> pingtxt_
[it]
$ cat PRIVACY

privacy policy

For the pingtxt iOS app and the pingtxt.com website. Last updated November 1, 2026.

──summary

  • pingtxt is self-hosted. The app talks to the hub that you (or your organisation) run, not to a pingtxt cloud.
  • We have no user accounts, no advertising and no tracking. We don't sell or share personal data.
  • The app uses two services that we run: the push relay at push.pingtxt.com, which forwards alerts from your hub to your phone through Apple and Google Firebase and stores nothing, and an update check at federicomengascini.com, which tells the app when a new version is out.
  • The update check uses a random installation id to count active installations. It is not linked to you, your hub or your phone.

──who we are

pingtxt is an open source project (AGPL-3.0) maintained by Federico Mengascini, who is the controller for the data handled by the push relay, the update check and this website. Write to privacy@pingtxt.com for anything about this policy.

──your hub

To use the app you sign in to a pingtxt hub by entering its address. Sign-in uses OAuth in the system browser: your password is typed on your hub's own page and never passes through the app or through us. Your hub gives the app an access token and a refresh token.

Everything the app shows (monitors, check results, incidents, maintenance windows, status pages, agents, your account) is read from your hub, and every change you make is sent to your hub. The hub stores which phone is signed in: the sign-in, the device name that iOS gives apps (the model, such as "iPhone", not the name you chose) and, when notifications are on, an encrypted push handle.

If Background App Refresh is on, iOS lets the app load the status of your hubs now and then while it is closed, and the widgets load it from your hub too, so that widgets and Live Activities stay current. These requests go only to your hubs.

Your hub is run by you or by whoever gave you access, not by us. That operator decides what is stored there and for how long; their own privacy policy applies to that data. We have no access to any hub.

──on your iphone

  • Access and refresh tokens are kept in the iOS Keychain, readable only on this device after it was unlocked.
  • The addresses of hubs you used, a few preferences, the random installation id of the update check and its last answer are kept in the app's settings (UserDefaults), and the latest hub status is shared with the pingtxt widgets through an App Group on the device.
  • Nothing of this is backed up to us. Signing out removes the tokens of that hub; deleting the app removes everything.

──push notifications

Notifications are optional. If you allow them and your hub has push turned on:

  • iOS gives the app a token, which the Google Firebase Cloud Messaging (FCM) SDK turns into an FCM registration token. To do so Firebase uses a Firebase installation ID and basic app and device information (app version, iOS version, device model).
  • The app sends the FCM token and your hub's id to the relay at push.pingtxt.com. The relay encrypts them into a sealed device handle, returns it and keeps nothing. Only the relay can open the handle; your hub never sees the FCM token.
  • The app gives the handle and the device name to your hub.
  • When a monitor changes state, your hub sends the alert text (for example the monitor's name and the cause) with the handles to the relay. The relay opens the handles and passes the message to FCM, which delivers it through the Apple Push Notification service. The relay does not store messages.

You can turn notifications off in iOS Settings at any time. Signing out removes the phone from your hub and deletes the FCM token.

──live activity

During an outage the app can show a Live Activity on the Lock Screen and in the Dynamic Island. To keep it current while the app is closed, iOS gives the app Live Activity tokens, which the app sends to your hub; your hub sends updates (open incidents: monitor name, start time, cause) with those tokens through the relay, FCM and Apple, as above. You can turn Live Activities off in iOS Settings.

──update check

When the app starts and when you come back to it, it asks federicomengascini.com whether a newer version is available or required. The request carries:

  • the installed app version, the iOS version (for example 26.1) and the platform (ios);
  • where the app was installed from (App Store, TestFlight or a development build);
  • a random installation id made by the app on first use. It is not the device id, the advertising id or anything from your hub, and it changes if you delete and install the app again;
  • like any web request, your IP address, which the server does not store or use.

The server answers with the latest version and whether yours is still supported. The installation id is stored only as a one-way hash, to roll out new versions gradually and to count active installations and versions. Nothing about your hubs, monitors or account is sent. The request is skipped if the server cannot be reached; the app works the same.

──what we don't collect

  • No analytics SDK or crash reporting: Firebase Analytics is not included and is turned off. The only count we keep is the anonymous one of the update check.
  • No advertising identifier (IDFA), no tracking across apps or websites, no data brokers.
  • No location, contacts, photos, health or payment data.
  • No account with us: your identity lives only on your hub.

──third parties

These providers may process data outside your country, including in the United States, under their own safeguards (such as the EU Standard Contractual Clauses).

──retention + deletion

  • The relay has no database. Its logs hold hub ids and counts of sent messages, never tokens, message text or IP addresses. IP addresses are held in memory only for rate limiting and dropped within minutes.
  • Firebase keeps an FCM token until it is deleted (at sign-out or when the app is removed) or has been unused for a long time; see Google's documentation.
  • The update check keeps only the hashed installation id with the app and iOS version it last reported, and the daily counts made from them. It keeps no IP addresses.
  • To delete everything: sign out of each hub in the app, then delete the app. Data kept on a hub can be removed by its operator.

──your rights

Depending on where you live (for example under the EU/UK GDPR or Californian law) you can ask to access, correct, delete or export your personal data, object to or limit its processing, and complain to your data protection authority. The legal basis for the push relay is the performance of the service you asked for (delivering your alerts); for the update check it is our legitimate interest in keeping the app up to date and knowing how many installations use each version. Because the relay stores nothing and the installation id is anonymous, we usually hold no data about you; for data on a hub, contact its operator. Write to privacy@pingtxt.com.

──children

pingtxt is a tool for monitoring servers and is not directed at children under 13 (or 16 in the EU).

──this website

pingtxt.com is a static site hosted on GitHub Pages. GitHub may log visitors' IP addresses for security; see the GitHub privacy statement. The site sets no cookies and has no analytics. Your theme and language choices are kept in your browser's local storage. The page loads the public status of status.pingtxt.com and the public usage totals from telemetry.pingtxt.com; these requests carry no identifier.

──hub usage stats

The self-hosted hub can send anonymous usage stats (a random id, its version and how many monitors and agents are live) once an hour, only if an admin turns it on. It is not part of the app. See usage stats in the docs.

──changes

We will update this page when the app, the relay or the update check changes what it handles, and change the date at the top. The history is public in the repository. The relay source code is public too: pingtxt-push-relay.

──contact

Federico Mengascini · privacy@pingtxt.com