ntfyxntfyx
Privacy notice.
What the service processes, why, and how long it stays.
Status and operator
Effective 29 September 2026. ntfyx is operated by 湖南巴格智能科技有限公司 (Hunan Bage Intelligent Technology Co., Ltd.). Registered address: No. 20020-98, Building 5, Runhe International Plaza, Liuyanghe Street, Kaifu District, Changsha, HUNAN 410003, China mainland. Contact x@bagex.online for privacy, support, or security requests. The encrypted service is being introduced in stages; iPhone availability and purchases depend on Apple approval. This notice applies to the ntfyx service and website.
Content and metadata
Message titles, bodies, answers, options, links, and display names are encrypted by your devices. The relay stores ciphertext and cannot normally decrypt it. It processes opaque Inbox, Topic, Source, and device IDs; timestamps; sizes; coarse event types; terminal states; and routing indexes for authorization, delivery, deduplication, quotas, and deletion. No ntfyx account or email registration is required. That does not mean no personal data is processed.
Notifications, purchases, and network data
The service needs APNs device tokens, push environment, and relevant app/device versions to deliver notifications. Apple transaction identifiers and anonymous entitlement associations support purchase restoration, refunds, and abuse prevention. Network IP information is available during connections and abuse checks. The ntfyx application does not log message bodies, credentials, or raw IP addresses. Hosting providers may process network and security metadata under their own policies; application-level logging limits do not disable those provider records.
Suppliers and transfers
Cloudflare provides the globally distributed website, API, encrypted relay storage, and delivery queues. A RackNerd server runs the Apple gateway; Apple provides APNs and in-app purchases. These providers may process data outside your country. Cloudflare routing and recovery features do not constitute a promise of single-country residency. Device and browser vendors independently process data under their own terms.
Retention and local storage
Ordinary service ciphertext is retained at most seven days and within the Inbox capacity limit. Pending requests remain until their deadline; terminal request and answer data remain seven more days. Minimal idempotency and consumption tombstones last thirty days. The Web cache keeps at most thirty days or 5,000 records, with active requests protected; iPhone history defaults to ninety days or 10,000 records. Revoked or invalid push tokens stop being used. Aggregate metrics contain no content or secrets. Cloudflare recovery copies may retain deleted records for up to 30 days. No separate application-level message backup is exported. Recovery must preserve deletion and revocation records before reopening access.
Deletion and recovery
Delete service data from the primary phone. Device copies and exported recovery packages are under your control and must be removed separately. Minimal deletion, revocation, and entitlement-generation records remain while the service operates to prevent old credentials or restored databases from reviving access. Purchase identifiers and entitlement history remain to support purchase restoration and refund reconciliation; they do not have an automatic expiry in the current implementation. Contact us about these retained records. A recovery package restores keys only when valid; a purchase restore alone cannot decrypt old content. Support cannot recover lost private keys.
Support and your choices
Support reports are opt-in. Preview and redact the report locally before sending; never send private keys, pairing links, recovery codes, or message content. Support correspondence is used to resolve the request and is deleted within 90 days after closure unless a continuing dispute or legal obligation requires retention. Depending on your market you may have access, correction, deletion, objection, restriction, portability, or complaint rights. Send requests to x@bagex.online. To protect an Inbox, we may need a signed ownership proof; do not send encryption secrets.