Privacy
This notice covers the anypush app, the anypush desktop client, the service at api.anypush.app and this website. It is written to be read, not skimmed past: if something here is unclear, write to hello@anypush.app.
Who we are
anypush is a product of OID4Pay B.V. (“we”). We decide what happens to the data below, which makes us the “controller” under the GDPR.
OID4Pay B.V.Nassaukade 51-2
1052 CN Amsterdam, the Netherlands
KvK 42074824
hello@anypush.app
What is stored, and why
| What | Contents | Kept |
|---|---|---|
| Your account | Email address, password (stored only as a bcrypt hash), display name, the date you signed up. | Until you delete your account. |
| How you found us | Your answer to “How did you hear about us?” when you signed up, if you gave one. It tells us how people find anypush. You give it by choosing to answer (consent, GDPR art. 6(1)(a)); ask us and we delete it. | Until you delete your account. |
| Hooks | Name, the secret token in its link and address, your quiet-alert setting, when it last received something. | Until you delete the hook or your account. |
| Messages | Title, text, link, priority, whether it came from the web, an email or a quiet alert, and when. | 7 days, or 30 days while you have Plus. Then deleted automatically. Sooner if you delete it. |
| Devices | Type (phone or computer), name, push token, app version, when it was last seen. | Until you remove the device or delete your account. |
| Sign-in sessions | A hashed refresh token per signed-in device. | 30 days, or until you sign out. |
| Preferences | Settings such as quiet hours, and your timezone, so quiet hours follow your clock. | Until you delete your account. |
| Purchases | For each Plus pass: the Google Play order id, which pass, and when you bought it. | 7 years, because Dutch tax law requires it. Also after you delete your account. |
Your account, hooks, messages, devices, sessions and preferences are what the service needs to deliver the notifications you asked for. The legal basis for them is the contract between you and us (GDPR art. 6(1)(b)). The answer to “How did you hear about us?” is your choice, and purchases have their own section below.
What other people send you
Anyone who has one of your hook links or addresses can send you a message. What they write on the ping page (an optional name and note), what a script sends, or an email becomes a message in your inbox, and is kept like any other message. The ping page sets no cookies and runs no scripts.
Each hook has its own email address. Email sent to it is received by MailOdds, our mail provider. Our server reads it from there over IMAP, keeps the subject and the plain-text body as a message, and then deletes the email from the mailbox, so neither the email nor its attachments are kept. Email that is not addressed to a hook, such as a question to hello@anypush.app, stays in our mailbox until we have dealt with it.
Logs
The server logs each request’s method, route, status and duration, and internal ids (of accounts, hooks and messages) for the events it handles. It does not log IP addresses or what a message says. Logs are rotated automatically: older entries are overwritten as the log fills up, usually within a few weeks.
Crash reports, only if you agree
The app asks before it sends crash reports. If you agree, Firebase Crashlytics (Google) receives the error, your device model, OS and app version when the app crashes. You can change your mind at any time: Settings → Turn off crash reports. The legal basis is your consent (GDPR art. 6(1)(a)). There is no analytics SDK and no advertising in the app.
Purchases
Plus is sold as prepaid passes in the Android app, through Google Play. Google Play takes the payment, and we never see your card details. From Google Play we receive the order id, which pass you bought, and when.
We keep these purchase records for 7 years, because Dutch tax law requires it. That includes after you delete your account. They contain no message content. The legal basis is the contract, to give you Plus (GDPR art. 6(1)(b)), and our legal obligation to keep the records (GDPR art. 6(1)(c)).
Who else handles your data
- Google (Firebase Cloud Messaging) delivers notifications to Android phones. The title and text of a message pass through Google to reach your phone.
- Google (Google Play billing) takes the payment when you buy a Plus pass.
- Google (Firebase Crashlytics) receives crash reports, only if you agreed to them.
- Cloudflare sits in front of the server and hosts this website. It processes IP addresses briefly, to deliver pages and to protect against abuse.
- MailOdds, our mail provider, receives the email sent to anypush.app addresses.
Some of these process data outside the European Economic Area. They do so under the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework. anypush sells no data to anyone.
Where it is stored, and backups
Our own server in the Netherlands stores everything in the table above. Daily backups are kept for 7 days, so deleted data leaves the backups within 7 days.
This website
This website is hosted on Cloudflare Pages. It sets no cookies and has no analytics or trackers. Its scripts run the demo on the front page and the light/dark switch, inside your browser, and send nothing anywhere. If you pick light or dark, your browser remembers that choice in its own storage; it never leaves your device. Cloudflare processes your IP address briefly, to deliver the pages and to protect against abuse. “Notify me at launch” opens an email to us in your own mail app; we use your address only to tell you when anypush is live, and delete it once we have.
Your rights
- A copy of everything: Settings → Download my data, in the app.
- Deletion: Settings → Delete account. It is immediate and permanent, apart from the purchase records and backups described above. See also how to delete your account.
- Correction, restriction, objection, or a question: write to hello@anypush.app from your account’s email address. You get an answer within one month.
- A complaint: you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or the one where you live.
Children
You must be 16 or older to have an anypush account: the age Dutch privacy law sets (UAVG art. 5). anypush is not directed at children under 16.
Changes
When this notice changes, the date at the top changes with it.