Privacy policy

In effect from November 1, 2026.

Who we are

Sentlet is a messaging app. You can reach us at privacy@sentlet.com. Sentlet's servers are in Canada.

Sentlet is in early testing. This policy describes the version testers use now.

What stays on your phone

Your chats, the people you talk to, and the photos, videos and files you send or receive are kept in an encrypted database on your phone. Its key is held by your phone's secure hardware. Sentlet doesn't copy it to Google's backups or anywhere else, so if you delete the app or lose your phone, your chats go with it.

What our servers keep

• Your account: a random account number, your public keys and those of your devices, the day the account was created, and a public key for recovering your account later (not used yet).
• Your username, only as a scrambled fingerprint (a hash). The servers can tell whether a username someone looks up exists, but they don't store the names themselves.
• Your display name and photo, encrypted with a key only your contacts and the groups you're in have. Our servers can't read them.
• Keys for starting chats with you: each is handed out once, to someone starting a chat with you, and then deleted. One spare is kept for when they run out.
• Messages waiting for you: encrypted. Each is deleted as soon as your phone confirms it arrived, or after 30 days if it never does.
• Attachments (photos, videos, voice notes and files): encrypted on the sender's phone before upload. Each is deleted once everyone it was sent to has downloaded it, or after 30 days.
• Groups: which devices receive a group's messages. So the servers can tell which accounts share a group, but not the group's name, who anyone is, or what's said.
• Daily counts of the tokens your account was given for things like looking up a username, so no one can flood the service.
• Reports (see "Blocking and reporting"): encrypted so that only Sentlet's own key, kept off our servers, can open them. They wait on our servers until we collect them, for 90 days at most.
• A browser you link (see "Sentlet in a browser"): that your account has one, when it was linked, and the day it was last used. Not which browser or computer it is.
• Your phone's Firebase installation ID, which lets our servers ask Google to wake your phone (see "Notifications and Google"). It's replaced when Firebase gives your phone a new one, removed when Firebase says it's no longer in use, and deleted with your account.

While Sentlet is in testing, those tokens are a simpler kind that lets our servers connect such a request (looking someone up, say) to your account. The final version uses tokens that can't be connected.

What our servers see but don't keep

• Your IP address, while your phone, or a browser you've linked, is connected, because data has to be sent back to it. It's never written to any log.
• When messages are sent, and roughly how big they are. Messages are padded so their size says little.
• Who a message is for, so it can be delivered, but not who it's from.

Notifications and Google

A phone can't keep a connection open all the time, so on Android, Sentlet uses Google's Firebase Cloud Messaging to be woken when something arrives for it:

• Registering: once you have an account, Sentlet registers your phone with Firebase, which gives it an installation ID. Sentlet gives that ID to our servers.
• Waking: when something arrives for your phone while Sentlet isn't connected, our servers ask Firebase to wake it, with a message that holds nothing: no sender, no chat, no content. Sentlet then fetches what's waiting from our servers itself.
• What Google learns: your phone's installation ID and when it was woken. Not who wrote, what they wrote, or who you talk to. Google's own privacy policy applies to what it handles.
• The notification itself is made on your phone, from the message Sentlet decrypted there. On the lock screen it says only "New message". In Settings you can make it say that everywhere.

Turning notifications off in Android's settings hides them, but Sentlet still registers with Firebase, so messages are fetched as they come.

Link previews

When you write a link, Sentlet can show a preview of the page with your message. Your phone makes it: it fetches the page and its picture straight from that website, as a browser would, so the website sees your internet address. Our servers aren't involved, and the people you write to never visit the link: the preview travels inside your encrypted message. You can turn link previews off in Settings, under Privacy.

Calls

You can call anyone whose chat you've accepted, by voice or video.

• Setting up a call: what the two phones need to find each other travels as encrypted messages in your chat, like any message. Our servers can't read it. A call that arrives while Sentlet is closed wakes your phone the same content-free way as a message (see "Notifications and Google").
• The call itself is encrypted between the two phones, with keys only they have. Nothing of it is recorded, by us or anyone.
• Direct or relayed: when the networks allow, a call goes straight between the two phones, so each one can see the other's internet address. When they can't, or when you turn on "Always relay calls" (Settings, Privacy), the call goes through Sentlet's call server, which passes it along without being able to hear or see it. While it does, the call server sees both phones' internet addresses and how much passes through, and keeps no record of either.
• Using the call server: your phone gets a password for it from our servers that lasts a few hours, in exchange for a single-use token, so the call server isn't told whose call it is.
• Your call history (who, when, voice or video, how long) is kept on your phone, in the encrypted database with your chats. Our servers keep none. A missed call's notification follows the same "Show message text" setting as messages.
• Android's call system: Sentlet's calls go through it, so headsets, cars and watches can answer and end them; they show the caller's name, as they do for phone calls. Sentlet's calls aren't added to your phone's own call log.

Sentlet in a browser

You can use Sentlet on a computer, at web.sentlet.com, by linking a browser to your phone: in Sentlet, go to Settings, then Linked devices. Your phone asks for your app lock or its own screen lock first, then you scan the code the browser shows.

• Its own keys: the browser makes its own keys, so what you send and receive there is end-to-end encrypted, as on your phone. Your phone sends it your chats and recent messages the same way. Our servers can't read any of it.
• What the browser keeps: with "Keep me linked on this computer", the browser keeps your account and its keys on that computer, encrypted with a key that never leaves the browser, so it opens again without your phone. Your messages are kept only while the tab is open. Without it, closing the tab logs the browser out.
• How long: a browser logs out by itself after 7 days without use, and 30 days after it was linked at the latest. Only your phone can link or remove one, at any time.
• Its name: the browser tells your phone which browser and system it is, such as "Chrome on Windows", end-to-end encrypted, so Linked devices can show it. Our servers aren't told.
• The people you chat with: their apps learn that your account has another device, so they can encrypt to it. They aren't shown it.
• Notifications: the page makes them itself, from messages it decrypted, and only while the tab is open. No other service is involved.
• web.sentlet.com is our own server, in Canada. It sends the page, which loads nothing from anyone else and has no cookies or analytics. It sees your IP address while the page loads, as any website does, and writes it to no log. The page then talks only to our servers, as the app does. Each release's fingerprint is listed on Sentlet for the web, so anyone can check the code they're sent.

Blocking and reporting

Blocking happens on your phone: our servers aren't told whom you block, and neither is the person you block. What they send you directly stops arriving, and they stop getting your new name and photo, except through groups you share.

Reporting someone sends us, from your phone: their last 10 messages in that chat as text (no photos, videos or files), the username and name your phone knows them by, whether it was a group, and your note if you write one. Your phone encrypts the report with a key only Sentlet holds, which is kept offline, not on our servers. Nothing in the report says who sent it, though the messages themselves may show it. We read reports to deal with abuse of Sentlet, and delete each one once it's dealt with. Reporting someone also blocks them.

What we never get

The content of any message, call or attachment, except the messages in a report (above); your contact list or address book; your phone number, email or location.

Backups of our servers

Our servers are backed up so they can be restored after a failure. Copies kept away from the server are encrypted, and something you delete can stay in our backups until they're replaced, for up to 6 weeks.

This website

sentlet.com is a plain website with no cookies, no analytics and nothing loaded from anyone else. It's hosted by Cloudflare, which handles each visit and sees your IP address, as any web host does (Cloudflare's privacy policy). When you open a Sentlet link, the part after the "#" stays in your browser and is never sent to any server.

When you write to us

If you email privacy@sentlet.com, we see your email address and what you write. We use it only to answer you, and delete it when we're done. Cloudflare passes the email on to us.

Sharing

We don't sell, rent or share your data with anyone. Google's Firebase wakes your phone for us, as described above, and gets nothing more than that needs. We would only hand over what we have if the law required it, and what we have is no more than what's listed above.

Deleting your account

In Sentlet, go to Settings and choose Delete account. That deletes your account and everything our servers keep about it, and Sentlet deletes your phone's Firebase installation. If you no longer have the app, see Delete your account.

Children

Sentlet isn't meant for children under 13.

Changes

If this policy changes, we'll update it here and change the date at the top. If a change means keeping more than we do now, we'll say so in the app first.