Privacy & security

Your server handles messages and cards

Your chosen self-hosted server receives business requests, stores message history and current card state, and manages devices and subscriptions. Its operator is responsible for the server, access controls, retention, backups, and deletion policies.

System notifications use Apple Push Notification service (APNs). Self-hosting does not remove that third-party delivery service. Choose notification content with your data sensitivity requirements in mind.

Business APIs and sending credentials

You manage permissions and credentials for business APIs used by fetched data sources. Authentication configuration is stored on your server; devices read prepared card data rather than holding business API keys directly.

Message and source update URLs also contain credentials. Share them only with tools that need to send. Revoke affected access if a credential leaks. Protect admin passwords and backups containing secrets.

Connections and push identity

The App can connect over HTTP or HTTPS. HTTP does not encrypt logins, credentials, or content; valid HTTPS is recommended for public access.

Ordinary users do not enter APNs private keys or Apple developer identity in the Web console. The official installer will configure the identity matching the official client; production identity and public packages are still in preparation.

Your own model, explicit actions

AI-assisted design uses copied instructions, pasted JSON, and explicit validation and preview. You choose and use your model; Vao Push does not hold or proxy third-party LLM API keys. Check for sensitive business data before sharing material with a model.

Browser data on this website

This website stores language and appearance preferences locally in your browser so they can be restored. Clear site storage to reset them. Demos use fixed fictional data, do not connect to business APIs or send messages, and do not access your microphone or model services.

Static hosting still processes network requests and access logs needed to serve pages. Final product privacy materials will accompany the public release.