Privacy policy

We will never sell or share your data. The services below run parts of PushArmor for us and only ever see the minimum needed to do their part.

Services we use

• Google's and Apple's notification services (FCM, APNs) for Android and iPhone, Google and Mozilla web push (Chrome, Firefox), and a UnifiedPush distributor if you chose one: used to wake your device. They see the address your device uses to receive notifications (push token or endpoint), and pass along the encrypted message, which they cannot read. They hold undelivered messages for up to 7 days (pairing requests for up to 4 weeks).
• Cloudflare: runs our relay server and its database, so it can technically see everything our relay server sees: your email address briefly at login (to send the code), your IP address, device public keys, push tokens, and encrypted messages it cannot read. Cloudflare keeps our delivery logs for up to 7 days. They hold the account ID, device IDs, and send results. They hold no content, no IP address, and no email. Cloudflare's bot check (Turnstile) runs on the email login page, on the command line login page (/auth/cli), and on the delete-account page only.
• Google and Apple login (if you choose them): used to prove the account. We keep only a one-way hash of your email address, which is your account ID (see below).
• AWS SES: used for email login only, to send the login code. It sees your email address at send time, and we send it nothing else. If a code email bounces, AWS may keep that address on its own suppression list.

Your email address

We do not store your email address. We keep only a one-way hash of it, which cannot be turned back into the address.

Why we need the hash: it is your account ID. When you log in on another device with the same address, the hash puts that device in the same account. If an address is banned for abuse, we store its account ID so it stays banned, even after the account is deleted.

End-to-end encryption

All messages between devices are end-to-end encrypted and signed by the sending device. Only the devices you send to can ever decrypt them, and each one checks that the message really came from the device it claims to be from. Each device makes its own keys, and the private keys never leave the devices. A message is encrypted on the sending device for the receiving device, so our relay server only passes along encrypted data it cannot read (ciphertext). We never see your message content or pairing fingerprints, and we do not store them.

What our relay server stores

Our relay server keeps, until removal:

• Per account: the account ID (the one-way hash), the account creation date, and the last-active month.
• Per device: public keys, push token or endpoint, allow and deny lists, names you give devices (stored only encrypted, so we cannot read them), created time, platform, logged-out flag, and pending pairing confirmation messages (end-to-end encrypted, kept until the other device is removed, rejected, or withdrawn, or 14 days pass).

An account with no send and no added device for about 3 years is deleted with its devices (banned accounts are kept). This also removes an account that has no devices left.

What stays on your device

• The address you logged in with, shown as Logged in as (a Hide My Email relay address if you chose one), so you can see which address to use on your other devices.
• Your history, deleted automatically after the number of days you set (default 30). History is device-local and not backed up.
• Your keys.

Lock screen: message content follows the platform setting (Android sensitive notification content, iPhone Show Previews) or the in-app switch Show message content on lock screen. With Send messages to watch off, Android message notifications are local only (not mirrored to paired wearables). Both switches work per device too. The Always hide content switch is off by default. When you turn it on, no notice shows any message content.

Tracking

No analytics, no ads, no tracking, ever. This site has no third-party scripts, except Cloudflare's bot check on the login and delete-account pages. We set no cookies; Cloudflare security features may set a short-lived one.

Background transmission (Firefox)

The Firefox add-on keeps a push connection to Mozilla (autopush WebSocket) in the background. As a fallback, a background script on PushArmor.com receives encrypted messages. It then passes them to the add-on inside the browser. Both carry encrypted data only.

Deletion

You can delete your account from the apps, or with the web flow at PushArmor.com/delete-account. Deletion removes the account and all its devices at once. Kept: undelivered messages at the push services, up to 7 days (pairing requests up to 4 weeks); copies on your other devices; and the account ID of an address banned for abuse, so it stays banned.

Remove on a device deletes that one device only. The account (the one-way hash, creation date, and last-active month) stays until you delete the account, or until the 3-year purge above.

Children

PushArmor is for people aged 13 and over. We do not knowingly hold an account for a child under 13.

Privacy requests

You can delete your account and all its devices yourself: delete it from the apps, or use the web flow at PushArmor.com/delete-account. For help with the apps, see the support page.

Who we are

PushArmor is operated by Ion Echo, LLC at PushArmor.com.