Privacy Policy

Last updated: October 28, 2026

This policy explains what information unsend collects, why, who else handles it, how long we keep it, and the choices you have. It applies to the unsend apps for iPhone, iPad, Mac and Android, the web app at web.unsend.app, and the website at unsend.app (together, "unsend").

unsend is provided by Unsend Inc ("we", "us"), 66 Mineola Ave, Roslyn Heights, NY 11577, USA. For the purposes of data protection law, Unsend Inc is the controller of your personal information. Questions and requests go to support@unsend.app.

The short version

• We collect what we need to run a messenger: your account, your messages, emails and calls, and the devices you use.
• Your messages, emails and calls are encrypted in transit and at rest. They are not end-to-end encrypted. Our systems hold the keys, so unsend can technically access your content. Access by our staff is restricted, logged, and shown to you.
• Some incoming email from businesses and promotional senders, and calendar invites, is sent to OpenAI to sort and summarize it. Your chats, and email between people, are not.
• We don't show ads, we don't track you across other apps or websites, and we don't sell or share your personal information for advertising.
• You can download a copy of your data and delete your account from inside the app.

1. Information we collect

1.1 Your account

• Username. Your username is also your email address (username@unsend.app).
• Invitation code. unsend is invite-only, so we record the code you joined with and the codes you create. If you create a personal invite for someone in your contacts, we store that person's phone number with the code.
• Profile, if you add it. First and last name, and a profile photo. These are optional.
• Phone number, if you add it. Optional for most accounts. It lets you recover your account and lets people who have your number find you. It is required only for accounts created on devices that can't use passkeys. We verify it with a text-message code.
• Older accounts. Accounts created before passwordless sign-in may still hold a birth date and gender from the old sign-up form. We no longer ask for them.

1.2 Sign-in and account security

• Passkeys. unsend accounts don't use passwords. A passkey is created and kept by your device or your passkey provider (for example iCloud Keychain or Google Password Manager) and unlocked with Face ID, a fingerprint or your device passcode. We store only its public half and a few facts about it: which provider it comes from, the name you give it, and when it was created and last used. The private key never reaches us.
• Recovery PIN. If you set one, we store only a one-way hash of it, never the PIN itself.
• Older passwords. If your account still has a password from before passkeys, we keep only a one-way hash of it. We delete that hash as soon as you save your first passkey. Until then, when you sign in with that password we check whether it has appeared in a known data breach. To do this, we send the first five characters of a hash of it to the Have I Been Pwned service. Neither your password nor its full hash is ever sent.
• Sign-in history. For each sign-in we record the country (worked out on our own servers from your IP address, using a database stored on our servers) and a general description of the device (for example "Chrome on Windows" or "iPhone"). We keep the full IP address of a sign-in for no more than 30 days, for security investigations. Sign-in notices in your inbox show a partly hidden IP address.
• Sign-in requests. When you ask to sign in from a new device, your other signed-in devices are shown that device's type, browser or operating system, country and partly hidden IP address, so you can approve or refuse. The request itself expires after two minutes.
• App Lock. On iPhone, iPad, Mac and Android, the App Lock passcode and any face or fingerprint unlock stay on your device. We never receive biometric data. On the web, App Lock is enforced by our servers. We keep a record that a browser session is locked for up to one year, so that the lock can't be bypassed.
• Security notices. We put a notice in your own inbox for each new sign-in and for changes to your passkeys, recovery PIN or password.

1.3 Your messages, emails and calls

• Chats. The messages, photos, videos, voice messages, files, stickers, reactions, replies and forwards you send and receive. Also the facts about them: who sent them to whom and when, and whether they were delivered, read or played. If you edit, star, pin, save or delete a message, we record that too.
• Email. The emails you send and receive at your unsend address: sender, recipients (to, cc and bcc), subject, body and attachments.
• Calls. A call record that shows who took part, when, for how long, whether it was voice or video, and which of your devices answered. We don't record the audio or video of calls (see section 4.3).
• Groups. Group names, icons and members.
• Personalization you upload. Your sticker library, any custom wallpapers, and your choice of wallpaper and bubble color.
• Messages to support. When you write to support@unsend.app, from the app or elsewhere, we keep that correspondence.
• Reports. If you report a message or a person, we receive the report and the content it points to.

Photos are re-encoded before upload, which removes location and camera information from them. Videos and files are uploaded as they are, so any information embedded in them (for example, where a video was recorded) goes with them.

1.4 Your contacts

• Address book (optional). If you allow it, both in your device's permission prompt and in the app's own explanation, the app sends your address book to us so we can show which of your contacts already use unsend. For each contact this includes their name, phone numbers and email addresses. It is sent over an encrypted connection, but the contact details themselves are not hashed or otherwise disguised. We save only the contacts that match an unsend account, as your unsend contacts. We don't keep the rest. While the permission is on, the app repeats the check from time to time so the list stays current. You can turn the permission off at any time in your device settings.
• Contacts you add by phone number. If you add someone by phone number and they aren't on unsend yet, we keep that number for up to 180 days. That way the contact can be connected if they join.
• Blocks and spam. The people and email addresses you block, and the senders you mark as spam.

1.5 Your devices

• Device information. A device identifier created for unsend, plus the device's name, type and model, operating system and version, and app version. On a Mac, the device name is the computer's name, which often includes your own name.
• Notification addresses. The push notification tokens Apple or Google gives your device, or your browser's web-push subscription, so we can deliver notifications and calls.
• Presence. Whether you are online, when you were last seen, and whether you are typing. Others see these only as your settings allow.

1.6 How you use unsend

We record when each app session starts and ends, how long the app is in active use, and the platform, app version, operating system and device model. We use this, together with the countries from sign-in history, to understand usage in aggregate: for example, how many people use unsend each day and how the apps perform. This analytics runs on our own servers. We don't use third-party analytics or advertising tools.

When you search for people or messages, the search is sent to our servers to answer it. We don't keep a history of your searches.

1.7 Website and web app

The website unsend.app sets no cookies and runs no analytics. The web app uses four cookies, all strictly necessary for signing in:

• A sign-in token that lasts one hour.
• A token that renews it, which lasts 30 days.
• A copy of your basic profile so pages open signed in, which lasts 30 days.
• A five-minute cookie used while you sign in by scanning a QR code.

There are no advertising, analytics or tracking cookies. Our hosting provider, Vercel, keeps standard request logs (IP address, browser and page requested).

2. How we use your information

• To provide unsend. We use your information to deliver your messages, emails and calls; to keep your conversations in sync across your devices; to send notifications; to show your profile to the people you talk to; to find your contacts on unsend; and to run search. This also covers the parts of the service you choose, such as stickers, wallpapers, GIFs and link previews.
• To sort and summarize email (see section 3).
• To keep accounts safe. This means verifying sign-ins, sending security notices, approving sign-ins between devices, limiting repeated attempts, and preventing abuse of invitations, signups and text-message codes.
• To deal with spam and abuse. We decide which first messages go to message requests using simple rules about the account and the message (for example, how new the account is). We also review reports and enforce our Terms of Service.
• To understand and improve unsend. We use the first-party, aggregate analytics described in section 1.6, plus error and performance reports (see section 6).
• To provide support, and to send you service messages such as welcome and security notices.
• To comply with the law and to protect the rights and safety of our users and others.

We don't use your information for advertising. We don't build advertising profiles, and we don't use your content to train AI models.

3. Email sorting and summaries (OpenAI)

To separate personal mail from business and promotional mail, and to show short summaries, unsend sends some incoming email to OpenAI. OpenAI processes it on our behalf.

• What is sent: the sender's address, the subject and the text of the email (for sorting, up to about 5,000 characters).
• Which emails:
  • Incoming email from businesses and organizations. This means senders on company domains, not personal email providers like Gmail. It excludes mail that our own rules already recognize as personal.
  • Email identified as promotional, to summarize it.
  • Calendar and meeting invitations from any sender, to summarize the event.
• What is never sent:
  • Your chats.
  • Your calls.
  • Email you send.
  • Replies between people.
  • Email from people using personal email providers, apart from calendar invitations.
• Why: to put each email in the right place in your inbox, and to give you a short summary of promotional mail and invitations.

This processing is part of how unsend's email works and currently happens automatically. If you object to it, contact us (see section 9). OpenAI may not use this content to train its models, and may keep it only for a limited time under its terms with us. Summaries are produced automatically and may contain mistakes. Checks for phishing and spam run on our own servers and don't use AI.

4. Encryption, and what it does and doesn't mean

4.1 Messages and email

• In transit. Everything between your apps and our servers is encrypted, and so are the connections between our own servers, with one exception: the short hop from our load balancer to our application server, inside our private network at Amazon Web Services.
• At rest. Your data is stored encrypted under keys managed in AWS Key Management Service. On top of that, the text of messages and emails, subjects, reply previews and attachment names are encrypted again by our application. Each conversation has its own key, and that key is itself protected by AWS KMS.

This is not end-to-end encryption. Our servers hold the keys so they can deliver, sync and search your messages, send notification previews, handle email and investigate abuse. Unsend Inc can therefore technically access your content. We limit that access:

• Only our application can use the message key.
• Any staff access to a person's content goes through an audited tool that requires a stated reason.
• Such access is listed for you in the app, under Security & privacy checkup.

Some information is not encrypted by our application, though it is still encrypted on disk and in transit:

• Names and email addresses in message headers.
• Who you talk to, and when.
• Reactions and read receipts.
• Group names.
• Your profile, contacts and devices.

Email that travels between unsend and other email providers is protected only as far as standard email allows. It is encrypted on the way when the other provider's server supports it, and once it leaves unsend, the recipient's provider handles it under its own policies.

4.2 Photos, videos and files

Media is stored encrypted, in a private storage location, and delivered only through signed links that expire: links to attachments after 24 hours, and links to profile photos and group icons after 7 days. Anyone who has such a link can open it until it expires.

4.3 Calls

Voice calls, video calls and screen sharing are encrypted with AES-256-GCM using a new key for every call. Our calling provider, Agora, relays the encrypted audio and video but cannot decrypt it. The key is created and held by our servers and sent only to the call's participants, so calls are not end-to-end encrypted either. We don't record calls, and nothing on our side joins your calls.

Agora does see the information it needs to connect a call: IP addresses, the call's channel name, a numeric participant identifier, and call-quality statistics.

4.4 On your devices

Each app keeps a copy of your conversations on your device so it works offline. That copy is protected by your device's own security, such as its passcode and storage encryption, and by App Lock if you turn it on. unsend does not add a separate layer of encryption to it, except for sign-in tokens, which we keep in the device's secure storage.

Signing out removes the copy from the device. In a web browser, some images and pages you viewed may remain in the browser's cache after you sign out. Clear your browser's site data for web.unsend.app to remove them, especially on a shared computer. On Android, unsend's data is excluded from device backups. On Apple devices, your device backup may include the app's local data.

5. What other people see

• Your profile. Your username, name and profile photo are visible to people you talk to. Anyone on unsend can find you by username unless you turn on Hide from search. People who have your phone number in their contacts can find you on unsend.
• Your activity. Others may see your online status and last seen, depending on your privacy settings. If you hide yours, you can't see other people's. People you chat with see your typing indicator, your reactions, and when they've delivered or read their messages to you.
• Your messages and emails. These go to the people you send them to. They can save, forward or screenshot them. Email you send goes to the recipients' email providers.
• Their copies stay. When you delete your account, or delete a message only for yourself, the people you talked to keep their own copies of the conversation. In those copies your name is replaced with "Deleted user", but your former email address stays on emails so their conversations still make sense.

Your privacy settings also include who can message you directly and whether new sign-ins can be approved from your devices.

6. Service providers and other recipients

We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We use the following providers to run unsend. Each may use your information only to provide its service to us, or, where noted, to answer a request your device makes to it directly.

• Amazon Web Services (United States, us-east-1). Hosts our servers, databases, file storage, encryption keys and backups.
• Vercel. Hosts the web app and website. All web app traffic passes through Vercel's servers, including your messages on their way to and from our servers.
• Twilio. Sends and checks the text-message codes used for phone verification, phone-number sign-up and account recovery. Receives your phone number.
• Agora. Carries voice calls, video calls and screen sharing. Receives the encrypted media, IP addresses, channel names, numeric participant identifiers and call-quality statistics.
• Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging). Deliver notifications and incoming calls to your devices. Receive your device's notification token and the notification itself:
  • Notifications include the sender's name and, unless you turn notification previews off in the app, a preview of the message or email.
  • With previews off, the text is replaced by "New message" or "New email", but the sender's name is still included.
  • Call notifications include the caller and the details your device needs to join the call, including that call's encryption key.
  In browsers, notifications travel through the browser maker's push service (for example Google, Mozilla or Apple), encrypted so that only your browser can read them.
• OpenAI. Sorts and summarizes some incoming email, as described in section 3.
• Sentry. Receives error reports from our servers. We have turned off the collection of user details, IP addresses, cookies and request contents.
• New Relic. Receives performance measurements from our servers, with request contents, cookies and sign-in headers excluded and personal data filtered out.
• GIPHY. Provides GIF search. In the iPhone, iPad, Mac and Android apps, your device sends the words you search for directly to GIPHY, which also sees your IP address. In the web app, our server sends the search, so GIPHY doesn't see your IP address. No unsend account information is sent.
• Brandfetch and our sender-icon provider. Supply logos for businesses that email you. Only the sender's domain (for example, example.com) is sent, never your address or the sender's full address. When your device loads a logo, the provider also sees your IP address.
• Unsplash. Supplies wallpaper photos. Your searches go through our servers. When a photo loads, your device fetches it from Unsplash, which sees your IP address.
• Have I Been Pwned. Used only when an older account signs in with a password, as described in section 1.2.

Some features also connect you directly to other services:

• Link previews. To show a preview of a link, the iPhone, iPad, Mac and Android apps fetch the page from your device, so that website sees your IP address. The web app fetches it through our server instead. Previews of Instagram links are fetched by our servers.
• Images in email. Images stored on other servers are blocked by default in every unsend app. If you choose to load them, the sender may learn your IP address and that you opened the email.
• Device features. On Apple devices, calls can appear in the Phone app's Recents, and unsend can suggest conversations through Siri. These stay under Apple's control and settings.

We may also disclose information:

• When the law requires it, in response to valid legal process.
• To protect the safety, rights or property of our users, the public or Unsend Inc.
• As part of a merger, acquisition or sale of assets, in which case we will tell you before your information becomes subject to a different policy.
• With your permission.

7. How long we keep information

We keep your account and content until you delete them or delete your account, unless the table below says otherwise.

Information we must keep for legal reasons, or to resolve disputes or investigate abuse, may be kept longer, but only for as long as that reason applies.

8. Download your data and delete your account

Download

In the app, open Security & privacy checkup ▸ Your data ▸ Download a copy of your data. We prepare a file with your profile, contacts, chats, emails and call history, with attachments included as links. You can request one copy a day. For information not included in the file (such as your devices or sign-in history), email us.

Delete

In the app, open Security & privacy checkup ▸ Your data ▸ Delete account, or use Delete account at the bottom of Settings. You confirm with your passkey or recovery PIN (or, on an older account, your password). Your other devices are signed out straight away. If you sign in again within those 7 days, or choose to cancel, the deletion is cancelled. If you no longer have the app, see web.unsend.app/delete-account or email support@unsend.app.

After 7 days we delete:

• Your profile, and your copies of your messages, emails and call records.
• Media that only you had.
• Your contacts, sign-in history and devices.
• Your passkeys and recovery PIN.
• Your stickers and wallpapers.
• Your mailbox.

Some things stay after deletion:

• Other people keep their copies of conversations with you (see section 5).
• A placeholder record, without your name, phone number or photo, stays so that their conversations keep working.
• Your username stays reserved.
• Usage records, invitation records and the record of staff access are kept as described in section 7.
• Deleted data can remain in encrypted backups for up to 12 months, until those backups expire. We don't restore deleted accounts from backups.

9. Your rights and choices

Wherever you live, you can:

• See and correct your profile in Settings.
• Download your data and delete your account, as described in section 8.
• Control who sees your last seen and online status, who can find you in search, and who can message you.
• Turn notification previews off.
• Turn sign-in requests off.
• Block people and email addresses.
• Sign out other devices.
• Turn off contacts access, camera, microphone and notifications in your device settings.

To make any other request, email support@unsend.app. We'll need to confirm the request comes from the account holder. Usually we do this by asking you to write from your unsend address or to confirm the request in the app. You can authorize someone else to make a request for you; we'll ask for proof of that authorization. We won't treat you differently for using your rights.

9.1 If you are in the European Economic Area, the United Kingdom or Switzerland

You have the right to:

• Access your personal data.
• Have it corrected or erased.
• Restrict or object to how we use it.
• Receive it in a portable format.
• Withdraw consent at any time, where we rely on consent. This doesn't affect anything done before you withdrew it.

We rely on the following legal grounds:

• Performing our contract with you, to provide unsend. This covers delivering your messages, emails and calls, syncing, notifications, and email sorting.
• Our legitimate interests in keeping unsend secure, preventing spam, fraud and abuse, and understanding usage in aggregate. In each case we have weighed these interests against your rights.
• Your consent, for contacts access and the other device permissions you grant.
• Legal obligations.

We will answer within one month. You can also complain to your local data protection authority.

9.2 If you live in California or another US state with a privacy law

In the past 12 months we have collected the following categories of personal information, from you, your devices and the people who communicate with you, for the purposes in section 2:

• Identifiers: name, username, email address, phone number, device identifiers and IP address.
• Customer records.
• Internet and other electronic network activity: app usage, and records of sign-ins and devices.
• Approximate location: the country, derived from your IP address.
• Audio and visual information: voice messages, photos and videos.
• Inferences limited to email categories: whether an email is personal or promotional.
• Sensitive personal information:
  • Account sign-in credentials: passkeys and the recovery PIN, which we store only as a public key or a hash.
  • The contents of your messages and email, which we use only to provide the service.

We disclose these categories to the service providers listed in section 6, for the purposes described there.

We have not sold or shared personal information for cross-context behavioral advertising, and we don't knowingly sell or share the information of anyone under 16. We use sensitive personal information only for purposes the law permits, so the right to limit its use does not apply.

You have the right to:

• Know what we collect, use and disclose.
• Delete it.
• Correct it.
• Not be discriminated against for using these rights.

Because we don't sell or share personal information for advertising, there is nothing to opt out of. We answer requests within 45 days. Residents of other US states with similar laws have comparable rights, including the right to appeal a decision on their request by replying to our answer.

10. International transfers

We are based in the United States, and our servers are in the United States (Amazon Web Services, us-east-1). Some of our service providers process data in other countries. If you use unsend from outside the United States, your information is transferred to, stored in and processed in the United States, where data protection laws may differ from yours. Where the law requires, we protect these transfers with safeguards such as the European Commission's Standard Contractual Clauses.

11. Security

We use these protections:

• Encryption in transit and at rest, with message content also encrypted by our application under keys held in AWS KMS.
• Encryption keys that rotate every year, with each use recorded in an audit trail.
• Backups encrypted before they leave the database server.
• Private media storage with links that expire.
• Passkey sign-in, which leaves us no passwords to steal.
• Limits on repeated sign-in and code attempts.
• Security notices for every new sign-in.
• Staff access to content only through an audited tool, which is shown to the affected person.
• Server logs that contain no message content.

No system is perfectly secure, and unsend is not end-to-end encrypted (see section 4). Keep your devices locked, review your devices and passkeys in Settings, and consider adding a recovery PIN. unsend will never call or message you asking you to approve a sign-in. If we learn of a security breach that affects your information, we will notify you and the authorities as the law requires.

12. Children

unsend is not for children under 13, and you must be at least 13 to create an account. If you are older than 13 but under the age at which you can consent to data processing where you live, you may use unsend only with the permission of a parent or guardian. We don't knowingly collect personal information from children under 13. If you believe a child under 13 has an account, email support@unsend.app and we will delete it.

13. Changes to this policy

We will post any change on this page and update the date at the top. If a change materially affects how we handle your information, we will also tell you in the app before it takes effect.

14. Contact us

Unsend Inc
66 Mineola Ave, Roslyn Heights, NY 11577, USA
Email: support@unsend.app