Privacy Policy

Last updated: 19 July 2026

This policy explains what data Simplepush processes, why, and who else is involved. It applies to the Simplepush apps for iOS and Android, the command line tool, the API, and this website.

Who is responsible

Timm Schäuble is the controller for the processing described here. Our postal address is in the Impressum. You can reach us at hello@simplepu.sh for any privacy question, including the requests described under Your rights.

The short version

• Using Simplepush requires no account, no email address, and no password. Your device registers itself and receives an identifier.
• We do not use analytics, tracking, advertising, or crash reporting SDKs. There are none in the app.
• Encryption is optional. When you turn it on, we cannot read your content. When it is off, we can.
• Everything we host runs in Frankfurt, Germany.

What we process

Device and account data

When you first open the app, it registers a user and a device with our servers. No email address, name, or password is involved. We store:

• A user identifier and a device identifier, both randomly generated.
• Authentication tokens for the device and an API token, so your device can talk to the API.
• A random salt used for client side key derivation.
• Your push token from Firebase Cloud Messaging, which is required to deliver notifications to your device.
• Device model, brand, operating system version, and app version, which the app reports so that we can support the device and show you which of your devices an event came from.
• A device name and an optional description, if you set one.
• A timestamp of your last activity.

Name and email address fields exist in our database but stay empty for personal use. They are only filled when you are invited into an organization, where an administrator provides them as labels for the member list.

Organization administrators who use the command line tool do have an email and password login. Those credentials are stored for that purpose only, with the password hashed.

Content you send and receive

Notifications, tasks, replies, submissions, and their history are stored on our servers so they can be delivered and shown in your event history. What we can actually read depends on encryption, see Encryption below.

Regardless of encryption, we always process the surrounding metadata, because delivery does not work without it: sender and recipient identifiers, topic identifiers, timestamps, sequence numbers, file names, file types, file sizes, and the device and actor names attached to an event.

If you attach your location to a reply or submission, the app reads your device location and sends it as content. This only happens when you actively choose it.

Uploads

Photos, voice notes, and files you send are stored in object storage. File names, content types, and sizes are stored alongside them.

Subscription data

If you buy a subscription, payment is handled by Apple or Google. We never see your payment details. We use RevenueCat to determine whether a subscription is active, and we link your Simplepush user identifier to a RevenueCat customer identifier for that purpose. Our servers store only whether your account is paying.

Organization billing runs through Stripe. In that case we store the Stripe customer identifier associated with the organization.

Server logs

Our gateway writes access logs that include your IP address, the requested path, HTTP method, status code, response size, request duration, and user agent. Our application logs contain user and device identifiers and truncated tokens for debugging. They do not contain the content of your notifications or tasks.

We need these logs to operate the service, to investigate faults, and to apply rate limits that protect the service from abuse. Your IP address is also used as a rate limiting key.

Encryption

Simplepush supports end to end encryption, and it is opt in. This distinction matters, so we want to be plain about it.

When encryption is enabled, your passphrase never leaves your device. Keys are derived on your device using Argon2id and HKDF, and content is encrypted with XChaCha20-Poly1305 before it is sent. In that case the content of your messages, and the contents of your uploaded files, are ciphertext to us. We cannot decrypt them, and neither can Google or Apple when the notification passes through them.

When encryption is not enabled, your content is stored in a form we can read, and the title and body of a push notification are visible to Google and, on iOS, to Apple while in transit.

Metadata is never encrypted, in either mode. See the list under Content you send and receive.

Who else is involved

We use the following processors and service providers:

Provider	Purpose	Location
DigitalOcean	Hosting, database, object storage	Frankfurt, Germany
Google (Firebase Cloud Messaging)	Push notification delivery	Google infrastructure
Google (Firebase App Check)	Verifying that requests come from a genuine app install	Google infrastructure
Apple (APNs)	Push delivery on iOS, reached through Firebase	Apple infrastructure
RevenueCat	Subscription status for the app stores	RevenueCat infrastructure
Stripe	Billing for organizations	Stripe infrastructure

Push notifications necessarily pass through Google, and on iOS through Apple, because that is the only way to reach your device. Delivering a push to Google requires sending your push token and the notification payload. Whether that payload is readable depends on encryption, as described above.

We do not sell your data and we do not share it for advertising.

International transfers

Our own infrastructure is located in Germany. The push and subscription providers listed above may process data outside the European Union. Where that happens, those transfers rely on the European Commission's standard contractual clauses or an applicable adequacy decision. A copy of the standard contractual clauses is available from the European Commission.

How long we keep data

• Uploads on the free tier are deleted after 30 days. On a paid subscription there is no time limit, and files are removed only when your storage pool is full, oldest first.
• Notification and task history is pruned after 3 months, while keeping at least the 150 most recent entries per user.
• Server logs are kept for 30 days.
• Account and device records are kept while your installation exists.

Your rights

Under the GDPR you have the right to request access to your data, correction, erasure, restriction of processing, and data portability. You can object to processing that we base on our legitimate interests. To exercise any of these, write to hello@simplepu.sh.

You can erase your content directly: the app's settings offer "Erase Account Data", which permanently deletes your messages, notifications, and topics from our servers. For deletion of the account itself, including device records, contact us with your user identifier, which is shown in the app under Settings, API Token. Note that we cannot restore encrypted content, and we cannot identify you by name, because we do not hold one.

We do not use automated decision-making or profiling as described in Article 22 of the GDPR.

You also have the right to complain to a supervisory authority.

Legal bases

We process your data to provide the service you asked for, which is Article 6(1)(b) of the GDPR. We process access logs and rate limiting data on the basis of our legitimate interest in operating a secure and reliable service, which is Article 6(1)(f). Where we ask you for consent, for example before accessing your location or camera, the basis is Article 6(1)(a) and you can withdraw it at any time in your device settings.

Children

Simplepush is not intended for children. Our Terms of Use require you to be at least 18 years old. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Security

We use encryption in transit for all connections, keep our infrastructure in a private network, and restrict database access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you want the strongest guarantee we can offer, enable end to end encryption, because then the protection does not depend on us.

Links to other sites

Our service and this website may link to sites we do not operate. We are not responsible for their content or their privacy practices, and we encourage you to read their policies.

Changes to this policy

We may update this policy. When we do, we will change the date at the top of this page and publish the new version here. Material changes will be communicated in the app or by a notice on this site.

Contact

Questions or requests: hello@simplepu.sh.