addressed.me privacy policy

Last updated: 2026-11-04

What addressed.me is

A Windows app, made by addressed.me, that protects files with Windows Hello and addresses them to the people you name. Protecting and opening your own files happens only on your PC: the files themselves, their contents and their passwords are never sent to us. The data we do receive is described below.

Sharing a file

When you share a protected file, the addressed.me share service (run by us on our own server, with Cloudflare in front of it) stores: a random ID for the share, the file's name, the email addresses you named, any end date you set, and one piece of the file's key. Anyone holding the file or its link sees the file's name and the addresses in masked form before signing in (a short link's preview card shows more, below; a BCC file names no recipient at all), and the name appears in the notices we email you, which go through Microsoft 365, so Microsoft handles those addresses and names. If you add a voice, video or text message, it also stores the message's kind, its length, one piece of its key, its digest and, for a link's message, its ID in your Drive. The service cannot open the file: that piece is useless without the file, which you send yourself.

When you send a short link, the service also stores its short code, the Drive ID of the file on your Drive, and the file's kind (a PDF, say), so the link can find the file. The preview card a chat shows for a short link is made for that link from what the service holds. While the file can be opened, anyone who sees the card can read your full address and, if the file has one recipient, that person's full address; with several recipients it shows only how many. Before its opening date, after its end, once its opens are used up, or once revoked, the card names nobody. A card a chat already shows stays as that chat saved it.

On Pro you can choose what a link's browser tab and its card's first line say. If you do, the service stores that choice with your account, including your own words if you wrote some, and anyone who has the link can read it before signing in. Either way your address shows in the tab and in the browser history of whoever opens the link. A card with your choice doesn't name the recipient. Delete my data deletes the choice.

A send from the current app has a short reference, a random label that opens nothing. With a BCC send the service stores the list of people as you sent it, the reference, the hint you typed, and the one domain everyone shares, if they do. Nobody who gets the file sees the list, but the service holds it and you see it. Each person gets one email saying you added them, with your address and the reference, sent through Microsoft 365 with everyone in BCC, so Microsoft handles those addresses. To limit these emails the service keeps each address's SHA-256 hash, with no salt, for a day. An unsalted hash is not secret: anyone who already has an address can check it against the hash.

Sending as another address

If you ask to send as another address, the service stores that address with your account, whether it has said yes, when you asked and when it said yes. An address that hasn't said yes is deleted after 7 days. An address says yes by signing in as it with Google or Microsoft, once, in the app; that way the service sends the address no email. The sign-in is checked and discarded, and the service keeps no account ID from it. If the address says no, the service keeps your account and the address's unsalted hash for 90 days, so you can't ask it again in that time. Files you sent as that address then name your main address.

A link you pass on to someone so their address can say yes isn't open yet. When it is, pressing Yes after signing in also mails that address a record of it, with a link to take it back, through Microsoft 365, and the yes counts only once that mail has gone. That link works while the address sends for you and for 7 days after. A no from someone who hasn't signed in ends only that link, and we keep nothing about the address for it.

The service also keeps counts that name no address: each plain mail it sends (only the time, for a day), each mail that failed (the kind and the time, for 7 days), and each sign-in that broke on our side or the provider's (the kind and the time, for 7 days).

When someone opens the file at go.addressed.me/open, they sign in with Microsoft or Google so the service can check the email address. For each try, by someone you named or not, the service stores the time, the email address, the IP address it came from, its country, and the browser and system type, and shows that list to you, the file's owner. It also keeps the Google or Microsoft account ID of each person's first open, so the address can't be handed to another account. Sign-in tokens are checked and then discarded, never stored.

To slow down abuse, the service counts requests per IP address (an IPv6 address by its /64) in its memory, for ten minutes at a time (for new plays of a message, for a day); these counts are not stored. Two limits are kept in its database instead: link requests (below) by IP address for an hour, and early-access signups by IP address for a minute; each is deleted once it is that old, when the next one comes in. Cloudflare, in front of our server, also limits requests per IP address. The service's running log names people only in masked form and holds no IP addresses.

This data is kept until you ask us to delete it, or until the time you set in the app's settings runs out after a file ends (off unless you set it). Taking someone off a share stops their access at once but keeps the record of their past opens for the owner.

What the founders can see

The two founders of addressed.me can see your account in our back office: your address, your plan and where it came from, the day you first signed in and the day you were last active, how many PCs and how many files you have, the date of your last send, and your payments. They read problem reports you send us, including anything you type in them, and can open a report's masked log with one click. They also see the addresses on the tester and early-access lists.

The back office doesn't show file names, who you sent to, or who opened what. Every look at an address and every change there is logged. A look at a whole list is logged as that list. That log names addresses in full; looks are kept for 6 months and changes for 24 months.

We use this to run the service, help you when you ask, and keep it safe. The founders, and the tools they run, can also reach the server itself for maintenance.

If we give you Pro, we mail you when we do, shortly before it ends, and when it ends. We don't send the last two if you pay for Pro or used "Delete my data", and we don't send the last one when we take Pro back without telling you. "Delete my data" doesn't remove a Pro you were given until it ends. We keep a record of every change made in the back office, including Pro we gave or took back, for 24 months; "Delete my data" removes the looks at your address and replaces your address in the kept changes with a one-way hash. Each of those changes is also mailed to the founders when it happens, naming the address. Those mails stay in their mailboxes until they delete them, and you can ask us to delete them.

Plays of a message

If the sender added a message, the share service notes when someone plays a voice or video message or reads a text one: for a signed-in recipient, their email address, the time and how far they played it; for anyone not signed in, only the time, how far they played it, the country, the browser type, and a random id that browser keeps for that file. No IP address is kept with a play. Plays are shown to the file's owner and kept with the file's opens.

Other records the share service keeps

When someone asks a sender for a link from the request page, the service keeps the time, the note they wrote, the IP address and the country, and tells the sender. For each of your PCs it keeps a public key, your Google or Microsoft account ID and the PC's TPM model, and it keeps the file-type icons your PCs send for the dashboard. If you pay for Pro, Paddle is the seller and takes the payment; we keep your email address, Paddle's customer and subscription IDs, and your plan's status and dates. For 30 days after you start a checkout we keep its Paddle transaction ID with your address, even after Delete my data, so a payment you already made still reaches your account. We never see your card.

If you ask for early access on addressed.me, we keep your email address and the time on the early-access list. During the alpha, testers' email addresses are also on a list that lets them buy Pro. To leave either list, email us (below).

Microsoft and Google sign-in on the open page

The open page asks Google for the email address and the fact that it is verified (openid email), and Microsoft for those and its basic profile sign-in (openid email profile). The service reads the email address and the account's permanent ID, and stores them as this page says. Nothing else from the account is read or stored.

Google Drive

addressed.me asks you to sign in to Google once. It asks Google for your email address and two Drive permissions: drive.appdata, a hidden folder that belongs to addressed.me in your Drive, and drive.file, the files addressed.me itself puts in your Drive (the files and messages you send as links). It cannot see, read or change any of your other Drive files.

addressed.me backs up every file password to the hidden folder. For each protected file, that folder holds one small record: a random tag that identifies the file, the file's name, its password and the date it was protected. The record is stored by Google under your account and is read back only by addressed.me on your PC, when you ask it to recover a file's password. The hidden folder also holds addressed.me's own copies for the files and messages you send and, when you use Check my PC, each sent file's folder and name, whether the original is unchanged, and a small preview of it, encrypted with a key the share service keeps for you and gives only to your PCs and your dashboard. The service never receives the previews.

The Google sign-in is kept on your PC, encrypted for your Windows account. It is never sent anywhere except to Google, and, so the share service knows who the sender is, to the share service.

Google user data

addressed.me's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from your Google Drive is used only to back up and recover your file passwords, to keep, share and remove the files and messages you send, and to show them on your dashboard. It is not sold, not shared with anyone and not used for advertising, and neither is your sign-in address sold, or used for advertising. No person reads the contents of your Drive backups and files. In the back office, the founders see only your sign-in address from Google, and no data from your Google Drive.

Windows notifications

The addressed.me icon in the Windows tray can show notifications about your files: someone tried to open one with an account not on the list (naming that account), someone asked for a link, an address said yes to you sending as it (naming that address), or a file was changed from your other PC. They come from the records the share service already keeps for your files, described above. So it can tell you of a yes it missed while off, the app keeps the addresses that said yes on your PC. No new data is collected or sent for them.

Updates

The app checks our server, go.addressed.me, for a newer version, and when there is one it asks you to update or updates itself. The request carries no account and nothing about your files. As with any web request, our server and Cloudflare see the PC's IP address and the time, so they can tell that addressed.me runs there. Our service keeps no record of these requests.

Checking the page that opens a file

The page that joins a file's two key halves comes from our server. After each deploy we publish its SHA-256 at app.addressed.me/hashes.txt, on a host that server doesn't run. To check a page, download it, hash its bytes and find the hash in that list. The list keeps history, so it's the page's newest line that counts. A short link's page adds that link's own card and target, so it has no line of its own: check the same page at the address the list names.

Reporting a problem

When you send a report from the app's report window, the app sends our service the message you write and the app's version, your Windows version and whether you are on Pro. Unless you untick it, it also sends the end of the app's log from your PC: a list, with times, of the steps the app took, counts and error messages. The app masks the log on your PC before sending it: file names and folder paths (only a file's extension stays), other people's email addresses, your Windows user name, keys, tokens and IDs are replaced. Your own email address is kept. Show what is sent shows exactly what goes. The log never holds the contents of your files. We delete a report 180 days after it is sent. A copy of the report, with your address and message but not the log, also goes to our mailbox on Microsoft 365, and stays there until we delete it; email us (below) and we will.

Removing your data

In the app's dashboard, Delete my data deletes the share service's records of you (your files, their opens and plays, link requests, your PCs, your other senders, your problem reports except their mailbox copies), your address on other accounts' sender lists, the groups and sender choice on that PC, and addressed.me's message files on your Drive and its own copies in your Drive's hidden folder. A report from the last 24 hours stays as an empty row (your address and the time) until it is a day old, so the daily limit on reports still counts it. It does not remove your Pro payment record, your address from the early-access and testers' lists, or a no from an address you asked to send as, which stays for up to 90 days so it can't be asked again. A Pro you were given, the back office's kept changes and the founders' mail copies stay as What the founders can see says. The service's daily backups still hold deleted records until they are 30 days old, then they are deleted too.

Remove addressed.me's access at myaccount.google.com/permissions, or under Google Drive > Settings > Manage apps. Removing it from Manage apps deletes the hidden folder and every backed-up password in it, so files whose passwords you don't have elsewhere can then be opened only on a PC whose Windows Hello still holds them.

To delete a share or its open records from the share service, email us from the address involved (below); we delete it within 30 days. If an account sent a file as your address, your address and your opens go, and that account keeps its own copy.

Contact

Questions: privacy@addressed.me