SMS capture
Inbound messages arrive in bounded batches, deduplicated per device so a retry never creates a second copy — or a second forward.
Android gateway · SMS · Notifications · Calls
Your phone already receives everything.
Now it can route it.
A native Android agent captures SMS, app notifications and call events, hands them to an encrypted API, and forwarding rules deliver them to Telegram or your own signed webhook — with retries, health alerts and a full audit trail.
No card required. Pair one device and write your first rule in minutes.
- capture sources on one handset
- 3capture sources on one handset
- pairing code lifetime
- 10 minpairing code lifetime
- message bodies at rest
- AES-256-GCMmessage bodies at rest
- 01HandsetForeground service
- 02OutboxDurable on device
- 03APIEncrypted ingest
- 04RulesMatch & route
- 05TelegramChat or channel
- 06WebhookHMAC signed
Nothing is dropped when the network is: the outbox drains with backoff.
01The problem
The messages that matter are trapped on one device
One-time codes live on one SIM
The person holding the handset becomes a bottleneck for every sign-in, every verification, every deploy that needs a code.
Alerts arrive where nobody is looking
Bank notifications, delivery updates and app alerts sit in a notification tray on a phone in a drawer instead of reaching the channel your team actually reads.
Passing the phone around is not an integration
Screenshots in a group chat have no history, no filtering, no retries and no record of who saw what.
02How it works
Four steps from a spare phone to a working gateway
Pair the device
Generate a one-time pairing code in the dashboard, enter it in the Android app, and the handset receives its own credential. The code expires in ten minutes and can be used once.
Let the agent capture
A foreground service watches inbound SMS, app notifications and the call log. Everything is written to a durable on-device outbox first, then drained to the API with backoff — a dead network delays delivery, it does not lose it.
Write a forwarding rule
Match on sender, body text, exclusions or one-time codes only. Scope a rule to a single device, order rules by priority, then send a test message through the target before you rely on it.
Watch and audit
Every device reports battery, connectivity and heartbeat. Pairings, forwards, failures and token rotations all land in an activity log you can filter by type, device and date.
03Features
Everything the gateway does
Built as one product: Android agent, API, worker and dashboard.
Rule engine
Priority-ordered rules matching on sender, body, exclusions or OTP-only, optionally scoped to one device, each with a one-click test send.
App notifications
A notification listener captures alerts from any app, with the same encryption, deduplication and routing as SMS.
Call events
Incoming, outgoing and missed calls with number, contact label and duration. Metadata only — call logs are never forwarded.
Telegram delivery
Route matched messages straight into a Telegram chat or channel — the fastest way to get a code in front of a team.
Signed webhooks
HTTPS endpoints receive platform events signed with a per-endpoint HMAC-SHA256 secret, subscribe to the event types they want, and keep a rotatable secret.
Health & alerts
Battery-low fires once rather than on every heartbeat, and a scheduled sweep marks silent devices offline — both as events you can forward.
Delivery log
Every outbound attempt records its status code, attempt count and error, so a broken endpoint names itself instead of failing quietly.
Fleet & organizations
Run many handsets under one account, group work into organizations with member roles, and rotate or revoke a device credential on its own.
Analytics & automation
Volume and failure trends over time, plus automation runs — so you find out that forwarding stopped before your users do.
Operator console
Staff get a separate, deliberately different back-office for support work. It reads metadata only, and every action it takes is written to an append-only audit log.
Self-hostable
The whole stack ships as Docker images with a Compose file, nginx, Prometheus, Alertmanager and Grafana — or one file for a Dokploy rollout.
04Security
Built for data you would not hand to a stranger
Message content is the most sensitive thing this product touches, so the architecture assumes it.
Encrypted at rest
SMS and notification bodies are encrypted with AES-256-GCM before they are stored. Plaintext is never written to a log.
One-time codes are never stored
A code is detected so a rule can match on it, then discarded. It exists in memory long enough to route, and nowhere else.
Staff cannot read your messages
The operator console shows senders, statuses and timings, and masks call numbers. The decryption key is never applied on that path — support tooling cannot see content, by construction.
Device credentials are not stored
Only a domain-separated HMAC-SHA-256 of each device secret is kept. Rotating a token invalidates the old one immediately.
Sessions that expire and rotate
Fifteen-minute access tokens, a rotating refresh token in an httpOnly SameSite=Strict cookie, and replaying a used token revokes its whole family.
Outbound requests are constrained
Webhook URLs must be public HTTPS — private and internal addresses are rejected — and every delivery carries an HMAC signature you can verify.
05Why teams use it
What you get out of it
Nothing is lost in a tunnel
The on-device outbox plus queue retries mean a message captured offline still arrives — late, not never.
One screen for every handset
Battery, connectivity, last heartbeat and message history for the whole fleet, instead of walking over to a phone.
It fits what you already run
Signed webhooks and a documented REST API put these events into your own systems; Telegram covers the cases that just need a human to see a code.
Your data stays yours
Run it on your own infrastructure with the published Compose stack, and no message ever leaves hardware you control.
06Pricing
Start free, grow by device
Plans are metered on the things that cost capacity: paired devices, forwarding rules and webhook endpoints.
Free
One handset, to prove it works
Free
- Paired devices
- 1
- Forwarding rules
- 3
- Webhook endpoints
- 1
Pro
A small fleet and real routing
$9/ month
- Paired devices
- 5
- Forwarding rules
- 25
- Webhook endpoints
- 10
Business
Departments, tenants and volume
$29/ month
- Paired devices
- 25
- Forwarding rules
- 200
- Webhook endpoints
- 50
Indicative pricing. Amounts are confirmed when a payment is verified, and a self-hosted deployment can run in open mode with no payment step at all.
Every plan includes
- SMS, notification and call capture
- Telegram and signed webhook delivery
- Encrypted message storage
- Device health alerts and activity log
- Bilingual dashboard, light and dark
- The Android app and REST API
How payment works
Pick whichever route suits you — activation is the same either way.
PayPal or Sham Cash
Pay, upload the receipt from the Plan & Usage page, and an administrator verifies it. Your plan and activation update automatically on approval.
Stripe
A deployment can switch to Stripe, where subscription lifecycle events update the plan directly through verified webhooks.
Open mode
Self-hosting for yourself? Run with billing disabled and every account is fully active from registration.
07Questions
Before you sign up
Do I need a dedicated phone?
It works on a phone you already use, but a spare handset on a charger is the usual setup: it stays online, its notifications are only the ones you care about, and nobody picks it up mid-capture.
Which permissions does the app need?
SMS access for messages, notification-listener access for app alerts, phone state and call log for call events, and permission to run a foreground service so Android does not stop it. Grant only the ones you intend to use.
Can you read my messages?
No. Bodies are encrypted before storage and the staff console never applies the decryption key — it shows senders, statuses and timings only. Decrypted content is returned to the account that owns it and to nobody else.
What happens when the phone loses connection?
Captures go to a durable on-device outbox first. When connectivity returns the agent drains it with backoff, and duplicate submissions collapse into one stored message and one forward.
Does Telegram delivery work with channels?
Yes — a rule's Telegram target accepts a numeric chat id or an @channel username, and a test send confirms delivery before you depend on it.
Can I self-host it?
Yes. The repository ships Docker images and a Compose stack with nginx, Prometheus, Alertmanager and Grafana, plus a single-file variant for Dokploy.
How do I move to a bigger plan?
Submit a payment proof from the Plan & Usage page. Once an administrator approves it, your plan, its limits and its expiry update without any further step.
Pair a device and route your first message today
The free plan is enough to see the whole path end to end — capture, rule, delivery, audit.