Sarand MessengerPrivacy Policy
In short
- Your messages stay on your phone. We run no message server and never receive your SMS, MMS, Bale or Eitaa messages.
- No account with us. Your Bale and Eitaa sign-ins go straight to Bale and Eitaa, and stay on your phone.
- No ads. We don't sell your data or use it for advertising.
- What reaches us is limited to: downloading the list of bank and company senders; reports of business senders shown without a logo (sender names, short codes and SMS-panel numbers, never a person's number); and, through Google Firebase, crash reports and basic usage statistics.
1. Who we are
Sarand (package com.weekend.sarand) is an Android SMS app that can also show your Bale and Eitaa chats. It is made by Sarand App Studio and published by Turned On Digital (“we”, “us”). This policy covers the Sarand app as distributed on Google Play, Cafe Bazaar and Myket, its server at backend.sarand.net, and this website. For Sarand, it takes the place of Turned On Digital's general privacy policy.
2. Your messages
SMS and MMS
Sarand works as your phone's default SMS app. It reads and saves your texts in Android's own SMS and MMS store on your device, and sends them through your mobile carrier, like any SMS app. Sarand also keeps its own data on your device, such as conversation settings, blocked senders and the spam filter's results.
Bale and Eitaa
If you add your Bale or Eitaa account, you sign in with your phone number and the code Bale or Eitaa sends you. The sign-in and everything after it goes directly between your phone and Bale's or Eitaa's own servers, over encrypted connections. Your session is stored only on your device. Messages, photos, voice messages, link previews and profiles come from their servers and are kept on your device. What you send and receive through Bale or Eitaa is handled by those services under their own terms and privacy policies. Signing out of an account in Sarand, or uninstalling Sarand, removes its session from your device.
Spam filter
The filter that sets advertising texts aside runs entirely on your device. Your messages are not sent anywhere to be checked.
Backups
SMS backups you make in Sarand are saved as files on your device; where they go from there is up to you. If Android's own backup is turned on, Android may include Sarand's database (its copies of your texts and your Bale and Eitaa messages) and its settings in your Google account's backup. Your Bale and Eitaa sign-in sessions are never included: Sarand keeps them in a part of its storage that Android's backup always leaves out. That backup is run by Android and Google under your Google account settings, not by us.
3. Bank and company names and logos
To show the names and logos of banks and companies that text you, Sarand downloads the whole list of such senders (their names, sender IDs and numbers) from our server, backend.sarand.net. It does this every 10 days and after the app is updated. Sarand then compares the list with your conversations on your phone, and downloads only the logos of the senders it found there. No phone numbers, messages or contacts are sent to us for this.
Like any web server, ours sees the IP address each request comes from and which file was asked for, including which logos are downloaded. These access logs are kept for 14 days for security and troubleshooting, and are not combined with any other data.
4. Reports of senders without a logo
To learn which senders to add to the list, Sarand reports business senders that it shows without a name or logo. When you open a conversation with a sender that has no name or picture in your contacts and isn't in the list yet, Sarand sends that sender's address to backend.sarand.net:
- What is sent: only a sender name (like
MyBank), a short code, or an SMS-panel number. A 10-digit number is sent only if it starts with 1000, 2000, 3000 or 5000, as bulk-SMS panel numbers do. - What is never sent: a person's phone number (mobile or landline), numbers from abroad, message text, your contacts, or any device, account or user identifier.
- How often: at most once every 5 days for each sender.
- What we keep: a count of reports per sender per day, without IP addresses. Reports are deleted after 5 days.
5. Contacts
Sarand reads your contacts on your device to show names and pictures in your conversations and to suggest recipients. Sarand never uploads your contacts to us.
Bale and Eitaa can show which of your contacts use them. For this, Sarand sends your contacts' names and phone numbers to Bale or Eitaa, as their own apps do, only after you agree in a dialog. You can decline and still use Sarand.
6. Crash reports and usage statistics
The store versions of Sarand include two Google Firebase services, which Google runs for us as a service provider:
- Firebase Crashlytics sends a crash report when Sarand crashes: technical details of the crash, the device model, Android and app versions, the time, and a random identifier of the installation. Sarand doesn't send its log lines or any message content to Crashlytics.
- Firebase Analytics collects only Firebase's automatic events: the first time the app opens, sessions and time in the app, screen views, and app updates. These come with the app version, device model, Android version, language, country or region, and a random identifier of the app installation. Sarand sends no events of its own. Collection of the advertising ID is turned off, and ad personalization is disabled.
Google keeps Crashlytics reports for 90 days, and Analytics data for at most 14 months. See Privacy and security in Firebase and Google's Privacy Policy.
7. Purchases
Sarand Pro is bought through Google Play, Cafe Bazaar or Myket billing. The store handles the payment, so we never see your card or bank details. The store tells the app that the purchase is valid, so Sarand can unlock Pro. Each store's own privacy policy applies to the payment. Sarand shows no ads, and nothing about you is used for advertising.
8. Permissions
Android lets you allow or deny each of these, and you can change your mind any time in Android's settings.
| Permission | What Sarand uses it for |
|---|---|
| SMS and MMS | To be your SMS app: show, send and receive your texts and MMS. |
| Contacts | To show names and pictures, suggest recipients, and, if you agree, find your contacts on Bale or Eitaa (see section 5). |
| Phone | To tell your SIM cards apart on dual-SIM phones, and to call someone from a conversation when you tap Call. |
| Notifications | To tell you about new messages. |
| Photos, videos and audio | To attach media to a message, and to save media you receive. |
| Microphone | To record a voice message, only while you record it. |
| Location | Only when you share your location in a chat. Android asks first, and “Only this time” is enough. |
| Alarms and reminders | To send scheduled messages on time. |
Sarand doesn't need the camera permission: taking a photo opens your camera app. Android also grants a few permissions without asking, such as internet access, starting after a restart (to keep scheduled messages), vibration, and running in the foreground while sending, syncing or playing a voice message.
9. Who we share data with
We don't sell or rent your data. Data leaves your phone only as described above:
- Google (Firebase), for crash reports and usage statistics (section 6).
- Google Play, Cafe Bazaar or Myket, for purchases (section 7).
- Bale and Eitaa, for what you send through them, and your contacts if you agree (sections 2 and 5).
- Authorities, only if the law requires it, and only data we actually hold (sections 3, 4 and 6).
10. How long data is kept, and deleting it
| Data | Where | Kept |
|---|---|---|
| Messages, Bale and Eitaa sessions, Sarand's settings | Your device | Until you delete them, sign out, or uninstall Sarand |
| Reports of senders without a logo | Our server | 5 days |
| Web server access logs | Our server | 14 days |
| Crash reports | Google Firebase | 90 days |
| Usage statistics | Google Firebase | At most 14 months |
Sarand has no accounts, so the little data we hold isn't linked to your name. To delete everything Sarand keeps on your device, clear its storage in Android's settings or uninstall it; uninstalling also resets the identifiers Firebase uses. To ask us to delete any other data, email hello@turnedondigital.com.
11. Security
Sarand talks to our server only over HTTPS, and to Bale and Eitaa over their encrypted connections. On your device, Sarand's data is protected by Android's app sandbox; a screen lock keeps it safe if your phone is lost. No system is perfectly secure, but we keep what we hold to a minimum.
12. Children
Sarand isn't directed at children under 13, and we don't knowingly collect personal data from them. If you believe a child has sent us personal data, contact us and we'll delete it.
13. Your rights
Depending on where you live, for example in the European Economic Area, the UK or California, you have the right to ask what personal data we hold about you, and to have it corrected or deleted. You can also object to or restrict its use, and withdraw your consent. You can also complain to your data protection authority. We don't sell personal information, and we won't treat you differently for using these rights. To use them, email us; we may need to confirm the request is yours.
14. This website
sarand.net uses no cookies, no analytics and no content from other sites. Its home page is in Persian when your device's time zone is Tehran's, and in English otherwise; if you pick a language with the switch at the top, your browser remembers it in its own storage, and the choice is never sent to us. The web server keeps access logs (IP address, time, page, browser) for 14 days for security.
15. Changes to this policy
If we change this policy, we'll post the new version on this page and update its date. Significant changes will also be mentioned in the app's release notes.
16. Contact us
For privacy questions and requests, email hello@turnedondigital.com.
This policy is also available in Persian.