Privacy Policy — Beeping

Overview

Beeping is a paging/alerting app: it lets a device generate pairing codes so it can be paged by scripts, monitoring tools, or teammates, and lets a signed-in sender generate API keys to send those pages. There's no email/password account and no separate login — each install is identified by an anonymous Firebase Authentication ID, not by your name, email address, or phone number.

We don't run ads and don't use analytics or advertising SDKs in this app. The only data collected is what's functionally required to register your device for push notifications, manage pairing codes/API keys, and enforce subscription entitlements.

Data we collect

Data	Why we collect it
Anonymous device/account ID	A random identifier assigned by Firebase Authentication when you first open the app. Used to scope your devices, pairing codes, API keys, and subscription to you. Not linked to your name or email.
Push notification token (APNs/FCM)	Required to deliver pages to your device. Stored against your device record so the backend knows where to send a push when someone pages you.
Display name	Optional, entered by you in Settings. Shown nowhere except your own device currently — stored so it can be reintroduced in future features (e.g. identifying a device to a sender) without a separate migration.
Do Not Disturb schedule	When you pause notifications, the end time is stored so the backend can skip non-critical pages until it passes.
Pairing codes	Short codes you generate to let others page your device. Stored with a reference to your device ID so an incoming send request can be routed to the right device.
API keys (hashed only)	If you send pages, you generate an API key. Only a one-way cryptographic hash of the key is stored — the plaintext value is shown to you once, at creation, and cannot be recovered by us or anyone else afterward.
Subscription/entitlement status	If you subscribe, we store your subscription tier, status, and Apple's transaction identifier to determine your plan's monthly send allowance and API key / pairing code limits. Apple handles your actual payment information — we never see or store your card details.
Send quota usage	A monthly counter of how many pages you've sent, used only to enforce the free-tier monthly limit. Resets automatically each calendar month.

How we use it

Everything above is used strictly to operate the app: registering your device for push delivery, routing pages sent to your pairing codes, authenticating API requests, and determining your subscription entitlements. We do not sell any of this data, and we don't share it with third parties except the infrastructure providers described below, which are necessary to run the service.

What stays on your device

Your page/alert history — the title, body, severity, timestamps, and acknowledgment status of every page you've received — is stored locally on your device only, using Apple's SwiftData framework. It is never uploaded to our servers. Deleting an alert (or clearing all of them) from the Alerts tab removes it permanently from your device with no server-side copy to also delete.

Third-party services

Beeping is built on top of a small number of infrastructure providers, each of which processes data strictly to provide their respective service to us:

Provider	Purpose
Firebase (Google)	Anonymous authentication, Firestore database (devices, pairing codes, API key hashes, subscription records), and Cloud Functions (the backend that sends pages).
Apple Push Notification service	Delivers pages to your device. Apple sees the push payload (title, body, severity) in transit but Beeping does not control Apple's own data handling of push delivery infrastructure.
Apple App Store / StoreKit	Processes subscription payments and reports transaction/renewal status to our backend via App Store Server Notifications. We never receive your payment card details.

We don't use any advertising networks, analytics SDKs, or data brokers.

Sender-configured webhooks

When sending a page, a sender may optionally attach a webhook URL. If the recipient acknowledges that page, their device sends an HTTP POST containing the message ID, pairing code, and page content directly to that URL.

This webhook URL is chosen by whoever sends the page, not by Beeping, and the request goes directly from the recipient's device to that URL — it does not pass through our servers. If you send pages with a webhook configured, you are responsible for how your own endpoint handles the data it receives. If you receive pages with a webhook attached by the sender, review who you're accepting pairing codes and pages from, since the sender controls where an acknowledgment is sent.

Data retention & deletion

Pairing codes and API keys are retained until you revoke them yourself from Settings — revocation is immediate and permanent. Your device record (push token, display name, Do Not Disturb schedule) persists as long as the app is installed and signed in; uninstalling the app does not automatically delete it from our database today, but it becomes unreachable since no push token can be re-registered without reinstalling. To request deletion of your account data, contact us using the details below.

Children's privacy

Beeping is not directed at children under 13, and we do not knowingly collect data from children under 13. If you believe a child has provided us data, contact us and we'll delete it.

Security

API keys are stored only as one-way SHA-256 hashes — the plaintext value is never persisted after being shown to you once at creation. Access to your device, pairing codes, and API keys is scoped server-side to your own anonymous account ID; Firestore security rules and backend authorization checks prevent one account from reading or modifying another's data.

Changes to this policy

If this policy changes materially, we'll update the "Last updated" date at the top of this page. Continued use of the app after a change constitutes acceptance of the updated policy.

Contact

Questions about this policy or a request to delete your data can be sent to [email protected].