Privacy policy

Sendover — browser extension (Chrome and Firefox) and phone app · Last updated: 28 October 2026

Summary

Sendover moves what you choose between your phone and your browser. Text and links are kept in your room's history (the last 50, up to 30 days on Pro and 24 hours on Free), and files are deleted automatically after your plan's window: on Free, one hour waiting for your device, then 10 minutes after the first download. On Pro, 30 days in both cases, capped at the last 500 MB per room. No name, no ads, no third-party analytics, no selling of data. What isn't collected can't leak.

Transfers themselves don't need an account. A room works with its code alone, as it always has. An account — your email — is only needed if you want a paid plan or to recover your room on a new device. Details in the "Account and subscription" section below.

What passes through the server
What you send yourself: the text, links, images and files you explicitly choose.
Device name: text you type (e.g. "Office PC"), shown to you alone.
Room code: 22 random characters the server generates at pairing. Not tied to you or your device.
Send time and a random ID for each item, to manage delivery and deletion.
Conversation history: the last 50 items in your room, up to 30 days on Pro and 24 hours on Free — then the oldest drops off. It holds text and links in full, and of files their trace, not their contents: name, size and type without a single byte of the file itself, so your thread stays continuous on a new device instead of coming back with silent holes.
This means a file's name lives as long as the history — longer than the file itself, which is deleted when its window ends (an hour, then ten minutes after the first download, on Free; thirty days on Pro). If the name alone reveals something you'd rather not, rename it before sending, or clear the history from Settings.
Usage summary for rooms with no account: when a phone and a computer both connect to a room with no account, we keep the day it was paired, the day it last connected, the day the extension or the Sendover web page was last used, the day something was last sent from it, and how many files it currently holds and their total size — so we can tell whether people use Sendover without signing up. It carries no room code, no content, no file names and no IP addresses, isn't linked to you or your device, and is deleted once the room ends or is claimed by an account.
Last send, last use and total uploaded: in your room we keep the time of the last thing you sent from the computer and from the phone, the hour you last used the extension or Sendover in the browser (opening its window or sending from it), and the number of files you have uploaded and their total size — no content and no file names — so we can tell whether Sendover is actually being used and how much server space it takes. This is deleted when the room ends.
The sign-in and sign-out commands: when you bring a browser into your room, only the room code itself passes; when you sign it out, nothing passes at all — an empty command. Neither carries content, neither is kept after it arrives, and neither enters the history.
Push subscription address — only if you turn on notifications in the phone app or on the pc.sendover.dev page. It's a link your browser generates with the push service (Apple, Google, Mozilla or Microsoft, depending on your browser), stored in your room so you can be alerted when something arrives while the app is closed. It carries neither your name nor your number, and you cancel it by turning notifications off in your phone's settings or in your browser's site settings, or by signing out of the page.
Automatic technical error reports: on a technical error (network, socket, storage) the app may send the developer a short description with none of your message text and without the key, identified only by the non-secret accountId. The manual "Send a report to the developer" button remains your choice.
And from your phone specifically: this report is only sent by your own press of the button — never automatically, no matter how often the fault repeats. In both cases it carries no session token, even if you have a signed-in account.

What you send never passes through the push service. The push that reaches your browser's push service is empty — just a bell. When it rings, the app asks your server directly what's waiting for you and writes that in the notification. So the message text appears on your screen, but it never crossed the push service's servers.

Since the text appears in the notification, anyone who can see your locked phone screen can read it. Turn off notification previews in your phone's settings if that bothers you.

Account and subscription

Transfers between your phone and your browser work with the room alone, no account, as they always have. An account is needed for two things only: the paid plan, and recovering your room if its code is lost or you move to a new device.

Your email — either by signing in with Google, or by typing it and confirming with a code we send you. We store the email — and, with Google, your Google account ID (sub), to detect an email being reassigned to someone else; it is used for nothing else. With Google we request two scopes and no third: openid and email — that is, identity confirmation and email only. We don't request your name, your photo, your contacts or your inbox, and we can't access them.
A name you type — optional, never required, and not taken from Google: it defaults to the part before @ in your email, and you can change it whenever you like. It's shown to you alone in your app, is never sent with what you transfer, and the other end never sees it.
Your plan status — the plan name, its expiry date, and whether your trial has been used.
Your subscription record — for each period you bought: its number of days, its amount, its activation date, and the matching payment transaction number. It's kept for one reason: so any claim or dispute over a payment is settled by a document, not a guess — for you and for us alike.
When your account was last used, and a counter of how many times it was read — a date and a number, nothing more. No pages, no content, no IP addresses, no record of what you transferred. It answers one question: was the subscription used after it was paid for.
The codes of the rooms linked to your account — up to three rooms, so you can recover them when you sign in.
Your sign-in session — a signed token stored in your browser to keep you signed in. Its only job is keeping you signed in: it doesn't track you across sites, can't be read by any other site, and goes away when you sign out.

Why do we keep "was the trial used"? So it's granted once per email. That's why the address is normalized before it's stored: letter case is ignored, and so is anything after + — only at providers that support sub-addressing (Gmail, Outlook, Yahoo, iCloud and the like) — so two spellings of one address don't count as two accounts, and two people aren't merged into one at a provider that treats + as part of the address. That is the only thing this normalized form is used for.

Payment never passes through our server. Your card details go directly to Stream (StreamPay) — the payment gateway — and to Moyasar, the licensed payment provider that actually processes the card and on whose domain the confirmation page opens. We never see or store them, not the number nor any part of it. We keep only the subscription status described above. Each of them handles its part under its own privacy policy.

Your account email reaches Stream only when you buy. When you tap "Subscribe" we create a payment link just for you, and put your account email and the subscription period in it — those two alone tell us, once payment succeeds, which account to activate. That's what makes activation instant and what prevents a subscription being activated on an email other than yours. We also register you there once as a customer, with that same email and your interface language, so the payment page opens without a form asking for your name and email. Nothing else is sent: not your name, not your room code, and nothing you've transferred.

How long things stay — exactly
Case Duration
A file — expiry depends on your plan Two windows: waiting for your device — 1 hour on Free and 30 days on Pro — then after the first download: 10 minutes on Free and 30 days on Pro, after which it's deleted. The renewal happens once only: so the copy reaches your device and isn't lost if you close the save sheet. Alongside the expiry there's a second limit: the last 500 MB per room; anything beyond that pushes out the oldest — whichever comes first
A file while the other end is offline Waits in your room within the same expiry (50 items at most); if it runs out before your device opens, the content is gone — its trace stays in the history: name and size, not a single byte
Text or link in the room history 30 days on Pro, 24 hours on Free, capped at 50 items — the oldest drops first. After Pro ends, the history keeps that length for five days, then it's trimmed
A room with no activity at all 90 days, then it's deleted with everything in it
The file queue is full (50 items) The oldest is deleted immediately, file and all
Push subscription address Stays as long as notifications are on; removed from the server the moment you unpair your phone, and automatically as soon as the push service rejects it
Email verification code A few minutes; used once, then erased
Sign-in session Until you sign out or it expires
Your account (email, name, Google account ID if you signed in with Google, plan status, subscription record and last activity) Stays until you ask us to delete it — then it's deleted with everything in it

Files are deleted along three lines: when their window ends (the first download renews it once), on the room's alarm, and when the room's storage fills up. The chat history has its own lifetime and cap, listed above — and a file's trace stays in it after the file itself is gone. There are no backups from which data could be restored.

What is never collected
✗ No IP address logs — we use it momentarily for rate limits and human verification, and it persists only in a security alert sent to the operator when someone fails ten times at the admin sign-in
✗ No tracking identifiers, no advertising or analytics cookies
✗ No analytics or measurement tools from any third party
✗ No ads, no data sharing, no selling it to anyone
✗ No reading the content of the pages you browse
✗ No file archive — files are deleted automatically after your plan's expiry window
✗ Not your name, photo or contacts — even when you sign in with Google
✗ No card details — they never pass through our server at all

The only exception is the sign-in session token if you sign in — it's needed to keep you signed in, can't be read by any other site, doesn't track you across sites, and goes away when you sign out. If you never sign in, there's no session at all. You can revoke all your sessions on all your devices with the "Sign out everywhere" button in Settings.

And one short-lived cookie if you choose to sign in with Google: a random value that lives twenty minutes, whose only purpose is to confirm that the return from Google came to the browser that started the request — so nobody is handed someone else's session. It carries neither your email nor your name, can't be read by any other site, and is erased as soon as sign-in finishes.

What's stored on your device alone

In chrome.storage inside your browser: the server address, the room code, the device name, your three preferences (auto-download, open links, copy to clipboard), your phone platform (iPhone or Android), a flag that you've seen the welcome screen, local counters for the trial bar (open count, first send, bar dismissed), and when the popup was last opened (to count what arrived since on its icon). None of this is sent to anyone, except the hour of your last use, which reaches our server to be kept in your room (see “Last send, last use” above). Removing the extension erases it. Opening the sign-in tab on the site sends no new data from the extension — the room is linked to the account there. Also stored: the auto sign-out delay, if you turn it on, and the last-use time it is measured against.

The "Sendover in the browser" page at pc.sendover.dev — the extension's alternative for those who don't install it — keeps the same things in its own site storage (localStorage and IndexedDB), with no sign-in tab and no permissions; it saves no file and opens no link without your click, and signing out or clearing site data erases it.

The extension also keeps a copy of every file you receive, in the browser's cache storage. An image is shown in the thread just as on your phone, and showing it is a full download — which starts the post-download window (10 minutes on Free). That copy is what keeps the image visible afterwards and what its Save button saves, and every other file is saved to your Downloads folder from it. There's also a copy of every file you send from the extension, kept the moment it's uploaded: it lets you open it from the thread without consuming the copy your phone is waiting for. These are purely local, never sent to anyone, shrink with the inbox, and all go away on sign-out, on clearing the inbox, or on removing the extension.

Signing out — via the 🚪 button in the extension popup, or from your phone — immediately wipes the room code, the inbox list and the image copies from this browser. Signing out of the browser doesn't touch your phone, and vice versa. One browser is signed in at a time: if you sign in from another browser, the first is signed out automatically and its code and inbox are wiped from it.

In the phone app: the message thread and your preferences in browser storage, and a copy of every file you save or open in the app's cache. The file is deleted from our server after its expiry, but your copy stays on your device — so a second tap works, and the image isn't lost if you close the share sheet. It's purely local, never sent to anyone, shrinks with the thread, and all of it goes when you delete the app.

The login code is eight random digits that live three minutes and are used once, then erased from the server. It's not tied to you or your device, and the app asks for no camera or any other device permission to sign in.

Permissions — and why
Permission Purpose
contextMenus The "Send to my phone" entries in the right-click menu
storage Saving your settings locally
notifications Telling you whether a send succeeded and arrived
activeTab The current page's URL — only when you choose "Send page link"
alarms Keeping the connection alive after the browser goes idle
downloads Saving what arrives from your phone to your Downloads folder
downloads.open
Optional Opening the file the extension saved with your system's app when you click its bubble — only on your click
offscreen · clipboardWrite Copying incoming text to the clipboard
<all_urls>
Optional — off by default Fetching the image file you right-clicked and uploading it to your server. No pages are read and no scripts are injected — there is no content script in the extension at all. Without it, the image's link is sent instead of its file.
⚠ What you should know before using it
Files and text are end-to-end encrypted — provided all your devices are up to date. The room key is generated by your phone and never passes through the server, so we see sizes, times and device names — not the content, and not file names. Its state is visible to you: a lock in the chat header and the "End-to-end encryption" section in Settings — if it says "Off", transfers are protected by HTTPS and WSS alone, and whoever runs the server is technically able to see what passes through during the minutes it stays there. The Android app doesn't support it yet: a room with an Android device stays unencrypted until it catches up, and the section says so by device name. There is no backup of the key on the server: if you lose your device and restore your room through your account, you get it back without what was in it before — only new items reach you.
The room code is the key. Anyone who gets it can send to you, receive from you, and read your text history. Don't screenshot it or post it. There is no key rotation. If it leaks: create a new room and abandon the old one — it stays usable by whoever holds its key until it expires 90 days after its last activity, when it's deleted with everything in it. This concerns the room code alone, not your account: your email and plan are untouched.
The extension acts on what reaches you without waiting for your tap. An incoming link opens in a new tab as soon as it arrives, an incoming file downloads to your Downloads folder, and incoming text is copied to your clipboard ready to paste — all three are on by default, and you can switch off each one separately from the extension's settings (the "Automatic behavior" section).
Technical limits
100 MB maximum per file on Pro, and 10 on Free
Up to 400 operations per hour per room on Pro, and 10 on Free
50 items maximum in the file queue, and 50 in the chat history
Infrastructure

The server runs on Cloudflare Workers with Durable Objects and R2. The code is open and you can run your own copy of the server, in which case nothing passes through our server at all.

What Sendover transfers — your text, links and files — never passes through any third party. The parties below don't touch it, and only come into play if you opt into an account or notifications:

Google — only if you choose to sign in with Google. It gives us your email and confirmation that you own it, and we request nothing else. Its role is governed by Google's own privacy policy.
An email provider — only if you choose to sign in by email. It receives your address and the verification code in order to deliver it to you. The admin-lockout alert to the operator's inbox passes through it too, as do support replies sent from support@; nothing else passes through it.
Cloudflare Turnstile — only if you choose to sign in by email. A tool we use to protect sending the sign-in code to your email from automated programs; it checks your browser at the moment of the request and is not used to track you or for ads.
Stream (StreamPay) — only if you subscribe. It's the payment gateway on which we create your payment link, and it receives your account email and the subscription period in that link — with those, your subscription is activated on your account as soon as payment succeeds. You're also registered there as a customer with that same email and your interface language, so you don't type your name and email on the payment page.
Moyasar — only if you subscribe. It's the licensed payment service provider and a party to our contract with Stream; your card details are processed there and the money moves through it. Your financial details go to it directly without passing through us, and we send it nothing ourselves.
Your browser's push service (Apple / Google / Mozilla / Microsoft) — only if you turn on notifications. The push sent to it is empty, as explained above.
Deleting your data

Files are gone after their window: an hour, then ten minutes after the first download, on Free, and thirty days on Pro, and their trace (name and size) stays in the history. The conversation history is kept up to 30 days on Pro and 24 hours on Free (or 50 items), and an inactive room is deleted after 90 days with everything in it. To delete immediately from your device: click 🚪 Sign out in the extension popup — it erases the room code and the inbox from this browser at once (it doesn't erase the room's history on the server). From your phone: Unpair this phone in the "Account & sign out" card. Or remove the extension and the app.

Unpairing your phone also cancels the push subscription: the subscription is canceled in your browser, and its address is removed from your room on the server at the same moment — so no dangling address is left for a bell to ring on a device that's no longer paired.

To delete your account — if you created one — email us at the address below from that same address. The email, name, Google account ID (if you signed in with Google), plan status, subscription record, last activity and room links are deleted, with everything they hold. Deleting the account doesn't restore your trial: the record that it was used is exactly what prevents a repeat, so it stays tied to the email even if you create the account again.

Losing the room code means losing access to the room — unless you had linked it to your account, in which case you get it back by signing in.

Changes and contact

Any material change to this policy will be posted here with an updated last-modified date. Questions: support@sendover.dev

Sendover — one tap. And transfers still need no account.