Privacy

What we cannot read

Voice, video and messages on organisation and private channels are end-to-end encrypted. They are sealed on the sending device to each recipient device's public key, and the server relays bytes it has no key for. This is a property of the design, not a policy we promise to keep: there is nothing for us to hand over, because we never hold it.

Public channels are the exception, and the app labels them. Anyone may join one, so an end-to-end guarantee would be theatre. They get TLS in transit and encryption at rest instead.

So are conversations with push.tt support — see Contacting support below.

There is no forward secrecy yet. A stolen device key could expose that device's past messages. A ratchet is planned; until it ships, we would rather write this down than let a padlock icon imply more than it delivers.

What we do store

• Your account: username, display name, the organisation you belong to, and your devices' public keys.
• Message and recording metadata — who spoke on which channel and when — because delivery, history and billing need it.
• Recordings and attachments, as ciphertext. The storage provider holds bytes it cannot open; the key that opens them lives in our database, not with the files.
• An append-only audit trail of administrative actions, including every time a staff member opens an organisation's message archive.
• A record of each connection the app makes to our servers: the IP address it came from, which of our servers answered, the device and app version, and when it opened and closed. Only push.tt staff can see it, to work out why somebody cannot connect or is reaching the wrong server, and to look into abuse — for example several accounts being run from one place. It is deleted 30 days after the connection ends, and with your account. Visitors using the support chat or the taxi booking pages on this website, and website demo accounts, are not recorded.
• The days you used the app: one record for each day you came online, with the kind of device (Android, iPhone, web), so we can count how many people use push.tt and whether they keep using it. Kept 400 days, and deleted with your account.
• When Google's push service tells us the app on one of your devices is no longer registered — usually because it was uninstalled — we note that and the day before discarding the registration, so we can count uninstalls. Kept 400 days, and deleted with your account.

Things that are off unless your organisation turns them on

Each of these is refused by the server until an administrator acknowledges, in writing, what it changes. That refusal is enforced server-side, not by the app being polite.

• Retention — keeping organisation-channel history where administrators can read it.
• Keeping deleted messages.
• AI transcription. Speech-to-text runs on the phone that recorded it; the transcript is encrypted before it leaves.
• Device management — kiosk mode and location reporting on company-owned handsets.
• Navigation — the handset tells a routing provider where it is and where it is going.
• Bridging a channel to a radio — after which anyone with a scanner in range can hear it. No amount of encryption changes that, which is why the warning is worded the way it is.

When someone joins an organisation, they are shown which of these are actually switched on for it — not a list of what could be.

Where your data physically is

push.tt runs cells in Dallas, Mexico City, Toronto and Nuremberg, all served by one primary database in Dallas, United States. Your handset connects to the nearest cell; the data lives in the US. If your organisation needs data resident in a specific jurisdiction, ask us — that is a deployment question with a real answer, not a checkbox.

Third parties

• Object storage holds recordings and attachments as ciphertext it cannot decrypt.
• Map tiles and terrain come from OpenFreeMap and OpenStreetMap data. Loading a map tells that provider roughly where you are looking.
• Routing, when navigation is enabled, sends the handset's position and destination to a Valhalla endpoint.
• Telephony, for World Phone numbers and SMS, goes through Twilio and is subject to their terms and to lawful interception on the public telephone network.
• Payments go through Stripe. We never see a card number.
• Push wake-ups may use Firebase where it is available. The payload is deliberately content-free — it says "something happened", never what.
• Measuring our ads uses Google's Firebase Analytics in the Android app, as described below. In the EU, the EEA, the UK and Switzerland it sends nothing unless you allow it.

Crash reports

Crashes are recorded with a fingerprint, capped per organisation, and visible only to that organisation and to push.tt staff. They carry no message content.

Install notice

The first time a new install of the Android app opens, before there is any account, it sends us one message saying the platform (Android) and the app version. Nothing else: no account, no device identifier, no phone model, no location. We keep those two facts and the time so we can count installs. The address the message came from is used only to stop floods and is not stored. Updating the app does not send it, and it is sent once per install.

Website analytics

This website measures its own traffic with software we run ourselves. There are no third-party analytics, advertising pixels or tracking cookies, and nothing is sold or shared. We record the pages you open and for how long, the site that sent you and any campaign tag in the link, your browser and operating system family, your screen size, language and time zone, and a few clicks — downloading the app, opening the console or the support chat.

How much more depends on where you are, and on what you choose:

• In the EU, the EEA, the United Kingdom or Switzerland — or anywhere we cannot place your address — the site asks first. Until you choose Allow, you are recorded anonymously: the country only, no address, no browser string, nothing kept in your browser, and an identifier that changes every day, so a visit tomorrow cannot be linked to today's.
• Elsewhere, and anywhere you choose Allow, we also keep your network address, the full browser string, an approximate city and region worked out from the address on our own server (from DB-IP's free location database, so no outside service sees it), the full address of the page that linked here, and an identifier stored in your browser so a return visit is recognised.

Privacy choices, at the foot of every page, changes your answer at any time. Choosing anonymous visits also makes anonymous what we already hold under your browser's identifier, there and then. A browser sending the Global Privacy Control signal is treated as having chosen anonymous visits. The address, browser string and full referring address are removed after 30 days; everything else is kept for 400 days. Only push.tt staff can see any of it.

Measuring our ads

push.tt advertises its Android app on Google. So that those ads can find people who go on to use push.tt rather than people who install it and leave, the Android app reports usage events to Google through Firebase Analytics: when the app is opened and how long it is used, when it is installed, updated or removed, when an account is created, and purchases made through Google Play. Each event carries a random ID for that install, plus the app version, the phone's model and operating system, and an approximate country.

They never carry your name, username, phone number or account, your messages, voice, contacts or location, or the Android advertising ID — the app does not read it. Ad personalisation is switched off: the events measure our ads, they do not decide which ads you see. Google receives them to provide that measurement; we do not sell them or pass them to anyone else.

You choose. In the EU, the EEA, the UK and Switzerland the app sends nothing until you tap Allow when it first asks. Everywhere else it is on until you turn it off in Settings → Share usage events with Google. Either way you can change your mind there at any time. The website, the dispatch console and the iPhone web app send none of this.

Contacting support

When you contact support — from Contact support in the app, by reporting a problem, or from the chat on this website — the conversation is not end-to-end encrypted, and every screen that starts one says so. The push.tt support team can read it, text, photos and voice messages alike, so that whoever is on duty can pick it up and the answer survives the team changing. It is kept as the record of your request; deleting your account deletes it.

A chat started from this website with no account is kept the same way. It carries only the name you choose to give, if any, and what you write or say in it.

Reporting a problem from the app

The in-app report opens a support conversation with what you wrote, and attaches your account, organisation, app version and handset model as a note only the support team sees. The screen says so before you send it. It carries no other message content, location or recordings.

Deleting your account

You can delete your account yourself, from Settings → Your account → Delete account in the app, or ask us to do it if you cannot reach the app. That removes your profile, devices, keys, sessions, sent messages and direct conversations.

Two things deliberately survive, and both are on the delete your account page in full: a channel you own that other people are still in is handed to another member rather than destroyed, and if you ever bought anything the purchase record is kept — required of us, and our own rule is that nothing deletes a record of money moving. In that case your account row remains as a tombstone with no name, no address, no password and no key.

Asking us about your data

Write to us through the contact page. Note that for anything end-to-end encrypted the honest answer is that we cannot produce it — your organisation's administrators can, from their own key, if retention is on.