1. What this covers
Fluxer runs a push relay so the official Fluxer app can receive notifications from instances Fluxer does not operate. Apple and Google only deliver notifications through credentials held by whoever signed the app, and only Fluxer holds those for the official app. Without the relay, an instance Fluxer does not operate cannot notify your device at all.
This notice adds to our privacy policy and applies only when the relay is used. It does not apply to UnifiedPush, where your instance sends notifications straight to a server you chose and Fluxer is never involved.
2. How it works
Your device creates a key pair and keeps the private half. Your instance encrypts each notification to that key and sends the sealed result to the relay. The relay passes it to Apple or Google unopened.
3. What Fluxer can see
Fluxer cannot read your notifications. The relay never holds the key that would open them.
For each relayed notification Fluxer records a salted digest of the device identifier, which app and environment it belongs to, the size of the encrypted payload, its priority and expiry, how long Apple or Google took to accept it, and the time. The sending instance's network address is recorded at our edge.
Every notification is padded to the same size, so its length reveals nothing about its content.
4. What others can see
Apple or Google receive the device identifier, the app it belongs to, the priority and expiry, and a fixed size block they cannot read.
Your instance operator holds the relay address for your device. Anyone holding that address can push to your device through the relay. It stays valid until the device identifier changes, which happens when you reinstall the app, restore the device, or update its operating system.
5. Where this happens
The relay and its logs run on the same infrastructure as the rest of the official Fluxer service. Where that is, and what it means legally, is set out under where data lives. Your instance runs wherever its operator put it.
6. Your choice
The relay is used only if you turn it on and your instance operator turns it on. Either side can turn it off at any time, and notifications stop reaching your device through the relay when you do.