Privacy Policy

NTFY me is an open-source iOS client for the ntfy notification service, published by Legitimate LLC. This policy explains what the app and its default server do with your data.

What we collect

The iOS app has no account system, advertising, analytics SDK or crash reporter, and no data broker relationship. The website is separate: the landing page (/) and guide pages (/docs/ and /docs/...) load Cloudflare Web Analytics to measure page performance and visits. The web app (/app), topic pages, subscription/API endpoints and web app assets do not include this beacon. Automatic Cloudflare beacon injection is disabled; the beacon appears only in the landing and guide HTML. See Cloudflare Web Analytics for the provider’s description of its collection.

The publisher does run one thing: the app's default server, ntfy-me.com, described below. It handles the topics and messages you choose to send through it. Use a different server and your topics and messages never reach us; if that server relays push through ntfy-me.com (upstream-base-url), ntfy-me.com receives only a hash of the topic's URL and a message ID, from that server's IP address.

What stays on your device

• The list of servers and topics you subscribe to
• The notifications you receive: titles, messages, tags, and any attachments you download
• Any custom names you give a topic
• Any username and password you enter for a server, and any custom HTTP headers
• Any end-to-end encryption password you set for a topic

Topics, notifications and usernames are stored in a database inside a container the app shares with its notification extension. Passwords and custom headers are kept in the iOS Keychain, shared the same way. Topic encryption passwords are kept in the Keychain on this device only: they are not included in backups or synced, so a restored or new phone needs them entered again. Deleting the app deletes the database.

What leaves your device, and why

Your ntfy server. The app connects to whichever ntfy server you choose. The default is ntfy-me.com, run by Legitimate LLC. It is not affiliated with ntfy.sh or the ntfy project, and you can switch to any other ntfy server, including your own, in Settings. The app sends that server the topic names you subscribe to and any credentials you entered for it.

On ntfy-me.com:

• Ordinary messages expire from the live server cache after 12 hours; attachments expire after 3 hours. Cleanup runs periodically, so expiry is not a promise of immediate physical erasure. Scheduled notifications can remain until their scheduled delivery and subsequent cache expiry. Copies already downloaded to devices are outside this server retention window.
• Your IP address is used to apply per-IP rate limits and is stored with cached messages. Railway HTTP access logs contain request paths (including topic names), IP addresses, user agents, status codes and timing. Railway currently retains logs for 7 days. Message text is not part of those HTTP log fields; avoid putting message text in a URL or query string.
• Topics are public: anyone who knows a topic name can publish, read and send clear/delete controls there. Names are not ownership reservations. Choose a long random name and do not use this free server for confidential or safety-critical delivery.
• We do not currently back up the ephemeral message cache or attachments. Device copies follow device retention. The service can lose cached data during a failure; it has no availability or delivery guarantee.
• The server is hosted on Railway, and requests to ntfy-me.com pass through Cloudflare. Both providers process request metadata under their own policies. Use HTTPS: plain HTTP publishing is accepted for compatibility, but its first hop is unencrypted and exposes the topic name and message to the network.

Messages on a topic with an end-to-end encryption password are encrypted by the sender before they reach the server, so we cannot read them: ntfy-me.com stores ciphertext and can see the topic name, time and size. Google and Apple push carries no message text; it carries the topic name and a message ID. The password never leaves your device. Once a message arrives it is decrypted and stored readable on this device like any other notification, so it can appear in Notification Center and in device backups.

For any other server, what it logs and keeps is governed by whoever runs it. If you self-host, that is you.

Apple Push Notification service and Firebase Cloud Messaging. To deliver notifications while the app is closed, the app registers for a push token and sends it to Firebase Cloud Messaging, operated by Google, which relays through Apple's Push Notification service. A push token is a device identifier. Pushes for ntfy-me.com carry no message content: Google and Apple see the topic name and a message ID, and the app then fetches the message itself from the server over an encrypted connection. This is how push delivery works on iOS and cannot be avoided while push is enabled.

The Firebase Messaging SDK in the app also sends Google an installation ID and diagnostic information about its own operation, which Google uses to provide the service and to measure how the SDK performs. The App Store privacy label lists this as Identifiers, Diagnostics and Other Data, all not linked to you and not used for tracking.

• Apple Privacy Policy
• Firebase Privacy and Security

If you would rather not involve Firebase, you can use another ntfy server without push delivery and refresh topics in the app, at the cost of instant notifications.

Children

The app is not directed at children, and we do not knowingly process children's data.

Changes

Material changes to this policy will be published at this address with an updated date.

Contact

For private privacy, security or abuse reports, contact support@ntfy-me.com. Do not post topic names, credentials or message contents publicly. For ordinary setup help, see the support page.