SendSelf has no accounts and no trackers. What you share is encrypted before it leaves your device, so the service carries it without being able to read it. This policy lists everything the service does process, why, and for how long.
No name, email address, phone number or password. Your devices are identified by keys they create themselves.
No cookies, analytics or ads, and no third-party scripts on any page.
Messages, files and names are end-to-end encrypted. The keys never reach the server.
Encrypted copies are deleted from the server as soon as your devices have them, and after a day at most.
SendSelf is a free, open-source project run by Oliver Martínez Haro, who is responsible for the data described on this page. It has no advertising, sells nothing, and makes no other use of the data it handles than running the service.
The source code is public, so every claim below can be checked against what actually runs.
Your messages, your files, their names and types, and the names of your devices and spaces are encrypted on your devices before they are uploaded. The keys to decrypt them never reach us, so we cannot read, scan or hand over that content in readable form — not even if we wanted to.
How that works, and where it stops, is described in the security model.
To pass content between your devices, the service keeps the following. None of it includes your name, email address, phone number or any other account details, because SendSelf never asks for them.
| Data | Why | How long |
|---|---|---|
| Encrypted messages and files | To hold them until each of your devices has downloaded them. | Deleted once every active device in the space has them, and after 24 hours at the latest. |
| Delivery status | Which devices still need each message, so a copy can be deleted as soon as it is safe to. | Deleted with the message. |
| Space and device records | Random ids, public keys, device roles, encrypted device and space names, a hash of each device's token, and when devices were added or revoked — so your devices can authenticate and recognise each other. | For as long as the space exists. Revoked devices stay on record, marked as revoked. |
| Key updates | When a device is revoked, the new space key, sealed separately for each remaining device. | Deleted once each device has collected its copy. |
| Pairing requests | The new device's public keys and the sealed package that lets it join. | Deleted when pairing completes; an unfinished request expires after 10 minutes and is removed within the hour. |
Like any website, every request reaches the service with your IP address and the standard information your browser sends, such as its user agent.
Your readable history, your files and your keys are stored in the browser of each device, and nowhere else. They stay there until you leave the space, clear the site's data, or the browser removes it. There is no automatic clean-up of local history yet.
If you link the sendself command line on a machine, it keeps its keys in a file there, and no history: it only sends.
Besides that, SendSelf keeps a copy of its own app files so it opens offline, and your appearance setting (theme and colour) so it survives a reload. You can protect your history, files and keys with a lock; the security model explains how.
SendSelf sets no cookies and uses no analytics, advertising, fingerprinting or social media trackers. Its pages are only allowed to run SendSelf's own scripts, so no third-party code can be added to them.
Links you follow out of SendSelf do not tell the site you visit where you came from.
SendSelf runs on Cloudflare, which serves the app, runs its server code, and stores the database and the encrypted files. Cloudflare processes the data above on our behalf and may do so in data centres outside your country. Its handling of that data is governed by the Cloudflare privacy policy.
No other company receives data from SendSelf, and none is sold or shared.
Storing and delivering your encrypted content, and the records that let your devices authenticate, is necessary to provide the service you ask for when you use SendSelf. Rate-limiting by IP address and keeping short-lived logs rest on our legitimate interest in keeping the service secure and working.
Most of what the service holds is in your hands directly:
Depending on where you live, you may also have the right to access, correct, delete or export your personal data, to object to or restrict how it is processed, and to complain to your data protection authority. Because SendSelf has no accounts, we cannot tell which records are yours without information from one of your devices; if you want to exercise a right, get in touch and we will work out with you how to identify them.
SendSelf is an early-stage project, and this policy will change as the service does. The date at the top of the page shows when it last changed, and every earlier version is kept in the public repository.
For questions about this policy or your data, open an issue on the project's repository. If your request involves anything you would rather not post in public, say so in the issue — without the details — and we will arrange a private channel.