An Android app that receives notifications from a server you run. Every message is sealed with your phone’s own key before it leaves your machine, so Google carries a locked blob and cannot open it. No account with us, no subscription, and a server you can read the source of.
Each phone makes its own X25519 keypair when it pairs, and the private half never leaves it. Your server seals every message separately for every phone using NaCl’s sealed box. A stolen database, a stolen Firebase project and a stolen network capture between them still open nothing.
Delivery rides on your free Firebase project. You upload the service-account file once through the web page — no rebuilding the app, no account with us, and no shared infrastructure that could be subpoenaed or switched off.
Google is handed a locked blob and a delivery address. No title, no body, nothing to index. The notification you see is built on the phone, after it opens the box.
A single static binary per platform. No runtime to install, no database server, no reverse proxy required. Download it, run it, answer three questions.
Channels group your notifications; a sending key is a password for one script. Revoke one and that script stops — everything else keeps working. Keys keep their history, so you can see when one was last used.
The app lists the channels the server says this phone is on, with unread counts, newest message and a pull to refresh. Each server channel becomes its own Android notification channel, so you can silence backups and keep alerts loud.
Accounts, history and the Firebase key are encrypted with AES‑256‑GCM under a key file kept outside the database, so a copied database file is worth nothing on its own. Sign-in is a password, an authenticator code and recovery codes.
The server issues its own certificate authority and the pairing QR carries its fingerprint, so the app trusts that one server and nothing else — no warnings to click past, and no change to your phone’s trust store.
The whole server is published. Every claim on this page — that Google sees ciphertext, that no analytics exist, that nothing phones home — is something you can check rather than take on trust.
NotiPrivYO-Windows.exeNotiPrivYO-Windows-ARM.exeNotiPrivYO-Mac-AppleSiliconNotiPrivYO-Mac-IntelNotiPrivYO-LinuxNotiPrivYO-Linux-ARM64NotiPrivYO-RaspberryPiNotiPrivYO-FreeBSDdocker compose up, compose file in the repositorySHA256SUMS, so you can confirm what you downloaded is what was builttitle and body are each optional, at least one is required, and together they stay under 2 KBcurl -X POST https://your-server:8443/api/v1/send \ -H "Authorization: Bearer $NOTIPRIVYO_KEY" \ -H "Content-Type: application/json" \ -d '{"title":"Backup finished","body":"412 GB written, no errors"}'
Program Files, adds a Start menu entry and appears in Settings → Apps like any other programSHA256SUMS first if you would rather verify than trustcd ~/Downloads && curl -fsSL -o NotiPrivYO \ "https://git.cyrilina.it/CyriLiNa.IT/notiprivyo-server/releases/download/v1.1.0/NotiPrivYO-$([ "$(uname -m)" = arm64 ] && echo Mac-AppleSilicon || echo Mac-Intel)" \ && chmod +x NotiPrivYO && ./NotiPrivYO
curl attaches no quarantine flag, and chmod +x gives it permission to run. Both problems gone in one linexattr -c ~/Downloads/NotiPrivYO-Mac-AppleSilicon && chmod +x ~/Downloads/NotiPrivYO-Mac-AppleSiliconThe server is free and always will be. The app is a one-off.