Privacy

Cavas, CVR DK37178640, Aalborg, Denmark, is the controller of the personal data described here. For anything about this policy, or to exercise any of the rights below, write to [email protected].

The private half of a passkey never leaves your device and is never sent to us. We store sending tokens and session tokens only as hashes.

A message carries whatever the sender put in it: a title, a body and optionally a link. We store it so it can be delivered and so you can read your history, and we send it to Apple to reach your device.

Don't put anything in a notification that you wouldn't want on a lock screen.

A connector records every event a service posts to it: the event's name, when it arrived, and whether one of your rules turned it into a notification. The most recent event of each name also keeps the values it carried, so the dashboard can preview what a rule would say before you save it.

Some of those values are about other people. A Stripe invoice carries your customer's email address and what they paid. Only the newest event of that name holds them. Older ones keep the name and the time, and all of it follows the receipts window below.

Six, and no more. There is no advertising, and nothing is sold or shared for anyone else's purposes.

Product analytics records the path of each page you open, a short list of product events, and your account ID. Autocapture, session replay and URL contents are switched off, so alert text, user keys and invitation tokens never reach it.

Crash reporting sends nothing while the app works. When something breaks, it reports the error and where in the code it happened. Routine refusals the app already explains, such as an expired sign-in or a feature your plan doesn't include, aren't reported.

• HetznerGermany

  Hosts the servers and the database. Sees everything stored, at rest.

• AppleUnited States

  Delivers push notifications, and takes payment for plans bought in the iPhone and Mac apps. Receives the message title and body, and the device token. For a purchase in the app, Apple holds your payment details and tells us the transaction, the plan and when it renews or ends.

• StripeIreland and the United States

  Takes payment. Receives your email address and payment details. Never message contents.

• PurelymailUnited States

  Delivers the sign-in code email. Receives your email address and the code. Never message contents.

• PostHogEuropean Union

  Product analytics, on PostHog's EU cloud. Receives the path of each page you open, a short list of product events, and your account id. Never message contents, your email address or a user key.

• SentryEuropean Union

  Crash reports, on Sentry's EU region. Receives nothing until something breaks. Then it receives the error, where in the code it happened, the page you were on with identifiers removed from the path, and your browser version. Your IP address reaches Sentry because the report is a network request. Your browser removes request and response bodies, headers and query strings first, and replaces anything shaped like a key, an address or a message before sending. Nothing is stored on your device, and your screen is never recorded.

Your account and messages are stored in Germany. Delivering a notification, sending a sign-in code and taking payment involve processors in the United States, and those transfers rely on the European Commission's standard contractual clauses.

Messages, delivery receipts and the events your connectors received are deleted automatically once they pass your plan's retention window. Receipts have the shorter window.

Connector events follow the receipts window, because like a receipt they record that something arrived and whether it reached you.

• Sign-in codes expire ten minutes after they are issued.
• Sessions expire thirty days after you sign in.
• Your account, devices and passkeys are kept until you delete the account, and are deleted with it.
• Payment records are kept for as long as accounting law requires, which is five years in Denmark.

You can ask for a copy of your data, ask for it to be corrected or deleted, ask us to restrict processing, object to processing based on legitimate interest, and ask for your data in a portable form. Write to [email protected] and you'll have an answer within a month.

Most of this needs no request. Your messages, devices, passkeys and sessions are on the dashboard, closing your account deletes them, and Download your data gives you a portable JSON copy.

If you think your data is being handled wrongly, you can complain to Datatilsynet, the Danish data protection authority.

You can't turn off the first list. Without it the site can't sign you in or remember your consent choice. None of it leaves your browser except the sign-in token, sent with requests to the API.

The second list is stored only if you agree, and you can change your answer from the footer of any page. If your browser sends Do Not Track or Global Privacy Control, you aren't asked: both count as no.

Crash reporting is in neither list. It writes nothing to your browser, so there's no identifier linking one visit to the next.

Traffic is encrypted in transit. There are no passwords to leak, and passkeys are stored as public keys only. Session and sending tokens are stored as hashes, so a copy of the database contains no working credential.

If a breach affects your data, we'll tell you and Datatilsynet within the time the law allows.

There are none. Nothing here profiles you or makes a decision about you without a person involved.

The service isn't intended for anyone under 16, and we don't knowingly create accounts for them.

This policy can change. The date at the top shows the last revision, and we email you before any change to how your data is used takes effect.