Last updated: October 20, 2026.
Message487 forwards selected notifications and new incoming SMS to a webhook you configure.
Notification events can include titles, text, image attachments and optional avatars or app icons.
SMS events include text, sender and time. Events also include a string channel identifier: the
Android notification channel ID, sms for SMS, or test for test events. Your n8n workflow or another HTTPS receiver decides
how to process or forward these events; the app does not depend on Telegram.
Both capture sources are off by default. Notifications require Android notification access and
selection of source apps. Optional automatic selection of newly detected launcher apps is off by default;
when enabled, it runs when you open or return to Message487 and preserves manual exclusions.
SMS forwarding requires the receive-SMS permission.
The app does not read existing SMS history, send SMS, or reply to notifications.
The app stores your webhook URL, editable device code, confirmation preference, enabled sources, selected and previously detected package names, the automatic-selection preference, duplicate-filter preference, pause state, notification image format/quality and limits, avatar/app-icon forwarding preferences and a random installation ID in private preferences. These preferences do not have additional application-level encryption. A webhook URL may itself contain a secret, so treat it as sensitive. Android cloud backup and device transfer are disabled for app data.
The webhook Bearer token is encrypted with AES-GCM and an Android Keystore key before being saved in preferences. It is sent in the Authorization header to your configured endpoint.
Message text, notification titles, SMS senders and the queued request description (including
its original destination, authentication token and confirmation mode) are stored in private files
encrypted with AES-GCM and an Android Keystore key. Notification images are stored separately
as JPEG/PNG files in private internal storage without additional application-level encryption;
Android storage isolation and device encryption apply. These files are under noBackupFilesDir
and are not exposed by the app’s FileProvider or added to the media gallery. Temporary image
files have the same storage protection. Older encrypted database payloads migrate to this layout
on their next delivery attempt. SQLite stores delivery metadata (event ID, source display name,
type, timestamps, state, attempt count and HTTP result) and a private file reference without
additional application-level encryption. Message duplicate detection stores SHA-256 hashes of source package, text and an order-independent SHA-256 checksum of encoded image content, roles and presentation, together with original event timestamps
(and retains hashes from the older exact-timestamp filter),
including when filtering is disabled. These hashes remain after delivery or journal deletion until
app data is cleared or the app is uninstalled. They are not a substitute for encryption against
guesses of known content.
The journal shows delivery metadata and does not display message contents or image previews. Confirmed events have their request and image files removed; only recent delivery metadata is retained. Undelivered payloads are not automatically deleted by age. Abandoned temporary files are cleaned during recovery after a grace period. File and database deletion do not guarantee forensic erasure of previously allocated storage. Message bodies, image data and server response bodies are not written to diagnostic logs by the app.
Event previews are opened only by an explicit user action. They show test events or the contents of currently active notifications from selected apps, including text, source package, channel ID and available images. They use the same image conversion and limits as capture. Opening a preview makes no webhook request and does not stop automatic capture; use Pause first if needed. Preview images are temporary private files, removed when the preview is closed or its screen model is cleared; abandoned files are handled by the existing recovery cleanup. Sending a preview requires an explicit action and uses the normal local queue. Explicitly sent tests and their automatic retries can be delivered during Pause; capture and delivery of ordinary messages remain paused. The journal continues to hide message contents.
Settings export writes an unencrypted JSON file to a location you choose in Android's document picker. It contains saved webhook URL, device code, selected source packages, capture preferences, duplicate-filter preferences and image settings. The Bearer token is included by default; a prominent switch lets you exclude it before export. A webhook URL can also contain a secret. Anyone with access to the exported file or its storage provider can read these values. The app does not encrypt the export, upload it separately or delete copies from your chosen provider.
Import reads a selected settings file and shows a confirmation before applying it. If the file has no token, the previous token is cleared. Imported preferences are stored with the protections described above, and forwarding is paused until explicitly resumed. Installation ID, Android permissions, queue, journal, diagnostics and update preferences are not included in the file. Settings import/export does not transfer or delete message payloads or queued credentials.
The app records local diagnostic events: startup, listener connectivity, capture and delivery outcomes, HTTP status codes, queue counts and failures. Logs exclude message and response bodies, notification titles, SMS senders, source packages, webhook URLs, authentication tokens, device codes and installation IDs. Exception messages are omitted; limited stack traces contain exception classes and code locations. Unhandled Java/Kotlin exceptions are saved synchronously and a report prompt appears on next launch.
Diagnostic files reside in private app storage without additional encryption. Three rotating files are limited to 256 KiB each, with a separate last-crash file up to 256 KiB. In Diagnostics you can view recent logs, clear them, or prepare an email to der-morgenstern@yandex.ru. The ZIP attachment includes these logs and an environment summary: app version, Android version/security patch, manufacturer/model, CPU architecture, enabled-source flags and selected-app count. Up to three archives are retained in private cache. Clearing logs also removes the last crash and cached archives.
Nothing is sent automatically. Your selected email/sharing app receives temporary read access to the attachment; review it before sending. Sent copies and your email address are processed by your email provider and the recipient and are not erased by clearing local logs. Reports are used to investigate the problem you report. We retain received diagnostic emails and attachments until the reported problem is fixed or you request their deletion, whichever happens first. Send deletion requests to der-morgenstern@yandex.ru. We delete our copies when either condition is met; copies held by your email provider remain subject to that provider's retention policy.
Your selected endpoint receives event text, an event ID, installation ID, device code, timestamp, schema version, event type, source package identifier and source display name. Notifications add a title and available image attachments, encoded as JPEG or PNG in Base64; SMS add the sender address. Image format and JPEG quality are configurable in Sources (default JPEG, quality 80%). Avatars and source app icons are sent only when their separate switches in Sources are enabled (both off by default). The avatar is the latest available sender avatar or notification large icon. Output size, dimensions and attachment count are configurable in Sources → Graphics; limits are enabled by default and can be disabled. Input decoding safeguards remain active. Images may be resized to fit enabled limits. Unreadable images are skipped with a local capture error. The Overview test sends synthetic text only. Connection tests have separate image selections for Big Picture, gallery, avatar and app icon; they do not enable notification capture options. Selected avatar/app-icon test images use the Message487 logo. Tests use the same image format, quality and limits and the local delivery queue. Android may redact notification content before giving it to the app.
The endpoint operator can also see connection metadata such as your IP address. The endpoint and any downstream services process data under their own policies. An n8n instance may retain complete event bodies in its execution history; the bundled development server does so. Retries can produce more than one server-side copy of an event. Changing the webhook affects new events; existing queued events keep their previous destination and token. Server execution history may also include request headers; restrict access and retention.
The app lists visible launcher apps locally to let you select sources and resolve display names. It does not upload an installed-app inventory or request visibility of all installed packages. If a source name is unavailable, its package identifier is used instead.
Release builds require HTTPS. Debug builds also permit HTTP to the Android emulator host and localhost for development. The app contains no advertising, analytics SDKs or automatic crash reporting, and does not automatically send data to the developer.
The app determines an update source from Android's installer information and whether that installer handles F-Droid repository links. An unknown installer requires a source choice. A saved manual choice takes priority. This does not upload an installed-app inventory.
Update checks are enabled by default and run about once a day when a source is known and the network is available. GitHub installs check the project's latest release through api.github.com; F-Droid installs check f-droid.org. You can change the source or disable automatic checks in App updates. These services receive the IP address and a Message487 update User-Agent; the app does not include message contents, webhook credentials, device codes or installation IDs.
GitHub APK downloads require explicit consent and are stored in the app's update cache. The app checks the release digest, package, increasing version code and matching installed signing certificate before offering the system installer. Installation requires a separate user action and Android's install permission. F-Droid updates open its app page and are handled by its client. Notification permission is used only for update reminders. The source, automatic-check setting, skipped versions and notification times are stored in private preferences without additional encryption. Cached APKs can be removed by clearing the app cache; clearing app data removes update preferences as well.
To request deletion of a diagnostic report you sent to the Message487 developer:
- Email der-morgenstern@yandex.ru from the address used to send the report.
- Ask to delete your report and identify the original email by its date or subject.
We delete the received email, its attachments and associated sender address from our copies. These are otherwise retained only until the reported problem is fixed. This request does not delete data held by your webhook, n8n, downstream services or your email provider.
Disable a source to stop capturing its new events. Pause forwarding to also pause queued delivery; a request already running may finish. Neither action erases previously queued events. Delete individual records from the journal to remove them from the active database and stop future attempts. Clearing app data or uninstalling removes local app data and resets the installation identity. These actions do not remove copies already received by the webhook or downstream services. Delete n8n execution history and downstream copies separately using those services' controls.
Project information and contact: Message487 on GitHub. Do not post personal messages or credentials in public issues.