Privacy Policy

Last updated: September 29, 2026

SendBond Inc. ("SendBond", "we", "us") operates Notebond, an encrypted messaging app, and the SendBond Outlook add-on (together, the "Service"). This policy explains what we collect, how long we keep it, and who else touches it.

1. Information we collect

Everything below is linked to your account and used only to provide the Service. None of it is used for advertising or tracking.

  • Account information: the name (first and last) and email address you give at registration, plus a password (stored only as a salted hash via ASP.NET Core Identity). If you turn on SMS-based message protection (available in the SendBond Outlook add-on), we also store the mobile number you verify for it.
  • Device information: when you activate the app on a device, a per-app device identifier (on iPhone, Apple's identifierForVendor), the device type, and the device's public encryption key. We use these to secure requests from that device and to enforce your plan's device limit.
  • Recipient email addresses: when you send a protected message, the recipient's address is sent to us so we can find their account and issue the key for that message. We don't build contact lists from them.
  • Message keys: for each message you send, we keep the key needed to open it, the message identifier, the sender's and recipient's account IDs, and when it was sent and first opened — only for the limited time described in Retention below.
  • Usage and quota data: how many messages you've sent this month, referral codes you've issued or used, and your subscription/device-tier status.
  • Purchase history: if you subscribe via the App Store, we verify the transaction with Apple and keep its transaction IDs, product, expiry date and an app-account token so we can confirm your subscription is active. We never receive your payment details; Apple handles them directly.
  • Bot-protection signals: Cloudflare Turnstile may collect signals during login to the administrator portal to distinguish humans from bots.
  • Diagnostics: when something goes wrong in the app, it sends us an error report so we can find and fix problems. A report contains the error type or code, the feature it happened in, the app version, your iOS version and device model, the network type (Wi-Fi, cellular or offline), whether the app was in the foreground or background, a random per-launch session identifier, a timestamp, your plan status and remaining monthly quota, and, for failed sends only, the number and approximate total size of attachments. Reports are linked to your account ID. They never include message content, subjects, contacts, other people's email addresses, file or attachment names, passwords, keys or tokens.

2. Information we don't collect

  • Message content and attachments are encrypted on your device and never pass through our servers. We only hold the keys that unlock them, for a limited time.
  • Your address book: the app may read your contacts on your device to suggest recipients, but they are never uploaded to us.
  • No advertising, analytics or tracking: the app contains no advertising or analytics SDKs, we don't use your data for advertising, don't track you across other apps or websites, and don't sell your data.

3. How we use it

To create and secure your account, deliver and encrypt your messages, enforce free-tier usage limits and referral bonuses, verify subscriptions with Apple, enforce per-account device limits, send you transactional email/SMS, diagnose and fix errors in the app, and prevent abuse. We use diagnostic reports only for app functionality — not for advertising or tracking.

4. Retention — read this if you care about keeping a message

Message keys are kept only for a limited window, then permanently deleted. Without its key, a message can no longer be opened by anyone:

  • Once a message is opened, its key is deleted 24 hours after it was first opened.
  • If a message is never opened, its key is deleted 60 days after it was sent.

Once a key is deleted, we cannot recover it — there is no backup copy. If you want to keep something long-term, save it to your device (e.g. your Vault) before these windows close.

Diagnostic error reports are kept for 90 days (about three months) and then automatically and permanently deleted. While they exist, they are visible only to SendBond administrators.

Account information, device registrations and subscription records are kept for as long as your account exists, and deleted when you delete it (see Account deletion below).

5. Who we share data with

  • Mailjet — transactional email delivery.
  • Apple App Store Server API — subscription status verification (transaction ID, environment, app-account token only).
  • Twilio — SMS delivery, only if you turn on SMS-based message protection (your mobile number and the one-time code).
  • Cloudflare — Turnstile bot protection on the administrator portal login.
  • Railway — our infrastructure host (application servers, PostgreSQL database, Redis cache), hosted in the EU.

We do not sell your data.

6. Account deletion

You can delete your account at any time in the app (Settings → Account → Delete Account) or by emailing support@sendbond.com from the address your account is registered with. Deletion is immediate and permanent. It removes:

  • your profile and login (name, email address, password hash, roles);
  • all your registered devices and their encryption keys;
  • your personal protection keys and the email addresses registered to your account;
  • the keys for messages sent to you;
  • your quota, referral and subscription records;
  • your error reports and sign-in refresh tokens.

Keys for messages you sent to other people are not deleted with your account, so your recipients can still open those messages. They are deleted on the normal schedule described in Retention above (at most 60 days).

Deleting your account does not cancel an App Store subscription: cancel it with Apple in Settings → [your name] → Subscriptions. Accounts managed by a company (corporate accounts) are deleted through that company's administrator.

7. Referral program

If you invite someone and they confirm their account, we record that confirmation against your account to calculate a monthly referral bonus. We do not share the referred person's identity with you beyond a count.

8. Your rights

You can request a copy of your account data, or its correction, by emailing support@sendbond.com. You can delete your account yourself at any time — see Account deletion above.

9. Children's privacy

The Service is not directed at children under 13, and we do not knowingly collect data from them.

10. International transfers

Our infrastructure runs in the EU (Railway, EU West region); by using the Service you consent to your data being processed there.

11. Changes to this policy

We'll update the "Last updated" date and, for material changes, notify you in-app or by email.

12. Contact

support@sendbond.com — see also our Support page.