Privacy policy
Effective 2026-09-27. Applies to the Shadow Clone Android app (package systems.hardin.smsforward), the forwarding relay and this website. Operated by Hardin Systems, New Orleans, Louisiana, USA. Contact: [email protected].
The short version
Shadow Clone forwards your text messages to an email address you choose. To do that, the message has to pass through our relay. It passes through; it is not kept. We do not run ads, analytics or tracking of any kind, in the app or on this site.
What the app can access, and why
- SMS (RECEIVE_SMS, READ_SMS). To see incoming texts, and — only if you turn on “messages I send” — to notice outgoing texts in the phone's SMS store. The app never sends SMS itself and never deletes or edits one.
- Notifications (optional, off by default). If you enable “RCS / chat messages”, the app reads notifications posted by your messaging app (Google Messages, Samsung Messages) because RCS is not otherwise readable. You grant this in Android's Notification-access settings; you can revoke it there at any time. The app ignores notifications from every other app.
- Internet. One HTTPS connection to our relay per forwarded message, plus the licence activation call. The internal Hardin build can also post to Telegram or a Discord webhook you configure; those go directly to those services.
- Foreground service and boot. Watching for messages you send needs a small background service (Android requires a visible notification for it). It starts at boot only if you had it switched on.
Not requested: contacts, call log, location, storage, camera, microphone, phone state.
What leaves your phone
For each message you have chosen to forward: the sender (or recipient) number or name, the timestamp, the message text, and the destination email you configured. It is sent over TLS to sms.hardin.systems, authenticated with a per-licence token that is generated when you activate and stored on the phone in Android's encrypted preferences.
What the relay does with it
The relay turns the message into an email from [email protected] and hands it to our mail server (also operated by us) for delivery to your address. The message text is not written to disk, database or log on the relay. The relay logs one line per forward — time, licence key, destination address, mail-server message id — so we can answer support questions. Those logs rotate and are deleted after 30 days. Standard mail-server logs (envelope addresses, delivery status) are kept for the same period.
Once the email is delivered, the copy in your inbox is governed by your email provider's policies, not ours.
Licence and purchase data
When you buy, Stripe processes the payment. We never see your card number. Stripe sends us the email address you entered and a payment reference; we store those with your licence key, its status, the activation times, and a per-day count of forwarded messages (used to enforce the 300-per-day limit). Stripe's own handling of your data is described in Stripe's privacy policy.
This website
Static pages behind Cloudflare. Standard web-server access logs (IP address, page, time, browser string) are kept for 30 days for security. No cookies are set by us; no third-party scripts run except Stripe's hosted checkout page, which you reach by pressing Buy.
Sharing
We share nothing with advertisers or data brokers. We disclose data only to deliver the service (our mail server, Stripe for payment) or when the law requires it.
Your choices and rights
- Turn any forwarding path off in the app at any time; uninstalling stops everything.
- Ask us to delete your licence record and logs: email [email protected] from the purchase address. Deleting the record ends the licence. You can also use our general form at hardin.systems/delete.
- Ask what we hold about you; we answer within 30 days.
Children
Shadow Clone is not directed at children under 13 and we do not knowingly collect their data.
Changes
If this policy changes materially we will post the new version here with a new effective date and note it in the app's release notes.