Privacy policy

Last updated 12 October 2026

Resano moves the text messages your Android phone receives to your own computers and fills verification codes into your browser. It is built so that nobody else, including us, can read them. This page covers the Android app, the desktop apps, the browser extensions and the relay at api.resano.app.

What stays on your devices

Message text, senders and codes are stored only on your phone and on the computers you linked to it. They are encrypted on the phone with AES-256-GCM before they leave it, using keys that only your devices hold. You can delete them in the apps at any time.

What the relay sees

Your devices exchange encrypted messages through our relay. It keeps each encrypted message for the retention period you choose in the app (by default 1 day for verification codes and 30 days for other messages, at most a year), up to 5,000 per vault, so a device you add later can catch up. It cannot decrypt them. It also keeps the random device identifiers and hashed access tokens your devices use. A vault with no activity for 180 days is deleted, and removing the last device deletes the vault and its messages. Your network address is used to limit abuse and may appear briefly in server logs. There are no accounts, names, phone numbers, contacts, analytics or advertising.

The browser extension

The extension talks only to the Resano desktop app on the same computer (127.0.0.1). On the pages you visit it looks for verification-code fields so it can offer and fill a code; it does not read page content beyond form field attributes and labels, and it sends nothing from the page anywhere. It stores its pairing token and your display options in the browser.

Updates and downloads

The apps check resano.app for new versions. Like any website, resano.app sees the address and browser details of requests it serves.

Sharing

We do not sell, share or transfer your data. We have no access to the content of your messages to share.

Contact

Questions: apps@imvx.org.