Privacy policy

Sendas forwards mail for your company addresses to your Gmail and lets you send from those addresses. This page explains what we keep to do that, and what we never keep. Sendas is open source, so you can check every claim here in the code.

What we store

• Your Google account basics: email address, name and Google account ID, from Sign in with Google. Your email address is also where your mail is forwarded.
• Your setup: your domains, the addresses you create, and the email addresses of teammates you share an address with. Teammates receive one confirmation email from us and nothing is forwarded to them unless they confirm.
• Passwords and keys, hashed: SMTP passwords and API keys are shown to you once and stored only as one-way hashes.
• A 7-day message log: sender, recipient, subject, time and delivery status of each message, so you can see what happened. Entries older than 7 days are not shown and are deleted.
• Server logs: connecting IP addresses and SMTP replies, kept for a short time to fight spam and abuse.

What we never store

• The content of your messages or their attachments. Mail passes through our servers and is handed straight to Gmail or the recipient.
• Anything inside your Gmail. Sendas has no access to your mailbox; Sign in with Google only tells us who you are.

Google user data

We request only your email address and basic profile, and use them only to sign you in and to deliver your forwarded mail. We do not use this data for advertising, do not sell it, and do not share it with anyone except as needed to run the service. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Spam checks

Incoming and outgoing messages are scanned automatically by Rspamd on our own servers to block spam, phishing and abuse. No person reads your mail as part of this.

Where it runs

Sendas runs on servers we operate at Hostinger (Singapore). DNS is served by Cloudflare. We do not use third-party analytics or advertising trackers.

Deleting your data

Removing a domain in the dashboard deletes its addresses, passwords and message log immediately. To delete your whole account, open Account in the dashboard and choose Delete account: your domains, addresses, teammates, passwords, API keys and message log are erased right away. Copies in our database backups expire within 14 days. If you can no longer sign in, email hello@sendas.space from the address you used.

Contact

Questions about privacy: hello@sendas.space.