Privacy policy
Who is responsible
The data controller for Message from Beyond (also referred to as Messages from Beyond) is Niedling Szabolcs, sole trader (egyéni vállalkozó), Rózsa u. 61., 7361 Kaposszekcső, Hungary; tax number 58655070-1-37; registration number 56344080. For privacy questions, access requests or deletion requests, contact sabiniedling@gmail.com. This policy covers the Android app and the service at https://beyond.sabster.hu. The Terms of Service are available at https://beyond.sabster.hu/terms.html. Last updated: 20 October 2026.
Information you provide
We process your account name, email address and a password hash; message titles, subjects and contents; recipient names and email addresses; the contacts (names and email addresses) you choose to save for reuse; check-in intervals, deadlines and status; file names, sizes and uploaded contents; optional release links; and support messages. Passwords are transmitted over HTTPS for verification and are not included in support emails. Enter recipient details only when you have a lawful reason to use them. Do not upload information you are not entitled to share.
Device and service information
The app stores your authentication token in Android secure storage and remembers your language. Our server stores authentication-session records, notification registration tokens, language preferences, check-in and message activity, delivery attempts and recipient receipt confirmations. Hosting and email systems may record IP addresses, timestamps, errors and delivery metadata to operate and protect the service. Google Firebase processes installation identifiers, FCM registration tokens and technical information such as IP addresses to provide notifications. We do not request access to your phone contacts, location, camera, microphone or entire file library.
Subscriptions through Google Play
New accounts can create and edit messages, recipients and attachments free of charge for 30 days from registration. After that, creating and editing requires an active subscription. In the Android app, Google Play handles the purchase and payment interface. We send Google Play a pseudonymous identifier for your Message from Beyond account to link the purchase to that account. Our server verifies the purchase with Google and stores its purchase-token hash, encrypted purchase token, product and plan identifiers, subscription status, expiry, renewal and acknowledgement status, and verification timestamps linked to your account. We use these records to verify, restore and display your subscription across the service. We do not receive or store your payment-card details. These records remain while your account exists and are removed with the account, subject to the retention exceptions described below; Google maintains its own transaction records under its policies. A Google Play subscription renews automatically until you cancel it in Google Play. Deleting your app account does not cancel a Google Play subscription; manage or cancel it in Google Play.
Subscriptions through PayPal
On the website you can subscribe through PayPal instead. We link the PayPal subscription to your Message from Beyond account using a pseudonymous account identifier and store the PayPal subscription and plan IDs, status, payment identifiers, payment times, amounts and currency, verified period end, verification time and checkout request identifier. We verify status with PayPal and use authenticated PayPal notifications to keep the website and app in sync. We do not collect payment-card details or PayPal passwords. These records are removed when the account is deleted, subject to the retention exceptions in this policy; PayPal maintains its own transaction records under its policies. A PayPal subscription renews automatically until cancelled through the website subscription page or your PayPal account; deleting a Message from Beyond account alone does not cancel an external subscription.
Subscription or free trial expiry and automatic deletion
If your subscription or your 30-day free trial ends and you do not subscribe, a two-month continuation period starts. During it you can still sign in, check in, pause messages and request deletion, but you cannot create or edit messages, recipients or attachments. Messages that are already active keep running and can still be released. If you do not subscribe by the end of the continuation period, we email you about 30 days and again at least 7 days before deletion, and then permanently delete your account, stored messages, recipient records, saved contacts, uploaded files, authentication sessions, notification registrations and subscription records. Messages that have not been released by then are deleted without being sent to their recipients. Subscribing at any time before deletion keeps your account.
Why we use it
We use this information to authenticate you, manage your messages and attachments, calculate deadlines, send reminders, release messages to recipients according to your instructions, record delivery confirmations, answer support requests and prevent abuse. Where GDPR applies, processing necessary to provide the service is based on performance of our agreement with you; service security and handling recipient details rely on legitimate interests in operating the requested service, subject to your rights. We process data to meet applicable legal obligations when required. Optional notification delivery is under your control through Android notification permission and settings. We do not use your message contents for advertising.
Recipients and service providers
Your chosen recipients receive the message and any release link when the configured release conditions are met. Their email providers and any external file-link provider may also process that information. Processors acting on our behalf: HostingBazis Bt. (Mándoki út 40., 4642 Tornyospálca, Hungary) hosts the website, the database and the uploaded attachments; Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) delivers emails; Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) delivers push notifications through Firebase Cloud Messaging. Google Play and PayPal (Europe) S.à r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg) process payments as independent controllers under their own privacy policies. A push notification may include a message title, status, deadline or identifier and may be visible on a locked screen. We do not send the full stored message body or uploaded file to Firebase for push delivery. Our support mailbox receives contact and deletion requests. We may disclose information when legally required or necessary to investigate abuse and protect users.
Storage and international processing
Account records and messages are stored on the service database; uploaded attachments are stored separately using the configured file-storage provider. Transfers between the app and the website use HTTPS; the service uses TLS for managed file-storage connections. This is not end-to-end encrypted storage: the operator and providers involved in delivering the service may access information as needed. Google and other providers may process data outside your country. Where applicable, international transfers require a valid legal mechanism and appropriate safeguards. Ask sabiniedling@gmail.com for details of the providers and safeguards applicable to your data. Google describes its processing at https://firebase.google.com/support/privacy.
File access and permissions
Uploading uses Android’s system file picker: you choose the specific file to share. Downloading uses Android’s Save as dialog: you choose where a file is saved. These actions give access to the selected file or destination and do not require permission to browse all files on your phone. Temporary transfer copies may be created in private app/server storage. Downloaded files you choose to save remain under your control and are not removed when you delete an account. Notification permission is optional; denying it does not prevent use of the other app features.
Retention
We retain account information and stored messages while your account exists and they are needed to provide your configured service. Uploaded files remain until removed, replaced or deleted as part of account deletion. Accounts whose subscription or free trial lapsed are deleted automatically after the continuation period, as described above. We retain service activity and delivery records as needed to operate and investigate the account’s deliveries. Support records are retained while resolving the request and for a proportionate follow-up period; we review them for removal when no longer needed. Security logs and backups follow the relevant provider’s retention schedule. Deletion from live systems may precede expiry of backup copies; backups must not be used to restore deleted accounts into active service. Invoices and accounting records of website (PayPal) payments are kept for 8 years as required by Hungarian accounting law, separately from the deleted account. Information required for a legal obligation or dispute may be restricted and retained only for that purpose. Contact us for the retention schedule applicable to your records.
Your choices and deletion
You can edit your profile and messages, manage recipients, delete messages or uploaded files, pause messages and turn off notifications. To request deletion of your account and associated data, open Menu > Profile > Delete account in the app, visit https://beyond.sabster.hu/delete-account.php, or email sabiniedling@gmail.com from your account address with the subject Account deletion. We may verify your identity to prevent unauthorized deletion. The support request does not immediately delete or pause the account; pause active messages if you do not want them released while the request is being processed. Deletion covers your account, stored messages, recipient records, uploaded files, authentication sessions and notification registrations, subject to any retention explained above. Copies already delivered to recipients, external links and files saved on your devices cannot be recalled by us.
Privacy rights
Where applicable law gives you these rights, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Send requests to sabiniedling@gmail.com. We respond within the period required by applicable law, normally one month under GDPR, and explain any permitted extension. You may complain to the data-protection authority where you live, work or believe a breach occurred. Supervisory authority in Hungary: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), Falk Miksa utca 9-11., 1055 Budapest; postal address: 1363 Budapest, Pf. 9.; ugyfelszolgalat@naih.hu; www.naih.hu.
Children and important limits
This service is intended for adults (18+) managing their own private messages. It is not designed for children. If you believe a child has provided information, contact us so we can investigate and remove it where appropriate. The service is not an emergency service, a will or a guarantee of delivery. Network, device, email or service failures can delay reminders and deliveries. Keep independent records and check your deadlines rather than relying only on push notifications.
Changes
We may update this policy when the service or its processing changes. The updated policy will show a new date and will be available in the app and on the website. Material changes will be communicated through the service where appropriate.