its dates, the devices on it (as codes) and a one-way fingerprint of the recovery code — enough to check a code someone types, never enough to read it. The code itself lives only on the Owner's device: the server hands a new code to it once and forgets it. While a device is on a plan, the plan also keeps the name the device gives itself, what kind of device it is, when it was last online and how much data it used this month, so the devices on the same plan can show who uses its data (Settings → Pool). Only the devices on that plan see it. The plan also keeps who on it is the Owner or an Admin, whether Sendya's lock is on on each device and whether it lets the Owner wipe Sendya on it, and its recent changes (the last 40: which device added, removed or made an Admin of which, by name) so the Owner and Admins can see them. When a device leaves the plan, its name and use are deleted from it after 30 days (until then the Owner can still mark it lost or stolen) and its name stays only in those recent changes. A device the Owner marked lost or stolen stays marked — the plan number, its name, when, whether it was asked to wipe Sendya and when it confirmed it did — until the Owner finds it again, or we delete the mark (see below). On Max (teams), the plan also keeps the groups its Owner and Admins make, which devices are group admins, and of which groups, the Owner's choice of who on the team can send to whom, the team's own name for each device, any monthly cap, whether a device is paused, invites not used yet (for 7 days), and how much data each device moved through the server, day by day for 92 days and month by month for 13 months, so the Owner and Admins can download reports. On Max the Owner and Admins see each device's use, and a group admin sees the use of the devices in its groups; the other devices see their own and the total. To let colleagues send to each other without pairing, every device on a team also sees the names of the colleagues it can send to, their group and whether they're online — never what they send or how much they use. What colleagues send each other is encrypted end to end, like everything else: the server can't read it. A device that leaves a Max plan stays in its reports, by its code and the name it had, until those numbers are old enough to go. If you use a promo code, we keep which device used it and when.
• Your own devices (every plan, Basic included): which of your devices call each other Mine (as codes), the name each gives itself, what kind of device it is and when it was last online — so a new device can pick the lost one; which of them trust each other and whether each lets its trusted devices wipe Sendya on it; and a one-way fingerprint of your recovery code, one for all your devices. The code itself is made on your device and lives only on your devices: the server never gets it, except for the moment you type it to use it. A device marked lost or stolen stays marked — its name, which of your devices marked it and when, whether it was asked to wipe Sendya and when it confirmed it did — until one of your devices finds it again, or we delete the mark (see below). When one of your devices marks another lost, its other trusted devices are told, once.
• The day your device last signed in to the server, so devices that stopped using Sendya can be deleted after a year.
• A log of what happens on the server, so we can look after it and answer you about your device: when a device first appears and each day it signs in (with the app's version, its system and what kind of device it is), devices marked lost or stolen, found or wiped, changes to plans and payments, when a message from the app reaches us and when we reply, what we did ourselves (such as a block or a note), and the server's own problems. Devices are in it by their support codes and plans by their numbers: no names, no addresses, nothing you send, and never what a message says.
• Our decisions about a device, if it broke the fair-use rules: a warning, a slow lane or a block, and the reason we gave — and our own short note, if we need one (say, "reported stolen by its owner").
• That your device agreed to our terms: which version and when. Your device signs it with its own key, so it can be checked later; the same record also stays on your device.
• A short code for your network, only while we count new devices per network (against people resetting Sendya again and again for a new free allowance): a code that thousands of possible addresses share — so your address can't be worked out from it — and how many new devices came from it this month. Wiped when the month ends.
• Your device's name (the one you choose in Sendya), only in memory while the device is connected, so your paired devices can show it. It's never written down.
• Internet addresses, only in memory: they're needed to connect at all, to stop floods of new devices or of tries to buy a plan, and to tell two of your own devices (or two devices on your team) that they're connecting from the same place, so they can try to reach each other directly. Only those two devices are told, and only that. Addresses are never written down.
• Your iPhone's or iPad's push address (the code Apple gives it for notifications) and which of your devices may wake it, from the iPhone or iPad itself. When something waits for your iPhone or iPad, our server asks Apple's push service to show a notification on it. What it says is sealed on your other device for that iPhone only: Apple and our server can't read it — they only see that a notification was sent, and when.
• Your devices' addresses on your own network (like 192.168.1.20) never reach us. When two of your devices need them to connect directly, they swap them with each other end to end, like everything else they send: the server passes them along but can't read them.

When you write to us

From the app (Report a problem, Contact us), we receive what you wrote, the topic, the app's version and system, a report number and the link to your device (its support code), so our reply reaches you. It becomes a conversation: we keep your messages, our replies, when each was sent and when your device last read them, and our own private note about what we did. With Report a problem, a short summary goes too: how the server connection is, how many devices are paired and nearby, the kind of network, and whether Sendya's lock is on. If you tick it, Sendya's recent activity, the speed of your last transfers and your last connection check go too. The app shows you exactly what's sent first, and takes out names, file names, folders, addresses and note text. For business messages, we also receive the email address you give us. If you email us, we receive your address and your message.

Only we see your conversations. In Sendya, only the device that started one can read it, and it never sees our note. If we download a copy to work on, we delete it once we've used it.

When you buy a plan

Plans are sold on this website and in the Sendya app on computers and on Android from our website through Link, Stripe's payment service: a plan's Get button on the pricing page, or Settings → Plan in the app, opens Stripe's checkout page. Stripe and Link handle your name, email, card and billing details under their own privacy policies — we never see your card. The Sendya server keeps only Stripe's reference for the subscription and the customer, whether it's paid, and when it renews, linked to your plan number, not to you. In Stripe's dashboard we can see what Stripe shows its sellers about a purchase (such as the buyer's name, email and country), and we use it only to answer you about your payment. A plan bought on the website has no device on it yet, so the page you see after paying shows the plan's recovery code: the server keeps that code as written until a device uses it, for 7 days at most, so the page can show it again. After that it keeps only the code's one-way fingerprint, like any plan's. In Sendya from Google Play outside the US, plans are bought with Google Play instead, which handles how you pay under Google's privacy policy. With the purchase, the app gives Google a fingerprint of your device — nothing that names you — and our server asks Google about the purchase: it keeps Google's reference for it, its order number, whether it's paid, when it renews and the country it was bought in, linked to your plan number. In the US, Sendya from Google Play opens Stripe's checkout after Google's notice, and our server tells Google what was paid there (the amount, the tax and the country — nothing about you), as Google's programme requires. In the iPhone and iPad app, plans are bought with the App Store instead, which handles how you pay under Apple's privacy policy. With the purchase, the app gives Apple a code made one way from your device's ID — nothing that names you — and our server asks Apple about the purchase: it keeps Apple's reference for it, which plan it is, whether it's paid, when it renews and the country it was bought in, linked to your plan number.

When you visit this website

The site sets no cookies and uses no analytics, ads or trackers, and we keep no record of your visit. It only remembers choices you make yourself — Light or Dark, and your currency if you pick one — in your own browser; they never leave it. To show prices in your currency, it asks Cloudflare which country your visit comes from; that isn't saved. If you press Show email address, Cloudflare Turnstile checks you're a person; it may collect device and browser information to do that, and it doesn't use cookies. Cloudflare, which runs the site, may set a short-lived security cookie of its own if it has to tell people from bots; that cookie is strictly necessary and isn't used to track you.

How we use it

Only to run Sendya: connect your devices, apply your plan and the free allowance, keep the server safe and fair, answer your messages and fix problems. We use overall numbers — how many devices are online, how much data passes per minute — to size the server; they aren't linked to anyone.

Purposes, legal bases and international processing

Where the law asks for a legal basis, this is what each use of information rests on:

We use consent only where we expressly ask for it. We never use your information for advertising or profiling, and we make no automated decisions about you with legal or similarly significant effects.

Cloudflare, our email provider, Stripe, Google (for Google Play purchases) and Apple (for App Store purchases, and its push service) may process information outside your country, including in the United States and other places where they or their own providers operate. When information leaves the European Economic Area or the UK, they rely on the safeguards the law requires, such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework. Their privacy notices describe their safeguards and how long they keep data. What you send between your devices stays encrypted end to end wherever it travels: none of them can read it.

How we share it

We don't sell, rent or trade data. A few services help us run Sendya and only handle what they need for that: OVHcloud hosts the Sendya server, Cloudflare runs this website, protects it and keeps the server's nightly backups (locked: Cloudflare can't open them), our email provider holds our mailbox, Stripe (through its payment service Link) sells and takes payment for plans, Google Play sells and takes payment for plans bought in Sendya from Google Play outside the US, the App Store sells and takes payment for plans bought in the iPhone and iPad app, and Apple's push service shows notifications on iPhones and iPads (it sees only that a notification goes to that device, and when — what it says is sealed). If you get Sendya from an app store (the Microsoft Store, Google Play or the App Store), that store handles the download and its updates under its own privacy policy, and shows us only overall figures, such as how many people installed Sendya. We'd only hand something to anyone else if the law forced us to — and there's very little to hand over.

How long we keep it

• Monthly use and the devices a device connected with: wiped when the month ends.
• A device's code and first month: while the device uses the server. A device that hasn't signed in for 12 months is deleted, with everything the server keeps about it.
• A device marked lost or stolen: until its Owner (or one of your devices) finds it again. If the device confirmed it wiped Sendya, we delete the mark 90 days later; if it never did, after 12 months.
• Messages sent from the app: the whole conversation (your messages, our replies, the details, the email and our note) is deleted 90 days after its first message, even if it's still open. We may delete it sooner once it's over. Want it gone now? Delete it in Help → Your conversations, or write to us in Contact us with its number (like R-7F3K). Copies in the locked backups go within 7 days after that.
• Emails: as long as needed to deal with them, at most 24 months.
• Plans: while the plan exists, then as long as the law requires for purchase records.
• A plan bought on the website: its recovery code as written, until a device uses it — 7 days at most; then only its one-way fingerprint. The link between the payment and the page that showed the code goes after 14 days.
• The server's log: 90 days. The sign-in lines (one a day per device): 30 days. What we did ourselves: 12 months.
• Team reports (Max): each device's use day by day for 92 days, month by month for 13 months — and all of it goes when the plan ends.
• Agreements to the terms: while the device uses the server, and afterwards only as long as we may need to show what it agreed to.
• Network codes: wiped when the month ends (none at all while the count is off).
• An iPhone's or iPad's push address: until it turns notifications off, is reset or wiped, or Apple says the address no longer works — and at most 90 days after the iPhone or iPad last sent it.
• Backups of the server: each one for 7 days, then it's deleted. If the nightly backup ever fails, the last three stay until new ones are made.

Your rights

You can ask to see the information we hold about your device, correct it, delete it, limit or object to how we use it, or get a copy. Because there are no accounts, the easiest way is from the app — Settings → Help → Contact us — so we can find your device's records. You can also email us. And you can always complain to the data protection authority where you live or work.

Want a clean slate? Remove Sendya and install it again: the device gets a new code, and the old code's monthly records disappear when the month ends.

Protecting your data

Transfers are encrypted end to end and each device checks the other's identity. The server keeps as little as possible and runs locked down. A break-in would find no files, no file names, no messages between your devices, no passwords, and no email addresses except the ones people give us in a business message. More on the security page.

Children

Sendya is for people aged 13 and over — or older, where the law of their country sets a higher age (see the terms). We don't knowingly collect information from younger children; if you think one is using Sendya, tell us and we'll remove what the server holds about that device. Plans can only be bought by adults; a parent or guardian can buy one for someone younger.

Policy updates

If we change this policy, we'll update the date at the top. For important changes, we'll tell you in the app before they apply.

Contact us

In the app: Settings → Help → Contact us. By email: Show email address.