Privacy Policy — SMS Forwarder: Sync & Automate

This policy is issued by LUCIDMAZE, UNIPESSOAL, LDA ("Lucidmaze", "we", "us"), the developer of SMS Forwarder: Sync & Automate ("SMS Forwarder" or "the app"). The app relays messages received on your device to destinations that you configure. This policy explains what data the app handles and where it goes.

1. Data the app handles

2. Where your data is sent

Your messages never pass through a server of ours. Message content leaves your device only to the destinations you set up: an SMS number, an SMTP mail server, a webhook URL, Telegram (via the Telegram Bot API), Slack, Discord, Microsoft Teams (via a Power Automate workflow you create), or a push server (ntfy, default ntfy.sh). Those third parties handle the data under their own policies. Choose destinations you trust.

If you enable two-way replies, the app also contacts the Telegram Bot API to receive replies you write, and sends those replies as ordinary SMS through your carrier.

If you enable the optional heartbeat, a short "still alive" message with no personal content is sent to the destination you choose, on the schedule you choose.

3. What we do not do

• We do not collect, receive, sell, or share your messages, their senders, your contacts, phone numbers or destination addresses.
• The app contains no advertising or crash-reporting SDKs and no third-party analytics. The only thing it sends to us is the anonymous usage statistics described in section 3a, which you can switch off.
• The app does not read your contacts.

3a. Anonymous usage statistics

Once a day the app sends us a small report about how it is being used. It is made up of counts, versions and your phone's model — never any part of a message.

What is sent: the number of messages forwarded and the number that failed, how many forwards you have set up, which destination types you use and how many messages each one handled, the app version, your Android version, your phone's make and model, the app's language and country, and a random install number created on your device. Each install signs its reports with a key created in the Android Keystore, so that nobody else can submit numbers in its name; the public half of that key is sent with the first report.

What is never sent: the text of any message, who sent it, your contacts, your phone numbers, or any destination address, email address, webhook URL, bot token or other secret. The report has no field that could carry message content.

Your network address is used only to limit how often reports can be accepted, while the request is being handled. It is not written to a log or stored.

Switching it off: Settings → Usage statistics. Nothing is sent after that.

Deletion: email support@lucidmaze.co with the install number shown under Settings → Usage statistics, and we will delete that install's records.

4. Permissions

• SMS (receive/read/send) and MMS/WAP push: to capture incoming texts and, if you add an SMS destination, send forwarded texts.
• Notification access (special access, off until you consent): to read the notification text of apps you choose. The app cannot read the private message databases of other apps, only what a notification displays. Whenever this is active, the app shows an ongoing notification telling you it can read your notifications; it carries a Pause button that switches notification reading off immediately. The app will not read notifications at all if that indicator cannot be displayed — for example if you switch off its notification category.
• Foreground service, boot completed, battery-optimisation exemption: to keep forwarding reliable.
• Internet / network state: to deliver to webhooks, email, Telegram and push destinations.

5. Your controls

You can disable forwarding, revoke notification consent, delete recipients (which erases their stored secrets), clear history, or uninstall the app at any time, which removes all app data. Exported configuration files never contain passwords, tokens or auth headers.

Two-way replies are off unless you enable them for a specific destination. When enabled, only sender IDs you allow can trigger an SMS, replies are limited per hour, a reply must refer to a specific forwarded message, and you may require a confirmation word or PIN.

6. Security

Secrets — SMTP passwords, bot tokens and webhook authentication headers — are stored using Android's encrypted storage, and are never included when you export your configuration.

Three destination types let you type in your own server address: webhooks, the ntfy push server, and your SMTP mail server. For each of them, the app refuses to send anything unencrypted unless you explicitly allow it for that one destination — a setting that is off until you turn it on, and that warns you at the moment you do. For a webhook or push server that means a plain http:// address; for email it means sending without TLS, which would expose your message and your mail password. Telegram, Slack, Discord and Teams are always encrypted, and the app rejects any other kind of address for them.

7. Appropriate use

Use the app only for your own messages and your own destinations. Do not use it to monitor another person. If someone else asked you to install this app, be careful — it may be part of a scam.

8. Age requirement

This app is intended for users aged 13 and over. It is not directed at children under 13, and we do not knowingly collect data from anyone under 13. The app sends no data to us in any case; all message data stays on your device or goes only to the destinations you configure.

9. Changes

We will post updates to this page and change the date above.

10. Contact

support@lucidmaze.co