Skip to content
Sendoff
Join

Sendoff

Privacy policy

Last updated October 26, 2026

Sendoff is a native Mac app. You drop a file on the notch, or the menu bar icon, and name who it is for. It arrives on the channel that recipient prefers. This policy explains the permission each service gets, what stays on your Mac, and what this website collects.

The short version

  • Sendoff connects to each service with the smallest permission that can send what you start.
  • Gmail is send-only. iMessage uses Messages on your Mac.
  • It sends only when you drop a file and name who it is for.
  • It cannot read your inbox.
  • Tokens are stored in the macOS Keychain on your Mac.
  • The app runs on your Mac. Files go directly from your Mac to the channel you pick: Gmail sends through Google, and iMessage through Messages.
  • Sendoff runs no file relay of its own.
  • The waitlist stores your email address, the signup time, the page section you used, how you found the site (campaign tags in the link, the referring page, and the page you landed on), whether you ticked the optional beta-tester box, and your answer if you tell us who you would send to first. It is kept in a private store and holds nothing about the files you send.

Who we are

Sendoff makes the Sendoff Mac app and this website. For privacy questions, write to privacy@getsendoff.app. For everything else, hello@getsendoff.app.

Each channel

You pick the channel for each send. Sendoff runs on your Mac and connects to that service directly, with a minimal send-only permission, and hands the file over: Gmail sends through Google, and iMessage through Messages. To make sending feel instant, the upload can begin while you are still choosing. For Gmail, that upload goes to Google. Sendoff runs no file relay of its own. We do not receive the file.

  • Gmail. One scope, gmail.send, to send the message you start. The details are in the Google user data section below.
  • iMessage. The Messages app on your Mac sends the file. Sendoff does not create an iMessage account, and it does not ask for a token that leaves the Mac.

Google user data

This section is the description of Sendoff's use of Google user data for the OAuth consent screen and for Google's verification of the app.

  • Sendoff requests only the gmail.send scope, so it can send the file you chose to the person you picked.
  • It never reads, stores, or shares your email.
  • Your Google tokens stay in your Mac's Keychain. Files go straight from your Mac to Google, with no Sendoff server in between.

Sendoff's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we request

When you connect Gmail, Sendoff uses Google OAuth and requests a single scope:

https://www.googleapis.com/auth/gmail.send

Google classifies gmail.send as a sensitive scope. Sendoff does not request restricted Gmail scopes, including gmail.readonly, gmail.modify, gmail.compose, or mail.google.com, and it does not request any other scope that would let the app read, draft, or manage your mailbox.

How we use it

The gmail.send scope is used for one thing: to send an email that you start.

You start a send by dropping a file on the notch or the menu bar icon, or by using the Share extension or the Finder hotkey, and then choosing a saved destination or pressing its number. Sendoff builds that message on your Mac. The attachment is the file you chose. The recipient is the person or service you saved. An optional note you type is included where that destination expects it. The message is then sent through the Gmail API from your Mac, from your Gmail address.

Sendoff does not send mail in the background, on a schedule, or by watching a folder.

What we never do with Google user data

  • We do not read your inbox, sent mail, drafts, or labels.
  • We do not list your messages or download them.
  • We do not modify or delete anything in your mailbox.
  • If you allow it, Sendoff reads your Mac's Contacts on your Mac to find people's email addresses and phone numbers. Your contacts never leave your Mac and are never uploaded to us.
  • We do not use Google user data for advertising, retargeting, or credit decisions.
  • We do not sell Google user data.
  • We do not use Google user data to train machine learning models.
  • We do not let Sendoff staff, or anyone else, read your Google user data. The send happens on your Mac. We do not receive a copy of the message or the file.
  • We do not transfer Google user data to a Sendoff server. Sendoff runs no file relay of its own.

When the channel is Gmail, the message goes to Google, because that is how Gmail sends mail, and then to the recipient you chose. You pick them. iMessage does not pass through Gmail.

Where the token is stored

Google access tokens and refresh tokens are stored in the macOS Keychain on your Mac. They are not written to a Sendoff server, and they are not part of the waitlist. Sendoff has no user accounts.

Signing out of Google inside Sendoff deletes the token from the Keychain. You can also revoke Sendoff at any time from your Google Account permissions at myaccount.google.com/permissions. If you revoke access, Sendoff cannot send until you connect Gmail again.

Limited Use

As stated above, Sendoff follows the Limited Use requirements of the Google API Services User Data Policy. Gmail uses only https://www.googleapis.com/auth/gmail.send.

  • We use Google user data only to provide the user-facing send feature: you choose a file and a destination, and Sendoff sends that message.
  • We transfer Google user data only as needed to provide that feature: to Google, so Gmail can send the message, and to the recipient you selected. We do not transfer it for advertising.
  • Humans do not read your Google user data. There is no dashboard where we can open your mail or your files. We do not allow humans to read it unless you explicitly ask us to for support, it is required for security, it is required to comply with the law, or the data is aggregated and used for internal operations in line with Google's policy.
  • We do not use Google user data to serve advertisements, including retargeting, personalized, or interest-based advertising.
  • We do not use Google user data to determine credit-worthiness or for lending.

Local data on your Mac

Sendoff stores these on your Mac, not on our servers:

  • Destinations you save: a name and the channel they prefer.
  • A sent log with the date, file name, recipient, and status, so you can resend or reveal the file in Finder.
  • The Google token, in the Keychain.

Files you send are read from disk so they can be attached. They are not uploaded to Sendoff. You can delete a destination or the sent log in the app. Removing the app and signing out removes the token from the Keychain. Copies of messages Gmail has already sent remain in your Gmail Sent folder, under Google's control.

This website

The marketing site is separate from the Mac app.

If you join the waitlist, we store the email address you submit, the time you submitted it, and a short source label, such as the page section you used. We also store how you reached the site: the utm_source, utm_medium, and utm_campaign tags if the link you followed had them, the address of the referring page (without its query string), and the path of the first page you opened. Your browser keeps those values in session storage until you close the tab, and they are sent only when you join. After you join, you can optionally answer “Who would you send to first?”, and that answer is saved with your signup. If you tick “I'd like to beta test”, we save that choice with your signup so we can invite you to the beta. We use that list to tell you when the trial opens. We do not sell it, and we do not add you to an unrelated mailing list.

If you buy Sendoff, Lemon Squeezy processes the payment and emails the license key. This site stores the order record Lemon Squeezy sends to our webhook: the event, your email, the order id, the amount, and, when Lemon Squeezy sends it, the license key. We do not store your card number, and we do not store the files you send from the Mac app.

The waitlist is stored by the host of this site. In production that is a private Vercel Blob store, so the address is not readable from a public URL, or Neon Postgres or Upstash Redis when those are configured instead. In local development it is a JSON file on the machine running the site.

We rate-limit signup attempts. That check uses your IP address for a short window, in memory or in Redis, and then discards it. We do not build a profile from it. Our host may keep ordinary request logs.

The site uses Vercel Web Analytics and Vercel Speed Insights to count page views and measure page speed. Vercel describes both as cookieless; they report aggregate visits, referrers, and performance, not who you are. The site does not use advertising cookies, and the waitlist form does not set a cookie. While we test two headlines on the /join page, that page sets one first-party cookie, so_join, for 60 days so you keep seeing the same version. It holds only “a” or “b”. If you join from that page, the version you saw is saved with your signup. To delete your waitlist address, email privacy@getsendoff.app.

Sharing

We share personal information only in these cases:

  • With the infrastructure that hosts this website and the waitlist, under our instructions.
  • With the service you chose, Gmail or iMessage, when you send a file from the Mac app.
  • If the law requires it.
  • If the business is transferred. Google user data remains subject to this policy and to Google's Limited Use requirements.

We do not sell personal information.

Retention

  • Waitlist addresses are kept until you ask us to delete them, or until we no longer need them to announce Sendoff.
  • Order records and license keys sent by Lemon Squeezy are kept so we can support the purchase. Email privacy@getsendoff.app to ask for deletion. A refund still follows Lemon Squeezy's receipt.
  • Rate-limit records last for the length of the limit window, which is minutes, not months.
  • Google tokens and the sent log stay on your Mac until you delete them, sign out, or remove the app.

Security

Tokens are kept in the macOS Keychain, the system credential store. This website is served over HTTPS. If you believe a token was exposed, revoke Sendoff in your Google Account and write to privacy@getsendoff.app.

Children

Sendoff is not directed at children under 13, and we do not knowingly collect their personal information.

Changes

If we change this policy, we will update the date above and post the new version at this URL. The homepage links here, and this is the privacy policy URL for the OAuth consent screen. The terms describe the license for the app.

Contact

Sendoff
privacy@getsendoff.app
hello@getsendoff.app