Privacy Policy

This policy explains what SentIt collects, why, and what you can do about it. SentIt is responsible for your personal information. Contact us at support@sentit.app.

What we collect from senders

• Account: your email address and display name, through our sign-in provider Clerk. If you sign in with Google, Clerk also receives your Google name and profile picture.
• Plan and billing: your plan, Paddle customer and subscription IDs, subscription status and renewal date. Card details go to Paddle and never reach SentIt.
• Deliveries: titles, messages, file names and sizes, and the files you upload.
• Connections: encrypted access tokens for Google Drive or Dropbox, if you connect them.
• Usage: daily counters of uploads and downloads used to enforce plan limits.

Recipients

Recipients do not need an account. Delivery pages set no cookies and use no analytics. Download counts are kept per delivery, not per person. Our own rate limits use the sender or delivery, never your IP address; IP addresses are processed only by Cloudflare’s network security.

Product analytics

On our public and sender pages, we may use PostHog to understand which page categories are visited and when deliveries are published, native uploads finish, or cloud files are attached. We send anonymous analytics identifiers and limited technical information: browser and operating system versions, device type and browser language. Identifiers stay in page memory and are not linked to your account.

We do not send your email, account ID, delivery or file IDs, titles, messages, file names, file contents, share links, query strings or referrers. Recipient pages, custom recipient domains, checkout and authentication callbacks are excluded. Analytics uses no cookies, localStorage or sessionStorage, and we do not enable automatic click tracking or session recording. We respect browser Do Not Track and Global Privacy Control signals.

Analytics requests go to PostHog’s US Cloud service. As with any direct browser connection, PostHog receives network information including your IP address. You can contact us at support@sentit.appabout analytics privacy or deletion; without account-linked identifiers, we may be unable to locate a particular anonymous event.

Cookies

We use only strictly necessary cookies: a security token that protects forms, Clerk’s sign-in session, and a short-lived state cookie while you connect Google Drive or Dropbox. There are no advertising or analytics cookies.

Who processes data for us

• Cloudflare: hosting, file storage, database and network security.
• Clerk: sign-in and its verification emails.
• PostHog: anonymous product analytics on public and sender pages when enabled.
• Paddle: payments, tax and invoicing. Paddle is an independent controller of the payment data it collects.
• Google: when you sign in with Google or connect Google Drive.
• Dropbox: when you connect Dropbox.

These providers may process data in the United States and other countries.

How long we keep it

• Uploaded files are scheduled for deletion 1 day (Free) or 7 days (Premium) after a delivery’s link expires. Cleanup runs periodically and retries failed deletions.
• Account data is kept while your account is active.
• We complete deletion requests within 30 days. Database backups are kept for up to 30 more days.
• Paddle keeps billing records for as long as the law requires.

Your rights

You can ask to access, correct or delete your personal information under Canada’s PIPEDA and, where they apply, the GDPR and UK GDPR. Email support@sentit.app from your account address. You can also complain to the Office of the Privacy Commissioner of Canada.

Security

Traffic is encrypted in transit, provider tokens are encrypted at rest, and files are kept in a private storage bucket. A share link works like a key: anyone who has it can open the delivery.

Children and changes

SentIt is not directed at anyone under 16. We will announce material changes to this policy by email or on this site.