1. What this covers
We run a push relay so the official Fluxer app can receive notifications from instances we do not operate. Apple and Google deliver notifications to an app only through credentials held by whoever signed it, and for the official app only we hold those. Without the relay, an instance we do not operate cannot notify your device through Apple or Google.
This notice adds to our privacy policy and applies only when the relay is used. It does not apply to UnifiedPush, where your instance sends notifications straight to a server you chose and Fluxer is never involved.
2. How it works
Your device creates a key pair and keeps the private half. Your instance encrypts each notification to that key and sends the sealed result to the relay. The relay passes it to Apple or Google unopened.
3. What Fluxer can see
We cannot read your notifications. The relay never holds the key that opens them.
For each notification the relay handles, we record a salted digest of the device identifier, which app and environment it belongs to, the size of the encrypted payload, whether Apple or Google accepted it, how long the relay took to handle it, and the time. Our edge servers also record the network address of the instance that sent it. We keep these records for the same period as security and usage logs, which section 7.4 of the privacy policy sets out.
Every notification is padded to the same size, so its length reveals nothing about its content.
4. What others can see
Apple or Google receives the device identifier, the app it belongs to, the priority and expiry, and a fixed-size block it cannot read.
Your instance operator holds the relay address for your device. Anyone holding that address can push to your device through the relay. It stays valid until the device identifier changes, which can happen when you reinstall the app, move to a new device, restore the device from a backup, or reinstall its operating system.
5. Where this happens
The relay and its logs run on the same infrastructure as the rest of the official Fluxer service. Section 6 of the privacy policy, where data lives, explains where that is and what it means legally. Your instance runs wherever its operator put it.
6. Your choice
The relay is used only if both you and your instance operator turn it on. Either of you can turn it off at any time, and notifications then stop reaching your device through the relay.