At a glance
This policy covers two products from Elgiosoft (“we”): Sendi Auth, the two-factor code app, and Sendi, the SMS, WhatsApp and verification service for businesses at this website.
- Your Sendi Auth codes are encrypted on your phone with your master password before they reach us. We can’t read them.
- We don’t show ads, sell data, or use third-party analytics or tracking in either product.
- You can delete your Sendi Auth account at any time, in the app or on this website. Deletion is immediate.
Sendi Auth
What we collect
- How you sign in: your phone number, or your Google account’s email address, name, profile picture link and account ID.
- Your name, if you enter one.
- Your codes, encrypted. Each saved code (its secret, the service name and account label) is encrypted on your phone with a key made from your master password. We store only the encrypted result and can’t decrypt it.
- A password check value. We store a random salt and a value derived from your master password so the app can confirm you typed it correctly. It can’t be used to recover your password or decrypt your codes. Your master password itself never leaves your phone.
- Your devices: the device type (for example “Android phone”), operating system, app version and when it last synced, so you can see and sign out your devices.
- SMS sign-in codes: when you sign in with your phone number, a record of the code we sent (the number, a one-way hash of the code, and whether it was delivered and used).
What stays on your phone
- Camera: used only to scan QR codes while the scanner is open. Images aren’t saved or sent anywhere.
- Fingerprint, face or passcode: checked by your phone’s operating system. The app only learns whether the check passed.
- An encrypted copy of your codes and the key to open them, kept in your phone’s secure storage so the app works offline.
Why
We use this information only to sign you in, sync your encrypted codes between your phones, show your list of devices, and keep the service secure. We don’t use it for marketing.
Sendi for businesses
What we collect
- Account details: your name, email address and the details you enter in settings; your password, stored only as a one-way hash; and your Google account ID and profile picture if you sign in with Google.
- What you send through Sendi: recipient phone numbers, message content, WhatsApp conversations and templates, verification requests, and delivery status for each.
- Billing: your credit balance and the history of top-ups and charges.
- API activity: requests made with your API key, kept to deliver messages, prevent abuse and help with support.
Why
To run your account, deliver your messages and verification codes, show you your logs and spending, bill you, and protect the service from fraud and abuse.
If you receive messages
If a business sends you an SMS, a WhatsApp message or a verification code through Sendi, we process your phone number and the message on that business’s behalf, only to deliver it and report whether it arrived. That business decides what to send you and is responsible for having your permission. To stop receiving their messages, contact the business directly. Verification codes are stored only as a one-way hash and expire within minutes.
How long we keep it
- Sendi Auth: for as long as your account exists. When you delete your account, your codes, backups, devices and account details are erased immediately.
- Sendi accounts: for as long as your account is open, so you can see your message history and billing. Ask us and we’ll close your account and delete its data, except billing records we must keep by law.
- Verification codes: stored only as a hash, valid for a few minutes, then unusable.
Security
All traffic to our servers is encrypted with HTTPS. Sendi Auth codes are end-to-end encrypted with your master password, passwords and verification codes are stored as one-way hashes, and access to our systems is limited to staff who need it. No system is perfectly secure, so if you think your account has been compromised, contact us straight away.
Your choices
- See or correct your data: your Sendi account details are in Settings; for anything else, contact us.
- Delete your Sendi Auth account: in the app under Settings, then Delete account, or on the account deletion page.
- Close your Sendi account: contact us and we’ll delete it.
Sendi Auth isn’t meant for children under 13, and we don’t knowingly collect their information.
Contact
Questions about this policy or your data: see the help page for how to reach us.
If we change this policy, we’ll update the date at the top of this page. For significant changes we’ll also tell you in the app or by email.