Privacy Policy
Your screenshot or text is sent to an AI provider to write the reply and is not kept by us afterwards. We store your email only if you sign in. Payments go through Stripe; we never see your card. The sendthis.one website shows an ad unit from Adsterra on return visits, which may set a pseudonymous ad cookie, and uses Monetag for optional push-notification ads and one clearly labelled sponsored "Partner offer" link in the footer (section 4). No analytics trackers, no selling data. You can delete your account in the app at any time.
1. Who we are
sendthis.one ("sendthis.one", "we", "us") operates the sendthis.one website and app, a service that generates suggested replies to conversations. Contact: support@sendthis.one.
2. What we collect and why
| Data | When | Why | Kept |
|---|---|---|---|
| Screenshot and/or typed situation | Each time you tap Generate | Sent to an AI provider to produce the reply | Not stored by us. Processed in memory and discarded once the reply is returned. |
| Email address | If you request a sign-in link or start a 72-hour pass | Sign-in, syncing your plan and credits across devices, receipts | Until you delete your account |
| Account record (plan status, generation counter, pass start time, Stripe customer id) | Once you sign in | Enforcing free-tier limits, the one-pass-per-email rule and paid access | Until you delete your account |
| IP address | Every request | Rate limiting and stopping abuse of the 72-hour pass | Rolling 24 hours for pass limits; short-lived in-memory counters otherwise |
| Payment details | If you subscribe | Billing | Handled entirely by Stripe. We receive a customer id and payment status, never your card number. |
| Operational logs | Sign-in, purchase and account-deletion events | Troubleshooting and fraud prevention | Rotated on a short schedule |
Apart from the Adsterra ad unit and the Monetag components described in section 4, we do not run advertising or analytics trackers. We do not sell or rent personal information, and we do not use your conversations to train AI models.
3. AI processing
To generate replies, the content you submit (image and/or text, plus your chosen persona and mood) is sent over an encrypted connection to a third-party AI provider, currently Anthropic. Depending on configuration the request may instead be handled by OpenAI or Google. These providers process the content on our behalf under their API terms, which prohibit using API inputs to train their models. Do not submit content you are not comfortable sharing with an AI provider, and remove other people's personal details from screenshots where you can.
4. Cookies and on-device storage
- Session cookie (
st_sess): set only after you sign in. HttpOnly, secure, expires after 90 days or when you sign out. - Local storage: your free-generation counter, pass expiry, paid flag and weekly bonus credit are kept in your browser or app so the service works without an account. They never leave your device except to sync with your own account. The website also stores a marker that you have visited before, used only to keep your first visit ad-free.
- Advertising (Adsterra): the sendthis.one website shows one ad unit (an Adsterra "Social Bar") served by Adsterra, a third-party ad network. It is not loaded on your first visit to the site from a given browser, and never on the account-deletion page. Adsterra states that its script may place a cookie in your browser and that it processes pseudonymous information tied to browsing events: a pseudonymous user id, your device or browser user agent, timestamps, ad impressions and ad clicks. Adsterra states that it does not collect or store personally identifiable information such as your name, email address or billing details. We do not pass your email, account record or conversation content to Adsterra. See Adsterra's privacy policy and cookies policy. Blocking or clearing cookies in your browser removes the Adsterra cookie.
- Advertising (Monetag): the sendthis.one homepage uses two components from Monetag, a third-party ad network. Push notifications (Monetag zone 11926889): the homepage loads a Monetag script that registers a service worker at
/sw.jsand may ask your browser for permission to show notifications. Nothing is sent unless you click "Allow"; if you do, Monetag can deliver advertising notifications to that browser, including when the site is not open, until you revoke the permission in your browser's site settings. The service worker and any permission are stored by your browser, not by us. Sponsored "Partner offer" link: the homepage footer carries one plain link, labelled "Sponsored", that opens a Monetag-selected third-party advertiser site in a new tab. It only does anything if you deliberately click it; it is not part of sendthis.one, we do not choose or control the destination, and the destination site's own privacy policy applies there. We do not use pop-unders, click-triggered redirects or any other Monetag format, and we do not pass your email, account record or conversation content to Monetag. Monetag states that it processes pseudonymous browsing data (a pseudonymous id, device or browser user agent, timestamps, impressions and clicks).
Apart from the Adsterra advertising cookie and the Monetag service worker and notification permission described above, no third-party cookies or third-party browser storage are set.
5. Service providers
- Anthropic / OpenAI / Google: AI reply generation (section 3).
- Stripe: subscription billing. See Stripe's privacy policy.
- Resend: delivery of sign-in link emails.
- Vercel and our own servers: hosting.
- Adsterra: advertising on the sendthis.one website (section 4). See Adsterra's privacy policy.
- Monetag: push-notification advertising and the sponsored Partner offer link on the sendthis.one homepage (section 4).
- Apple App Store: if you install the iOS app, Apple processes the download and any in-app purchase under Apple's terms.
Each provider receives only what it needs for its job. Data may be processed in the United States.
6. Deleting your data
Open MENU → Account → Delete account (step by step). Deletion is immediate: any active subscription is cancelled, your account record and email are erased, and you are signed out everywhere. One thing survives: a one-way, keyed hash of your email address with no readable email attached, used only so the same mailbox cannot claim a second free 72-hour pass. You can also email support@sendthis.one from the address on the account and we will delete it for you.
7. Your rights
Wherever you live, you can ask us to access, correct, export or delete the personal information we hold about you, or object to how we use it, by emailing support@sendthis.one. We answer within 30 days. California residents have these rights under the CCPA/CPRA; we do not sell or share personal information for cross-context advertising, so there is nothing to opt out of. Residents of the EEA, UK and Switzerland have the equivalent rights under the GDPR and may complain to their local supervisory authority. Our legal basis for processing is performance of our contract with you (providing the service) and our legitimate interest in keeping the service secure.
8. Security
All traffic is encrypted in transit (HTTPS). Session tokens are signed and cannot be forged. Payment data never touches our servers. Access to account data is limited to what is needed to run the service. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.
9. Children
sendthis.one is not directed to anyone under 18 and we do not knowingly collect personal information from children. If you believe a minor has provided us information, contact us and we will delete it.
10. Changes
We may update this policy. The effective date at the top changes when we do, and material changes are announced in the app before they take effect.