Privacy Policy

Last updated: 2026-10-07

PushEdge ("we", "us") provides a push-notification platform for app publishers: the marketing site at pushedge.app, the management console at console.pushedge.app, the API at api.pushedge.app, and the PushEdge mobile app. This policy explains what personal data we process, why, and what rights you have.

1. Data we process

• Account data: email address, organization name, password (stored as a one-way hash), multi-factor authentication secret and recovery codes (encrypted/hashed), and session metadata.
• API keys: key name, a short identifying prefix, and a hash of the key. The full key is shown only once, at creation time.
• Device & subscription data: the push token issued by Apple (APNs) or Google (FCM) — stored hashed — the platform, a per-installation identifier, channel subscriptions, and activity timestamps.
• Notification data: title, body, target channel, and send time. Delivery counters (sent / failed) are computed and logged at send time.
• Technical & security logs: IP address, user agent, request timestamps and error events, kept to operate and secure the service (rate limiting, abuse and bot prevention).

The marketing site does not use advertising cookies or third-party analytics trackers.

2. Why we process it

• Provide the service: authenticate you, manage channels and devices, and deliver notifications.
• Secure the service: prevent brute force, abuse and bots; enforce rate limits and quotas.
• Support: answer your requests and troubleshoot incidents.
• Comply with legal obligations and enforce our Terms of Service.

3. Legal bases

Where the GDPR applies, we rely on the performance of our contract with you (providing the service), our legitimate interest (security, service improvement, abuse prevention), your consent where required, and legal obligations.

4. Sharing

We do not sell personal data. We share limited data with processors that are necessary to run the service:

• Google Firebase Cloud Messaging (FCM) — to deliver push notifications to devices.
• Cloudflare Turnstile — to protect login and registration from bots.
• Hosting and backup providers — to host the platform and store encrypted backups.
• Tally — provider of the contact form: the data you submit through the form (e.g., email and message) is processed by Tally and sent to us.
• Stripe — subscription billing (Pro/Company plans): organization name, contact email and payment amounts are processed by Stripe (PCI-DSS certified). Card data is stored by Stripe, never by PushEdge.

5. Retention

• Account data: until you delete your account from the console (Account page) or contact us.
• Device data: until the device unsubscribes, is pruned after a token becomes invalid, or your account is deleted.
• Notification history: as long as needed to provide the Feed and statistics, then deleted with the account.
• Backups: 7 daily and 4 weekly generations, rotated automatically.
• Security logs: kept for a limited period, as required for security and legal purposes.

6. Security

Push device tokens and API keys are stored hashed, MFA secrets are encrypted, traffic is protected in transit, and access to production systems is restricted. No method of transmission or storage is 100% secure, but we work to protect your data and continuously improve our safeguards.

7. Your rights

Subject to applicable law, you can request access to, a copy of, correction of, or deletion of your personal data, as well as restriction of or objection to certain processing. You can delete your account directly from the console, and end users can delete individual notifications from the mobile app when the channel allows it. To exercise your rights, contact us via our contact form. If you are in the EU/EEA, you also have the right to lodge a complaint with your local data protection authority (in France, the CNIL).

8. International transfers

Some processors may process data outside the EU/EEA. When this happens, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

9. Children

The service is not intended for children under 16, and we do not knowingly collect their personal data.

10. Changes

We may update this policy from time to time. The "Last updated" date above reflects the latest revision; material changes will be announced on this page or by email where appropriate.

11. Contact

Questions about this policy or your data? Use our contact form.