SCIFText

For security managers

SCIFText is a personal Android app that emails a user’s own texts to email addresses they verify. It is not remote-access software, MDM, a hidden monitor, or a way to move classified traffic off an approved device.

If someone at your company installed it, this page is the short briefing. The full data list is in the Privacy Policy.

What it is What it is not Permissions Data Network Workplace policy Allow or block

What it is

Package name com.sciftext, listed on Google Play as SCIFText. The user installs it on a phone they control, signs in, verifies up to three forwarding addresses, and turns forwarding on. Incoming SMS, MMS, RCS (from Google Messages notifications), missed-call alerts, and — only if they opt in on the Sources tab — other app notifications are emailed to those addresses. A reply from a verified address is sent back out as a text from that phone’s number.

Nothing is forwarded until the user agrees to the in-app notice and turns forwarding on. A persistent “SCIFText is running” notification stays in the shade while it is working.

What it is not

Permissions it asks for, and why

Android notification access is granted for the listener as a whole. The app only forwards Google Messages (and the Sources the user enables). SMS read/send is used when the user makes SCIFText the default SMS app, or to send email-to-text replies. Contacts are looked up on the phone so the email subject can use a name; the contact list is not uploaded. Internet is for HTTPS to sciftext.com and Firebase Cloud Messaging. A foreground service keeps forwarding alive; that is why the ongoing notification exists.

It does not request camera, microphone, location, phone-state, overlay, or query-all-packages.

What leaves the phone

The SCIFText server does not store message text or pictures. They pass through memory on the way to the user’s inbox (Amazon SES) or back to the phone (Firebase), then are gone. The server keeps account and routing data: sign-in email, password hash, verified forwarding addresses, device id / model / FCM token, plan counters, and short-lived fingerprints used to stop duplicates and to refuse replies that should never become a text. Details and retention are in the Privacy Policy.

Replies are accepted only from a verified address, and only when the email passes DMARC. Sessions and one-time links are stored as hashes. The app talks to the server over HTTPS.

Where it talks

Workplace and classified use

If your policy forbids personal mail relays, default-SMS replacement, or notification access on managed phones, you should treat SCIFText like any other app with those capabilities: block the package. An employee who forwards work SMS, including one-time codes, to a personal inbox is a policy problem, not evidence that the app is malware.

Do not use SCIFText to move CUI, classified, or other restricted messages off an approved device. The terms already say to follow workplace and facility rules.

How to allow it, or stop it

Questions: privacy@sciftext.com.