Push Notifications & Your Metadata

VAULTEX never lets anyone — including us — read your messages. They are end-to-end encrypted on your device and stay that way. But notifications are a different problem from content, and on iPhone they involve an unavoidable tradeoff that we want you to understand and control. This page explains it in plain terms.

The short version: Push notifications are off by default. With them off, no outside company learns anything about your VAULTEX activity. If you turn them on, Apple sees when your phone is woken and from what network — but never what your messages say or who sent them. You choose.

Why is this even a question?

On Android, an app can keep its own connection to your server alive in the background, so VAULTEX can notify you without any third party involved.

iPhone does not allow that. Apple suspends background apps and blocks long-lived background connections. The only way Apple lets an app wake up your closed iPhone is a push through Apple's own servers (APNs). There is no exception — every secure messenger on iOS faces this, and the one project that refuses on principle (Briar) simply doesn't ship an iPhone app at all.

So on iPhone you get a genuine choice, and we surface it instead of hiding it.

What does Apple actually get?

If you leave push off (the default): nothing. No token, no signal, no metadata. Apple is not involved in your VAULTEX use in any way.

If you turn push on, Apple's push service can see:

• A device token — a random identifier for your specific app install.
• Timing — that your device was woken at a particular moment (which can hint at when you receive messages).
• Your IP address — at registration and each delivery, which reveals rough location and your network.
• The notification payload — which in VAULTEX is deliberately empty of meaning: it is opaque encrypted data (or a generic "you may have new messages"). Your phone decrypts the real content locally, after the wake-up, inside a sealed component Apple cannot see into.

What Apple never gets, in any mode: your message text, who messaged you, your contact list, your groups, or your encryption keys.

In one line: Apple may learn that you were pinged, when, and from where — never what was said or by whom.

Can Apple tie this to my real identity through my iCloud login?

Honestly: yes, potentially. This is the part most people don't realize.

The device token is issued through Apple's infrastructure on a phone that's signed into an Apple ID. Apple can connect token → device → Apple ID, and an Apple ID is usually linked to your real name, phone number, and payment method. So for a push-enabled user, Apple could in principle associate "this person receives VAULTEX wake-ups at these times from these networks" with a real identity.

Again — this is metadata, not content. Apple still cannot read a single message. But the pattern of being notified is something we'd rather you decide about knowingly. That's exactly why push is opt-in.

Does an anonymous Apple ID fix it?

It helps, but it's not a magic fix. An Apple ID created without your real name or payment raises the bar, but:

• Apple still sees your IP addresses unless you also mask every connection (e.g. a trustworthy VPN/Tor).
• Creating an Apple ID increasingly requires phone verification, and a phone number is itself an identifier.
• Downloading the app from the App Store ties some Apple ID to the install.
• If the phone was ever used with your normal Apple ID, or your carrier/SIM links it, the anonymity can unravel.

Treat an anonymous Apple ID as one useful layer, not a guarantee.

"Can't I just open the app to check for messages instead?"

Yes — and that's the most private option, which is why it's the default.

With push off, VAULTEX simply delivers your queued messages when you open the app (or, optionally, during occasional background check-ins your phone schedules). No Apple involvement, no token, no timing signal — at the small cost of not getting an instant banner when the app is closed. It works like email without push: you see everything the moment you open it.

For people facing serious surveillance threats, this manual / foreground mode is the recommended posture.

So what are my actual choices?

VAULTEX is moving to a tiered model so you pick your own balance of privacy vs. convenience:

You can also receive messages with no internet and no servers at all when another VAULTEX user is physically nearby (Bluetooth) — that path involves no Apple and no company whatsoever.

Our commitments if you do enable push

• Push is off until you turn it on, after a screen that says plainly what Apple will see.
• Payloads are always content-free — decryption happens only on your device.
• The record needed to route a push to you is treated as opaque, never logged, and deleted when you log out.
• Where possible, push registration is routed over Tor so it isn't tied to your network address.

This page describes a privacy/security tradeoff inherent to iOS, not a weakness unique to VAULTEX. The technical detail lives in our threat model and architecture decision record ADR-0003.