Privacy policy

Effective 12 September 2026. Last updated 1 November 2026. This policy covers the Resender Android app and this website, resender.me.

Resender forwards the SMS arriving on one Android phone to the email addresses you chose, through your own mailbox. It has no server, so there is no copy of your messages anywhere except on your phone and at the destination you named. This page says exactly what the app handles, what leaves the phone, and what we never see.

Who we are

Resender is made and published by Anton Kriukov, c/o Autorenglück #67541, Albert-Einstein-Str. 47, 02977 Hoyerswerda, Germany. You can write to support@resender.me; a person reads it.

Where data-protection law — the GDPR and laws like it — asks who is responsible for the app, the answer is the person named above. In practice there is nothing for that person to hold: the app sends us nothing, we run no service that receives your messages, and we keep no sign-up, no profile and no copy of anything your phone handled — except an email you choose to send us yourself, such as a problem report (see below).

What the app does

Resender runs on the Android phone that holds the SIM card. When an SMS arrives, the app goes down your list of rules in order, and the first rule that matches decides. A rule compares the sender or the text of the SMS with what you wrote in it, and sends the message to all of your recipients, to the ones the rule names, or — if the rule says not to forward — to nobody. The last row of the list, Forward the rest (Forward everything while it is the only row), takes every SMS no other rule took; it is on when the app is first installed. If it is off and no rule matches, nothing is sent anywhere. If every rule is off, nothing is forwarded at all, and the app says so on its main screen. Every recipient is an email address, and every message is sent through the mailbox you set up.

The app forwards an SMS only during the first 24 hours after it arrived: a delivery that keeps failing is retried for those 24 hours and then given up, and the journal shows it as failed. On the free tier the app forwards up to 3 SMS a day; it counts them on the phone, and an SMS over the limit is held in the journal instead of being sent.

Everything is set up on the phone itself. There is no sign-up and no Resender account, because there is nothing of ours to sign in to. The only sign-in the app offers is to your own mail account, described below.

What the app handles, and where it stays

All of the following lives in the app's own storage on your phone, and nowhere else:

Incoming SMS. Read as they arrive, in order to be compared with your rules and forwarded as you set up. Only the messages arriving on the phone the app is installed on — it cannot see any other phone's messages.
Forwarded messages. Sender, text, time of arrival and, on a two-SIM phone, which SIM it came in on. Kept so the app can retry a failed delivery within the 24 hours described above and show you what happened in the journal, where the text stays hidden until you tap it.
Messages that matched no rule (possible only while Forward the rest is off). The sender and the time, and nothing else — the app's storage has no field for the text of an unmatched message, so that text is never written down. This list holds the newest 100 entries.
Messages a rule told the app not to forward. The sender, the time, the SIM and the rule that matched — the text is not stored, and nothing is sent.
Delivery records. For each message and recipient: the status, how many attempts have been made, when the next one is due, and the last error the destination returned. The text of the message is stripped out of that error before it is stored.
Your rules and recipients. Each rule's name and condition — the sender or the text, and the value you typed — the SIMs it listens on and the recipients it sends to; and the email addresses of your recipients.
Your mail account settings. Server, port, encryption mode, user name and From address — plus the password, or, if you signed in with Google, Microsoft or Yandex instead, the sign-in tokens — either one encrypted (see Security).
App preferences. The language and the theme you picked, and whether the daily status message is switched on.
Your Pro status and the daily count. Whether this install is on Free, the 7-day trial or a Pro subscription and which plan the store reported; the time of the first launch, which starts the trial, stored encrypted — on the Google Play build it is also kept in your Google account's Block Store, so a reinstall keeps your free week (nothing else is stored there); and how many SMS were forwarded today, for the free tier's daily limit.

None of it is sent to us. We have no means of reading it, now or later.

What leaves your phone

Only what you configured, and only to the address you configured:

Forwarded messages, to the recipients your settings name.
The app's own notices, to those same recipients: a test message when you press test, a notice when deliveries have been failing and another when they recover, on a day when the free tier's limit held an SMS back, one notice to your own address only — at most one a day — saying that an SMS was held, how many were held today and since you installed the app, with a link to Pro (you can switch it off in Settings → Limit notice), and — only if you switch it on — one line a day saying the app is running on your phone model and how many messages it forwarded. Neither the limit notice nor that daily line carries senders, phone numbers or message text.
A problem report, only when you send one yourself from Settings: a fixed list of fields (app and device facts, counters, failure classes, server status codes, the mail server's host name and your address with the name masked — never the server's words, senders, phone numbers, recipients' addresses or message text), what you wrote and the screenshots you choose to attach. It goes to support@resender.me through your own mailbox, as mail you send; if no mailbox is set up, or that send fails, it goes to the mail app you pick instead.
The network connection each delivery needs: to your mail server, or, for a Gmail account you signed in to with Google, to Google's Gmail API, or, for a Microsoft account you signed in to with Microsoft, to Microsoft Graph.
The domain of a mail address, once, while you set up a mailbox — and only if the app does not already know that provider (see below).

The app contacts no server of ours, because there is not one.

Finding your mail provider when you set up a mailbox

When you set up a mailbox, the app fills in the server settings for you. For common providers it finds them in a list built into the app, and nothing leaves the phone. When the domain of your address — the part after the “@” — is not on that list, the app takes up to two steps, and stops as soon as one of them identifies the provider.

First, it asks your phone's own DNS resolver — the one your phone already uses for every website and app — which server receives mail for that domain (the domain's MX record). That is a single question, and the app waits no longer than three seconds for the answer. No third-party DNS service is involved. If the answer does not identify the provider, the app then makes one request to Mozilla's Thunderbird autoconfiguration database, carrying the domain alone.

In both steps the domain is the only thing that leaves the phone, and only while you are setting up the mailbox. Your address, your user name and your password are never sent, and nothing is looked up when messages are forwarded.

Write to the developer

The Write to the developer button in the app's settings sends an email to support@resender.me through your own mailbox — the same way the app forwards an SMS — when you press Send. The email contains the text you wrote, the screenshots you chose from your gallery (scaled down before sending), and an attached technical report: the app's version and tier, the phone's make, model and Android version, the state of the app's permissions and settings, counts of rules, recipients and deliveries, the category of each recent delivery failure, and a log of the app's last 400 delivery and system events — when an SMS arrived, each attempt, and changes of screen, battery saving and network. The report also names your mail server (host, port, encryption and how the settings were found) and your email address with the name masked (***@domain). It contains no phone numbers, no SMS texts and no passwords. If no mailbox is set up yet, or the send fails, the button opens your own mail app with the same email instead, and it leaves the phone only if you press send there. Either way it goes only when you choose to send it. We receive it like any other email you write to us and use it only to answer you.

The diagnostics file

Builds of the app made for testing — not the version published in the stores — can also write a plain-text diagnostics file and hand it to Android's share sheet, so you can send it to someone helping you. Nothing is uploaded and nothing is sent automatically: the file goes where you send it and nowhere else.

The standard export contains senders, delivery statuses, attempt counts, error texts and the app's own recent log lines. It contains no message text and no passwords. A second, separate button produces an export with message text, and warns you before it does. Each export replaces the previous one.

Instead of typing a mail password, you can sign in to a Google, Microsoft or Yandex mail account. The sign-in happens directly between your phone and that provider.

What the app is allowed to do. The sign-in grants Resender the permission to send mail from that account — with Google the permission called gmail.send, with Microsoft Mail.Send, with Yandex mail:smtp. With Google and Microsoft the sign-in also carries the standard identity permission (email; Microsoft adds openid and offline_access), which tells the app which address you signed in with and lets the sign-in last without asking you again; it reveals your address and nothing else. None of these lets the app read, list, search, change or delete your mail, and the app never does any of those things.

What it is used for. Only to send what your rules forward, and the app's own notices described above, to the recipients you named. For a Gmail account signed in with Google, each forwarded message is sent as one request from your phone to Google's Gmail API (messages.send). For a Microsoft account signed in with Microsoft, it is likewise one request from your phone to Microsoft Graph (me/sendMail). For any other account, the app connects from your phone straight to the provider's mail server and sends the message over SMTP, as it does for an account with a password.

Where the tokens are kept. Signing in gives the app two tokens: an access token, which works for a short time, and a refresh token, which lets the app get a new access token without asking you to sign in again. Both are stored on your phone, encrypted with a key held by the Android Keystore (see Security), and are used only on the phone. They are never sent to us or to any server of ours.

Not shared, not sold. Nothing the app obtains through the sign-in is shared with, transferred to or sold to anyone, and none of it is used for advertising, analytics or any purpose other than sending the mail you set up. Resender's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements (see Third parties).

How long, and how to remove it. The tokens stay on the phone until you sign out of that account in the app, clear the app's data or uninstall the app. Signing out deletes them from the phone and, where the provider offers a way to do so, also asks the provider to revoke the permission. You can withdraw it yourself at any time, too, in the security settings of your Google, Microsoft or Yandex account.

Permissions, and what each is for

Receive SMS. The app's whole function: it is how the app learns that a message arrived and what it says. Used for matching and forwarding, and for nothing else.
Internet. To deliver to your mail server.
Run at startup. So that after the phone restarts, anything still waiting in the queue is delivered.
Phone state. Used for exactly one thing: reading the carrier names of the SIM cards, so a rule can say “SIM 2 — your carrier’s name” instead of an internal number. The app asks for it only on a phone with two SIM slots, and only when you first open the SIM section of a rule. Refuse it and you lose the ability to match on a specific SIM; nothing else changes. No phone number, no device identifier and no subscriber identity is read anywhere in the app.
Foreground service. Resender keeps a small service running, with its notification, so that Android is less inclined to stop it; on older Android versions the system's own work scheduler also briefly uses one to run a delivery. The notification exists to tell you the app is running — it collects nothing.

The app asks for no access to contacts, location, files, camera, microphone or your call history.

Third parties

The third parties in this product are the ones you choose, when you choose them.

Your email provider. Every forwarded message travels through the mail server of the account you entered — your own server, or a provider such as Gmail, Outlook or any other. That provider handles the message under its own privacy policy, exactly as it does every other message you send.
Google, Microsoft or Yandex, when you sign in to a mail account instead of typing a password. The sign-in happens directly between your phone and that provider (see Signing in); the resulting token is stored on your device only and is never sent to us, because we have nowhere to send it. Resender's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Besides the identity permission described above, the only Google permission used is the one that sends mail on your behalf; Resender does not read your mailbox.
Mozilla's Thunderbird autoconfiguration service, when the app offers to fill in your mail server settings. Only the domain part of the address — what comes after the “@” — is sent, in order to ask which settings that provider uses. Your full address is not sent, your password is not sent, and no message is ever sent there.
The store you subscribe to Pro through. A subscription is handled entirely by Google Play under its own privacy policy. The app receives back only whether this installation is entitled to Pro, and on which plan. We never see your name, your email address or your payment details.

What we do not do

No server of ours ever sees your messages, because there is no backend and there will not be one.
No sign-up with Resender, no registration, no profile.
No analytics, no telemetry, no crash reporting, no advertising identifier in the app.
No advertising, in any tier.
No selling, renting or sharing of your data with anyone. We hold nothing that could be sold.
No reading of your messages for the app's own purposes: no auto-fill, no scanning. A rule reads the sender or the text only to compare it with what you wrote in that rule, on the phone.
No cloud backup and no sync between devices. That is the price of everything above, and it is deliberate: reset the phone and you set the app up again.

About this website: every page, this one included, counts visits with one small analytics script, GoatCounter — no cookies, no personal data, no cross-site tracking. The only thing the site keeps in your browser is the language you picked. The site has no forms and no comment box, and asks you for nothing.

How long things are kept

Everything below is kept on your phone and nowhere else: the app has no server to keep a copy on.

Forwarded messages. The text of the message is kept for 7 days; the record of it — sender, time and delivery status — for 30 days. After that the app deletes them automatically; a message whose delivery is still being retried keeps its text until that last attempt is over.
Senders of unmatched messages: only the newest 100 are kept; each new one drops the oldest.
Rules, recipients, mail settings and credentials stay until you change or delete them in the app.
A problem report or a diagnostics file sits in the app's cache until the next one replaces it.
Uninstalling the app removes all of it. So does Android's “Clear data” for the app, if you want to keep the app but start over.
Copies that already left — the forwarded message sitting in your mailbox or your recipients' mailboxes — are yours, at the destination you chose. We cannot reach them, and neither can the app.

Security

Credentials are encrypted at rest. Your mail password, or the sign-in tokens, are encrypted with a key generated and held by the Android Keystore, which keeps it in the phone's secure hardware where the phone has it and never hands the key out — not to the app, and not to anything else.
Email is encrypted in transit. The app requires TLS, and checks that the server's certificate really belongs to the server name you typed. It refuses to fall back to an unencrypted connection, even if the server offers one — a failed send that you can see is better than a silent one that anyone on the network could read.
No claim beyond that. We hold no security certification and claim none. A phone in someone else's hands is outside what any app can protect: lock the phone that runs Resender.

Children

Resender is not directed at children and is not intended for anyone under 16. It has no content for children, and it collects nothing about who is using it — we could not tell a child from anyone else, because we receive nothing at all.

Your rights

Data-protection law gives you the right to see the personal data held about you, to correct it, to erase it and to take it elsewhere. With Resender you exercise all of them on the device, because the device is the only place the data is:

See it: the app's screens show your rules, your recipients, your settings and the journal.
Correct or delete part of it: edit or delete a rule or a recipient in the app.
Erase all of it: Android Settings → Apps → Resender → Storage → Clear data, or uninstall the app.

We cannot do any of this for you, and there is no request you could send us that would change anything: we hold no copy to show, correct or delete. The one exception is an email you chose to send us, a problem report included: ask, and we delete it. Questions about this policy go to support@resender.me. If you are in the EU, the EEA or the UK and think something here is wrong, you can also complain to your national data-protection authority.

Changes to this policy

If the app changes what it does with your data, this page changes with it and the effective date at the top moves. There is no sign-up and no mailing list, so there is no way for us to notify you — the current version is always the one at resender.me/privacy.