Privacy

The Hedgerow app

What it stores on your phone

• Your connections: the name, address and kind of each server you add, in the app's own storage.
• API tokens for those servers, in the iOS Keychain, for this device only. They are not synced to iCloud and not included in backups. They can be read after the phone has been unlocked once since it started, so the notification extension can fetch a notification's text while the phone is locked. They are sent only to the server they belong to.
• Small settings: which connection is selected per service, whether notifications are on, and the bookkeeping for notifications described below.

Where it connects

To the addresses you added, over HTTPS (plain HTTP only for addresses on your own network). It does not follow a redirect to another host. With notifications on, it also connects to Postal Pigeon (below). There are no other connections: no analytics, crash reporting or advertising services.

Notifications

Notifications are off until you turn them on in the app, and a server sends none until its administrator adds the "Hedgerow app" channel. When you turn them on:

1. iOS gives the app a device token (an address in Apple's push system). The app registers it with Postal Pigeon.
2. For each connection, the app asks the relay for an opaque handle and gives that handle to that one server. The server keeps it encrypted, tied to your user and the token you used.
3. When something happens, the server stores the text of the alert for 24 hours under a random reference and asks the relay to push "something happened" with that reference.
4. On your phone, the notification extension looks up which connection the push is for, fetches the text from that server with your token, and shows it. If it can't, you see the generic "Something needs your attention".

The app never opens a link, follows an address or runs a command from a push. Turning notifications off for a connection, removing a connection or turning notifications off entirely deletes the handles at the relay and at your servers.

Postal Pigeon, the push relay

Apple only lets the holder of the app's push key send notifications to it, so self-hosted servers can't reach your phone directly. Postal Pigeon is the small relay that does it for them. It runs at pigeon.hedgerow.tools, operated by the Hedgerow project.

What it stores

• Your device token, encrypted, with the app and whether it is a test or store build, when it was registered and the date it was last seen.
• For each handle: a hash of it, a random tag your app chose, when it was made and the date it was last used.
• For each server: a random id, its product and version as it reports them, the date it was last used, and for 30 days the first part of the address it registered from (a /24 or /48 network), for abuse limits.
• Daily counts of pushes per server, for 30 days. No device or handle appears in them.

Never stored: any notification content (there is none), the reference a push carries, your server's name or address, your API tokens, or which server a device or handle belongs to.

What it can see while working

• The internet address of your phone when the app registers, and of your server when it sends a push.
• At the moment a push is sent, which server asked for which handle. The relay doesn't store or log that pair, but a modified relay could. That is the honest limit of "the relay doesn't know which server you use".
• How many handles your device has (roughly how many servers you connected), but not which.

The relay's logs hold no tokens, handles, references or addresses. The reverse proxy in front of it keeps ordinary access logs (time, address, path) for at most seven days.

How long

A device is deleted when the app turns notifications off, when Apple says the token is no longer valid, or after 90 days without contact. A handle goes when it is revoked or its device is deleted. A server's registration is deleted after 180 days without use.

What Apple sees

The device token, the app, the time and a tiny payload: a type, the random tag and the random reference. Apple's privacy policy applies to that.

The relay's code and design are public: github.com/Ferdinand99/Postal-Pigeon. If you'd rather not use it, the app and the servers work without notifications, and you can run your own relay with your own app build.

Your servers

Vigilant Vole, Keen Kestrel and Wise Wren run on machines you or your organisation control, and you are responsible for the data on them. The Hedgerow project has no access to them. The only thing they send to us is a push request with a handle and a random reference, and only when a "Hedgerow app" channel is set up.

TestFlight and the App Store

When you install the app through TestFlight or the App Store, Apple may share crash reports, usage statistics and feedback with us if you agreed to that on your device or in TestFlight. We only use them to fix the app.

This website

hedgerow.tools is hosted on GitHub Pages and sets no cookies. Visits are counted with our own Keen Kestrel, which keeps no IP addresses or lasting identifiers and respects Global Privacy Control. GitHub, as the host, may log requests under its own privacy statement.

Your choices and rights

You can turn notifications off in the app at any time, which deletes your device at the relay. Deleting the app removes everything it stored on your phone. Because there is no account, we can't look you up by name or e-mail; if you want something about your device deleted or explained, contact us and we'll help with what the relay holds. You can also complain to the Norwegian Data Protection Authority (Datatilsynet).

The app is not directed at children.

Contact and changes

The Hedgerow project is run by Ferdinand99 in Norway. Write to kontakt@opland.net about privacy, or use the Hedgerow app's issue tracker. Security problems go through a private report on the repository's Security tab.

When this page changes, the date at the top changes too, and the full history is in the website's repository.