This Privacy Policy describes how Pushoney handles personal data and is provided for general information; it is not legal advice. It is intended to align with Moroccan Law 09-08 and the EU General Data Protection Regulation (GDPR). For deployments with specific regulatory obligations, please review it with your own counsel.
Pushoney is operated from Casablanca, Morocco and is the data
controller for personal data of account holders (the
customers who register at portal.pushoney.com).
For personal data of subscribers (the end users of websites operated by our customers, who receive push notifications), Pushoney acts as a data processor on behalf of the customer who operates the originating website. The customer is the data controller for that data.
| Data | Why | Legal basis |
|---|---|---|
| Email address, password hash | Authentication, account recovery, transactional email | Contract performance (Art. 6(1)(b) GDPR) |
| Hub configuration (domain, branding, settings) | Operating the Service for you | Contract performance |
| Login IP, user-agent, session timestamps | Security: detecting unauthorised access; "Active sessions" feature | Legitimate interest (Art. 6(1)(f)) |
| Audit log entries (signups, logins, password changes, campaign sends, API key creation, etc.) | Security, dispute resolution, regulatory compliance | Legitimate interest + legal obligation |
| 2FA secret (AES-256-GCM encrypted) and recovery codes (bcrypt-hashed) | Two-factor authentication | Contract performance + your explicit opt-in |
| PayPal email (only if monetisation enabled) | Routing payouts | Contract performance |
| Data | Why |
|---|---|
| Browser push endpoint (a unique URL issued by the subscriber's browser) | The technical address required to deliver a push notification |
| Public encryption keys | End-to-end encryption of push payloads (Web Push protocol) |
| IP address, user agent, browser, OS, device type (collected at subscribe time) | Geo-targeting, device-type filtering, abuse detection |
| Country, region, city (derived from IP via MaxMind GeoLite2) | Geo-targeting + analytics |
| UTM parameters and source attribution | Acquisition channel attribution |
| Send / delivery / click / conversion events | Campaign analytics + advertiser attribution |
We do not collect, derive, or store the content of the messages a subscriber receives outside of what the originating customer pushes. We do not collect names, email addresses, or other directly-identifying information about subscribers.
The portal at portal.pushoney.com uses two
cookies, both classified as strictly necessary under the EU
ePrivacy Directive:
pp_portal — your
authenticated session. HttpOnly, Secure, SameSite=Lax,
30-day TTL.pp_attr — UTM/source
attribution captured for the iOS-PWA install flow so
attribution survives the standalone-mode subscribe.
HttpOnly, Secure, SameSite=Lax, 24-hour TTL.Customer-operated hubs (the websites that integrate the Pushoney embed snippet) may set additional cookies; that is governed by each customer's own cookie policy.
See Cookie Policy for the full list.
We do not sell personal data. We share it only with:
[email protected].Pushoney's infrastructure is hosted in Europe. When personal data is transferred from the European Economic Area to Morocco or other jurisdictions, we rely on appropriate safeguards including the European Commission's adequacy decision for Morocco (where applicable) or Standard Contractual Clauses.
| Data | Retention |
|---|---|
| Account data (email, hubs, settings) | Until you delete your account |
| Audit log entries | 3 years from event date, then deleted |
| Subscriber data | Until the subscriber unsubscribes or the customer's hub is deleted, whichever comes first |
| Send / Click / Conversion events | 2 years from event date |
| Active sessions | 30 days of inactivity, then expired automatically |
| Email verification / password reset tokens | 24 hours from issuance |
Under the GDPR, Morocco Law 09-08, and equivalent regimes, you have the rights to:
To exercise any of these rights, email
[email protected] from the address registered
to your account. We respond within 30 days.
To stop receiving notifications on this device:
use the “Stop notifications” action on any recent
push notification, or visit
https://<the-site-domain>/unsubscribe while
using the same browser you originally subscribed in. Either
flips your device's subscription to “gone” and we
stop sending. Re-subscribing later is a one-click action from
the originating site.
If you are a subscriber (an end user who receives push
notifications from a website that uses Pushoney) and you wish
to exercise data-subject rights, please contact the operator
of the originating website first; they are the data controller.
If they do not respond within a reasonable time, you may also
contact us at [email protected] and we will
forward your request and, where possible, act on it directly.
The simplest way to stop receiving notifications is to revoke push permission in your browser settings — that immediately invalidates the push endpoint and we mark your subscription as gone.
We apply industry-standard security controls: encrypted transport (TLS), encrypted secrets at rest (AES-256-GCM for 2FA secrets, bcrypt for passwords and recovery codes), audit logging, two-factor authentication for accounts, role-based access control, regular dependency updates, and active abuse-detection systems. No system is perfectly secure; if we become aware of a personal-data breach affecting you, we will notify the relevant authorities and affected individuals without undue delay as required by applicable law.
Pushoney is not directed at individuals under 16. We do not knowingly collect personal data from children. If you believe a child has registered an account, contact us and we will delete the account.
We may revise this Policy from time to time. Material changes will be communicated by email or through the account dashboard at least fourteen (14) days before they take effect, except where the change is required for legal or security reasons.
Privacy questions, data-subject requests, and breach reports
should be sent to [email protected]. Mail and
in-person inquiries can be addressed to our operations base
in Casablanca, Morocco.