Privacy Policy

中文 / Chinese →

Overview

NotifyForward ("the App," "we," "our") is a utility that reads incoming notifications, SMS messages, and missed-call notifications on your device and forwards them to destinations you configure—such as Bark push servers, email addresses, SMS recipients, or Webhook endpoints (any HTTP/HTTPS URL you control). This Privacy Policy explains what data the App accesses, how it is handled, and your rights.

Before any sensitive data is accessed, NotifyForward presents this policy for your explicit consent on first launch; nothing is forwarded and no sensitive permission is requested until you accept.

Data the App Accesses

To provide its core forwarding functionality, the App accesses the following types of data on your device:

• Notification content — Title, body text, app name, and timestamp of notifications you receive on your device. This is read via the Android NotificationListenerService API, which you must explicitly enable in system settings.
• SMS messages — Sender phone number and message body of incoming SMS. This is read via the SmsReceiver component when you enable SMS forwarding and grant the Receive SMS permission.
• Missed-call notifications — When missed-call forwarding is enabled, the App detects missed-call notifications (Android CATEGORY_MISSED_CALL) through the NotificationListenerService and forwards the caller information. The App does not use the READ_PHONE_STATE permission or any call-screening role.
• Installed applications list — Used solely for the App Filter feature so you can choose which apps' notifications to forward. Accessed via the Android package-visibility <queries> mechanism, which exposes only launchable apps (not QUERY_ALL_PACKAGES).

SMS and missed-call forwarding are off by default; the first time you enable either, a one-time disclosure dialog explains what is accessed and asks for your confirmation. The App does not access your contacts, camera, microphone, location, photos, or any files on your device.

How Data Is Stored

Your configuration settings—such as Bark server URLs, email credentials, SMS forwarding numbers, Webhook endpoints and bearer tokens, and app filter preferences—are stored exclusively on your device. Sensitive credentials (email passwords and Bark device keys) are encrypted at rest with the Android Keystore (AES-256-GCM); other settings are kept in Android DataStore.

• Settings are never uploaded to any remote server.
• Notification content is forwarded in real time and is not persisted by the App beyond the brief moment required for transmission.
• No analytics, crash reporting, or usage tracking SDKs are embedded in the App.

Third-Party Services

The App forwards data to destinations you explicitly configure. These are third-party services and are governed by their respective privacy policies:

• Bark push service — If you configure a Bark server URL, notification content is sent to that server via HTTPS. You may use a self-hosted Bark instance or the public Bark service. See Bark on GitHub for details.
• SMTP email delivery — If you configure email forwarding, notification content is sent through the SMTP server you specify (e.g., Gmail SMTP, custom mail server).
• System SMS service — When SMS forwarding is enabled, the App uses the standard Android SmsManager API to send SMS messages. Charges from your mobile carrier may apply.
• Webhook endpoints — If you configure a Webhook target, the App sends an HTTP request (POST JSON body or GET query string) to the URL you specify. Webhook traffic uses HTTPS with certificate validation by default. You may opt to skip TLS verification for a single target only (e.g., a self-signed or LAN server); this is never applied globally and does not weaken other channels. Any Bearer token you provide is encrypted at rest with the Android Keystore (AES-256-GCM) and is sent only as Authorization: Bearer <token> to your configured endpoint. The endpoint URL, request payload, and token are entirely under your control—we do not relay, proxy, or log them.

Data Security

We take reasonable measures to protect the data processed by the App:

• All network communication with Bark servers uses HTTPS encryption. Webhook forwarding also uses HTTPS with certificate validation by default; skipping verification is an explicit, per-target opt-in that never applies globally.
• Email passwords and Bark device keys are encrypted at rest with the Android Keystore (AES-256-GCM) and are only decrypted in memory when used for SMTP authentication or Bark requests.
• We recommend using app-specific passwords (not your primary account password) for email forwarding.
• The App runs entirely on-device; there is no server-side attack surface.

Your Rights

Under applicable data protection laws (including GDPR and CCPA where applicable), you have the following rights:

• Transparency — You can review exactly what data the App accesses at any time via the Android system permission manager and the App's settings screens.
• Control — You can revoke any permission (Notifications, SMS) at any time through Android Settings. The App will continue to function for the remaining enabled channels.
• Deletion — Uninstalling the App removes all locally stored configuration data. Since we do not store any of your data on our servers, no additional deletion request is necessary.
• Access — All data the App holds about you is configurable within the App itself, so you can review and modify it at any time.

Children's Privacy

NotifyForward is not intended for use by individuals under the age of 13. We do not knowingly collect or process data from children under 13.

Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:

• Email: kefu@jujumi.top
• Response time: We aim to respond within 3 business days.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the App after changes constitutes acceptance of the updated policy.