NotiPrivYO server

Free, open-source, self-hosted server for NotiPrivYO — end-to-end encrypted notifications to your own Android phone.

• You run this. Nobody else sees your messages, and there is no account with anybody.
• Delivery goes through your own free Firebase project. Google only ever carries ciphertext — no title, no text, nothing readable.
• Every phone has its own key. Each message is sealed separately for each device.
• A web page for people, an API for scripts. Everything an operator must do has a page. Sending is a single HTTP call from anything that can make one.
• Encrypted out of the box. HTTPS with no configuration, on a network with no domain name.

The paid Android app is sold separately by CyriLiNa.IT LLC. This server is free, and always will be.

Installing it

Download the one file for your machine and run it. That is the whole install.

Your machine	File
Windows	NotiPrivYO-Windows.exe
Mac, Apple Silicon	NotiPrivYO-Mac-AppleSilicon
Mac, Intel	NotiPrivYO-Mac-Intel
Linux	NotiPrivYO-Linux
Raspberry Pi	NotiPrivYO-RaspberryPi
Synology or QNAP, Intel or AMD inside	NotiPrivYO-Linux
Synology or QNAP, ARM inside	NotiPrivYO-Linux-ARM64
TrueNAS SCALE	NotiPrivYO-Linux
TrueNAS CORE, FreeBSD	NotiPrivYO-FreeBSD

Most Synology and QNAP models sold in the last few years have an Intel or AMD processor, not ARM. If you are not sure, the Linux one is the likelier of the two.

Double-click it. It finds a free port by itself, issues its own certificate, opens your browser at the right page with the setup code already filled in, and asks you the rest on screen.

No installer. No runtime to install. No database to set up. No configuration file to edit. Nothing to type.

On a machine with no screen — a NAS, a VPS — it prints the address and the setup code, and also writes them to START-HERE.txt in its data folder, so you can open that with the NAS's file manager instead of hunting through a log. That file disappears the moment somebody claims the server.

Docker, if you would rather:

git clone https://git.cyrilina.it/CyriLiNa.IT/notiprivyo-server.git
cd notiprivyo-server && docker compose up -d --build
docker compose logs notiprivyo

What the first run asks you

1. Which addresses people will use — already filled in with what your machine answers on. Add a Tailscale address or a .local name if you want one. The certificate is issued for these.
2. How people reach this server — no domain, your own certificate, Let's Encrypt, behind nginx, or Tailscale. It cannot guess, so it asks.
3. Your account — a username, a password and an authenticator app. No email address, anywhere. You are given ten recovery codes; they are the only way back in, so keep them.
4. Firebase — a walkthrough, not a link to Google's docs. It costs nothing; Cloud Messaging is free on Firebase's no-cost plan. The key you upload is checked against Firebase before it is kept, so the wrong file is caught immediately rather than three days later.

Settings also has starting with the computer, so a reboot does not stop your notifications. On Windows, Mac and desktop Linux it is a switch and needs no administrator password. On FreeBSD there is no per-user way to do it, so the page gives you the one line to paste instead of a button that would quietly do nothing.

On a NAS, the container manager's own "restart automatically" setting does this job, and the page says so rather than offering a switch that cannot work inside a container.

Removing it

NotiPrivYO is one file, not an installed program, so it does not appear in Windows Apps or in Applications on a Mac. Settings → How to uninstall lists everything it put on the machine and walks through it: stop the server, remove the startup entry, delete the file, and — only if you mean it — delete the data folder.

There is deliberately no button that deletes your data. That folder is your accounts, your paired phones and your whole message history, and a button that erases it is a button somebody clicks by mistake once.

Sending a message

curl -X POST https://your-server:8443/api/v1/send \
  -H "Authorization: Bearer $NOTIPRIVYO_KEY" \
  -H "Content-Type: application/json" \
  -d '{"title":"Backup finished","body":"412 GB, no errors"}'

Examples for shell, Python, PowerShell and Go, and the full list of replies, are in SENDING.md.

Certificates, without the usual pain

With no domain name, the server runs a small certificate authority of its own. Trust it once on a laptop and you are done for ten years — the certificate actually served is renewed automatically behind it, so nothing ever has to be re-trusted.

Your phone needs nothing. The pairing QR code carries that authority's fingerprint, so the app recognises your server by itself.

The authority can only vouch for this machine and for private network addresses. Even if its key were stolen, it could not be used to impersonate a public website.

Back this up

Settings → Download a backup. One encrypted file with everything on it: your accounts, your phones, your channels, your message history, the key that opens it and the certificate your devices trust. Choose a passphrase for the file and keep that somewhere other than the file.

Do not just copy the files. The database is written to in the background, so a copy taken with rsync, Time Machine or a NAS backup tool while the server is running can be missing whatever happened most recently — and it will restore without complaining. That is how a backup silently becomes an empty server.

If you do copy by hand, stop the server first, and take all of these:

File	What it is
notiprivyo.db, notiprivyo.db-wal, notiprivyo.db-shm	accounts, phones, channels, keys, encrypted history — all three, the -wal is not a temporary file
vault.key	the key that opens that history
ca.key, ca.crt	the certificate authority your devices trust
firebase-key.json	your Firebase service-account key

Keep vault.key somewhere other than the database. Together they are your message history in plain text. Apart, each one is useless.

If you ever restore notiprivyo.db without vault.key, the server will not start, and it will not quietly make a new key. It says so in its console output and on a page in your browser, and that page will take the key file back from you.

How it is put together

ARCHITECTURE.md is the build spec: encryption, data model, permissions, the HTTP surface, the setup wizard and the contract with the Android app.

CRYPTO-PARITY.md explains the one thing shared with BirdWatch — the sealed-box code and its wire format — and the rule that a security finding in one must be fixed in the other.

Licence

AGPLv3. Copyright © 2026 CyriLiNa.IT LLC.

Run it, change it, share it. If you modify it and run it for other people, publish your changes. The Android app is a separate program and is not covered by this licence.