Privacy

1. Who is responsible

ANGELTECH is responsible for the NotiFerry website, product, and direct support data it controls. Contact privacy@agentkey.dev. Independent providers control their own services and processing.

ANGELTECH controls the product-support information it receives. Lemon Squeezy, ntfy, Apple, Google, and the site infrastructure process data for their own services under their published terms.

Operator

ANGELTECH · 9 Route de la Conche, 19320 Saint-Martin-la-Méanne, France

Payment and receipt

Link, LLC f/k/a Lemon Squeezy LLC

Website host

Vercel Inc. · 440 N Barranca Avenue #4133, Covina, CA 91723, United States

Provider roles

ANGELTECH supplies and supports NotiFerry; Lemon Squeezy handles checkout, payment, receipts, and license records; ntfy relays notifications; Vercel hosts this website.

2. Notification data and your controls

Notification content stays on your Mac until forwarding is enabled and a new eligible record is read after the current baseline. With the read-only folder permission you select, the app can read the source app, source identifier, title, subtitle, body, and record timing. These fields can contain messages, one-time codes, health, financial, employment, or other sensitive information.

Before enqueueing, NotiFerry applies your app exclusions and privacy mode: full preview, app and title only, or a generic alert. Pausing forwarding discards notifications received while paused; resuming does not backfill them. You can clear queued content, rotate the topic, revoke folder access, or reset setup.

3. Local storage and exact queue behavior

After privacy filtering, an owner-only SQLite outbox stores at most the newest 1,000 pending rows. A row is eligible for delivery for 10 minutes after the alert appeared in Notification Center; a late alert is dropped, not sent, and an alert that is already late when captured is never stored. Expired rows are deleted on the next enqueue or delivery- claim activity, so an inactive database may retain an expired row longer until that activity, manual clearing, reset, or app-data deletion. When delivery falls at least 30 seconds behind, five or more pending alerts from one app are sent as one notification: the newest alert, with a count of the others, whose content is deleted unsent. Successful delivery, permanent failure, capacity trimming, clearing, and reset remove rows earlier.

Source is capped at 256 UTF-8 bytes, source identifier and title at 512 bytes each, subtitle at 1,024, and body at 3,800. The database uses owner-only permissions, rollback journaling, and SQLite secure deletion, but it is not separately encrypted and storage systems can retain copies. NotiFerry keeps no separate history of successfully delivered content; macOS maintains its own Notification Center database independently.

4. ntfy and mobile push

The app sends the filtered fields and topic over HTTPS to your configured ntfy server. The random public topic is a bearer secret: anyone who learns it can subscribe and publish until it is rotated. The app stores the topic and any optional ntfy credential in macOS Keychain. A copied subscription link is placed on the system clipboard and is automatically cleared after two minutes only if the clipboard has not changed.

Public ntfy.sh may cache messages for approximately 12 hours under its current configuration. ntfy states that iOS instant delivery uses Firebase Cloud Messaging through Apple Push Notification service, so ntfy, Google, and Apple may process content or metadata. A custom ntfy server has the operator’s own retention and logging settings.

5. Diagnostics, analytics, crashes, and cookies

The app does not automatically upload a support report. When you choose “Copy privacy-safe diagnostics,” it puts a bounded report on the macOS clipboard containing version/build, macOS version, CPU architecture, engine/permission/onboarding/license categories, counts, and operational timestamps. It excludes notification content, app identifiers, paths, server/topic details, credentials, purchase data, free-form errors, and URLs. Unlike the copied topic link, this diagnostic text is not timed for automatic clipboard clearing; review it and overwrite the clipboard when finished.

ANGELTECH measures website document requests and trial or checkout handoffs using daily aggregate counts by page, landing page, button placement and a limited source category, such as Google search or the ntfy listing. These counts are retained for up to 90 days in a private Upstash Redis store connected through Vercel. They are not unique visitor counts. No IP address, full referrer URL, search query, email, notification content, session replay or visitor identifier is stored in this measurement.

Infrastructure request logs can contain the requested URL and query, network address, country, browser headers, request identifier, and response status under the host's policies. ANGELTECH does not copy those raw logs into the measurement store. Requests carrying Global Privacy Control or Do Not Track are excluded, as are recognized bots and prefetches.

If a visitor chooses checkout on the site, the same-origin, non-cacheable redirect can pass the allowlisted page and CTA placement, together with any validated Google click identifier, approved static ad variant and a random reference for that checkout, to Lemon Squeezy as custom checkout data. A signed purchase callback can match that reference to the source and landing page, retaining payment amount, currency, refund state and a keyed order hash for up to 90 days. Customer details and raw callbacks are not copied into the measurement store. The order hash prevents repeated callbacks from duplicating a purchase and lets refunds update the same record. Checkout references identify individual handoffs, not visitors.

Source and landing-page categories can travel in links while you browse the site. The site uses no attribution cookie or browser storage and cannot recognize you on a later visit or connect a later purchase inside the Mac app to a download. The redirect omits custom attribution when Global Privacy Control or Do Not Track is enabled.

From version 0.1.2, the app checks notiferry.com for updates daily by default. You can disable automatic checks in Settings → About and check manually. Update checks and downloads expose your network address and ordinary request headers, including app and operating-system versions, to the website host. System profiling is disabled. These requests do not include notification content, your topic, or license key. An update is installed only when you choose to install and relaunch.

Analytics

No product telemetry, analytics SDK, tracking pixel, session replay or persistent visitor identifier is enabled. First-party website measurement counts document requests and trial or checkout handoffs by limited source category, landing page, page and button placement. A random checkout reference can match a signed purchase callback. GPC and DNT requests are excluded; measurement data expires within 90 days.

Crash reporting

No automatic crash-reporting service is enabled in this release.

Cookies and browser storage

The website sets no NotiFerry analytics or advertising cookies and uses no browser local storage for attribution. Infrastructure providers may set strictly necessary security or abuse-prevention cookies under their own policies.

6. Trial, licensing, purchase, and support

macOS Keychain stores the random installation identifier, trial start, license key, activation instance, and validation timestamps. Trial history is intentionally retained across the in-app reset. The trial start and history remain in macOS Keychain after in-app reset and reinstall; they end only when the relevant Keychain item or device data is removed.

Activation and validation send the license key and an installation-derived instance name to Lemon Squeezy’s license API. The app receives license status and associated store, product, variant, activation, and validation metadata; Lemon Squeezy can associate the license with order and customer records. NotiFerry caches a successful validation for 24 hours and permits at most seven days offline after that validation.

Purchase/accounting records

Purchase, receipt, tax, and refund records are retained only as needed to operate the purchase and meet applicable legal obligations.

Support records

Support correspondence is retained while needed to answer and resolve the request, or longer when an applicable legal obligation or dispute requires it.

Website security logs

Site infrastructure processes ordinary request and security logs under its published policies. Separate private website measurement retains daily aggregate counts, checkout references and matched purchase/refund state for up to 90 days; raw requests and customer details are not copied.

7. Purposes, legal bases, and transfers

ANGELTECH processes information to provide support and perform the license contract, meet legal obligations, protect the product and users from abuse, and—where permitted on the basis of legitimate interests—measure website acquisition and checkout performance with limited, expiring data. Where applicable law requires consent, this measurement is not used unless that consent has been obtained.

Some independent providers operate outside the EEA. Their published privacy terms describe where they process data and the safeguards they apply.

ANGELTECH does not sell notification content or use it for targeted advertising or model training. Information may be disclosed when lawfully required or necessary to protect users, the service, or legal rights.

8. Retention, choices, and rights

Unsubscribing does not erase a message already cached by ntfy. Rotation prevents future use of the old topic but cannot guarantee deletion from independent infrastructure. Reset clears setup, ntfy secrets, preferences, and the queue, and attempts to release a paid activation; it intentionally retains trial history. Removing the app does not remove macOS Notification Center history or necessarily remove Keychain items.

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or objection for personal information ANGELTECH controls, and complain to a competent authority. Contact privacy@agentkey.dev. For data controlled by ntfy, Apple, Google, Lemon Squeezy, or the host, contact that provider. Checkout availability depends on Lemon Squeezy, applicable law, and payment restrictions.

9. Changes

Policy version 2026-11-03 is effective 2026-11-03. A material change to notification handling will be disclosed before the changed behavior is enabled where required by law.