Is DroidSender safe?

What the app can and cannot do on your phone

DroidSender has one job: sending the messages you send from the dashboard or the API, and bringing the texts your phone receives into your inbox. It reads your phone's contacts only to show names in your conversations, and copies your contact list to your account only if you turn that on. It never reads your calls or call log, never uses your location, camera, photos or microphone, does not look at your other apps, does not replace your messaging app, and carries no ads or analytics. The only outside service inside the app is Google's push service, which wakes it up to send. Every permission it asks for, and why, is listed on the Android app page.

While a phone is connected, every SMS it receives and every message you send from DroidSender appear in your DroidSender inbox. To also see the texts typed in the phone's own messaging app, turn on “Import older conversations” in the app, and all your conversations are in one place on your computer.

Why you install it from droidsender.com, and how to check it

Google Play only lets an app send and read SMS if it is your default messaging app or fits one of a short list of exceptions. DroidSender works alongside your messaging app instead of replacing it, so it is installed from droidsender.com. You can check it yourself:

• The developer is verified by Google, and Google Play Protect scans the app like any other.
• Every version is signed with the same key. SHA-256 fingerprint of the signing certificate: 63:BB:E0:FB:8C:09:E8:91:1C:76:27:69:DF:C6:67:03:0D:EE:CC:BC:D4:87:5F:BB:8E:8E:EF:69:A2:22:C7:37
• The app checks the SHA-256 of every update before installing it.

Android shows a warning for apps installed outside the store. That warning is expected.

Where your data is stored

Messages travel over HTTPS and are stored on servers in the European Union, under the GDPR. To reach your phone, each outgoing message passes through Google's push service, and campaign text goes through the scam check. For the contact lists you upload and the messages you send, you are the controller and DroidSender is the processor. Your data is used only to run your account. You can ask us to delete your account at any time, and your data is deleted within 30 days. A data processing agreement is available on request. Payments go through Stripe, so your card details never reach DroidSender. The full list of providers, and where each one is, is on the subprocessors page.

Can DroidSender be used for scams?

Not easily. Before a campaign sends its first SMS, the text is checked for obvious fraud, such as messages pretending to be a bank, a delivery company or a government office, fake fines or refunds, "Hi mum, this is my new number", or requests for codes, card details or passwords. Suspicious campaigns are held and reviewed by a person before anything is sent, and we block accounts used for fraud. When someone replies STOP, their number is blocked for that account automatically. Anyone who receives an unwanted SMS sent through DroidSender can report it.

If you change your mind

The free plan needs no card. Paid plans can be cancelled at any time, and in the first 30 days you can ask for a full refund, no questions asked. If you ask us to delete your account, your data is deleted within 30 days.