Privacy Policy

1. Overview & Core Purpose

NotiRelay is an open utility designed to capture notifications from user-selected applications on Android and dispatch them directly to a custom HTTP/REST endpoint configured solely by the user.

We believe your notification data is personal and sensitive. This Privacy Policy details our strict commitment to privacy: we do not collect, monetize, store on our servers, or share your data with any third party.

2. Zero Data Collection by Developers

The developers of NotiRelay have no access to your notifications, your endpoint URLs, your credentials, or any diagnostic telemetry generated on your device.

3. Where Your Data Goes (User-Directed Transmission)

When a notification is intercepted from an application you have explicitly allowed:

• The notification payload (title, text, package name, timestamp) is constructed locally on your device.
• The payload is transmitted directly and exclusively to the custom REST API / Webhook URL that you have configured in the app settings.
• Transmission occurs using standard HTTP/HTTPS protocols over your device's active network connection.

4. On-Device Storage & Credential Security

All configuration data and local history are stored strictly on your local device:

• Credential Encryption: Authentication credentials (including Basic Auth passwords, static Bearer tokens, and OAuth 2.0 client secrets) are encrypted using EncryptedSharedPreferences backed by the hardware-backed Android Keystore. They are never stored in plaintext and never logged.
• Local Delivery Logs: Delivery logs are stored inside an app-private Room database on your device to provide operational visibility (success rates and retry countdowns).

5. Data Retention & Automated Purging

To keep storage footprint minimal and prevent data buildup, NotiRelay enforces strict automated purge policies:

• 24-Hour Success Log: Successfully delivered notification records are automatically purged after 24 hours.
• 30-Day Error & Retry Log: Failed and retrying event records are automatically purged after 30 days.

6. Android Permissions Declared

NotiRelay requests only the permissions necessary for its operational features:

• android.permission.BIND_NOTIFICATION_LISTENER_SERVICE (Notification Access): Required to intercept incoming status-bar notifications from the apps you select. You can enable or revoke this access at any time in Android System Settings.
• android.permission.INTERNET & android.permission.ACCESS_NETWORK_STATE: Required to dispatch JSON payloads to your configured webhook endpoint.
• android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS: Optional permission requested to ensure background retry jobs (via WorkManager) execute reliably without being terminated by device battery savers.
• android.permission.POST_NOTIFICATIONS: Used on Android 13+ to post system notifications if needed for service status and alerts.

7. User Control & Data Deletion

You retain complete control over what NotiRelay accesses:

• App Filtering: In the Apps tab, you can choose between Whitelist mode (forward only selected apps) and Blacklist mode (forward all except selected apps).
• Revoking Access: You can disable Notification Access at any time in Android Settings. Once revoked, NotiRelay immediately ceases reading all notifications.
• Complete Data Removal: Uninstalling the application or clearing its app storage via Android Settings permanently deletes all encrypted credentials, configuration settings, and delivery logs.

8. Children's Privacy

NotiRelay is a technical developer utility and is not directed at children under the age of 13. We do not knowingly process or collect data from children.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any updates will be reflected with a revised "Effective Date" and published with new app releases or on our public repository.