📩 SMS Relay
Turns appointment texts into Notepad reminders, by itself, on Android.
Why this exists as an app at all
No web page can read your texts — Android gives browsers no such API, and Play restricts the SMS permission to apps that are your default messaging app. So the permission has to live in something installed. This is that something, written for one job, with no dependencies and no analytics, so it is a small thing to trust rather than a stranger's forwarder app.
Pair this phone
Checking your Notepad account…
Type it into the SMS Relay app within 10:00. It pairs one phone, once.
Install
- Open the downloaded file. Android will ask whether to allow installing from your browser — this is the "install unknown apps" prompt, and it is expected here.
- Open SMS Relay and tap Allow reading texts.
- In Notepad, go to Reminders & notifications → Pair a phone and type the 8-character code into the app.
That's it. Nothing is sent before you pair, and the code is good for ten minutes and one phone.
What leaves your phone
- By default, only texts that look like appointments — something with a date or time and an appointment-ish word in it. Everything else stays put.
- Never a security code. One-time passcodes, verification and 2FA codes are blocked in every mode, with no setting to turn that off. Forwarding those would make the server a way into your bank.
- The app never shows, stores or logs the texts it relays. It is a pipe, not an inbox.
How it is kept private
- Each text is sealed on the phone with ChaCha20-Poly1305 before it is sent, and opened only by Notepad's own server.
- The connection is TLS with certificate pinning, so a corporate proxy or a rogue certificate authority cannot sit in the middle of it.
- Your phone's key is created when you pair, is different on every phone, and is not in this download — taking the APK apart reveals nothing.
- That key is held in Android's hardware-backed keystore, so it cannot be copied off the phone, even from a rooted one.
- A captured message cannot be replayed: each carries a one-time value and a timestamp the server checks.
- Lost the phone? Revoke it in Notepad's settings and it goes dead immediately.
Verify what you installed
The signing certificate below is the one every genuine build carries.
Compare it with what your phone reports, or with
apksigner verify --print-certs sms-relay.apk.
SHA-256 f4de43adda64c530945a8cc1ff16119e268704c94ce27c5170f7100987a09fea
Source: the sms-relay repo. Built from it with
scripts/build-apk.sh.