Relay terms
Effective date: 5 October 2026 · Version: 1.0
Summary
- The relay delivers push notifications from your own InfraInbox server to the InfraInbox iPhone app. It is free and needs no account.
- Notifications are end-to-end encrypted. The relay forwards bytes it can’t read.
- Fair use: up to 30 notifications a minute to each phone, plus the limits in section 4. A homelab is far below them.
- There is no uptime promise. For alerts that matter, keep a second channel.
- Before we lower a limit, start charging or shut the relay down, we tell you well in advance.
1. What these terms cover
1.1. The relay. The InfraInbox push relay at https://push.infrainbox.app (the “Relay”) is run by INNOVA SOFTWARE S.R.L., Romania, Trade Register J30/1284/2021, CUI 45402130 (“we”). The App Store version of the InfraInbox app can receive push notifications only through a service holding our Apple credentials; the Relay is that service.
1.2. Who they apply to:
- Operators: whoever runs a self-hosted InfraInbox server that sends notifications through the Relay. On a self-hosted server the Relay is on by default; you can turn it off with
push.relay.enabled: false. - App users: anyone who pairs the InfraInbox app with a self-hosted server and so registers their phone with the Relay.
By sending through the Relay, or registering a phone with it, you accept these terms.
1.3. What they don’t cover: the self-hosted software, which stays under its open-source licence (AGPL-3.0 for the server), and these terms don’t limit any right it gives you; InfraInbox Cloud, which has its own Terms of Service; and the app itself, which is licensed under Apple’s standard licence agreement for App Store apps.
2. How the Relay works
2.1. The path. Your server encrypts each notification for one paired phone, using that phone’s own key (RFC 8291), and sends it to the Relay signed with your server’s VAPID key (RFC 8292). The Relay passes it to Apple’s push service, and the app decrypts it on the phone.
2.2. What the Relay can and can’t see. It can’t read, change or forge your notifications. It does see the phone’s push token; your server’s IP address and public VAPID key; and each message’s time, size and urgency. Apple sees the push token and a generic text, which the app replaces after decrypting.
2.3. What the Relay stores, and for how long:
| Data | Kept |
|---|---|
| Registration: ID, platform, environment, push token (encrypted at rest), your server’s public VAPID key, a hash of the management secret, the critical-alert setting, timestamps | Until the app removes it. Deleted 7 days after Apple rejects the token, or after 180 days without use |
| Daily send counts per VAPID key (the key stored as a hash) | 8 days |
| Service and web-server logs, without push tokens or message content | 7 days |
| Message content | Never stored |
Our Privacy Policy (section 5) explains how we handle this data.
3. Free, with no account
3.1. The Relay is free. You don’t need an InfraInbox account; your server’s identity is its VAPID key.
3.2. If we introduce a paid tier, we give at least 90 days’ notice here, in the self-hosted server’s release notes and on our website. A paid tier will not reduce the free fair use below the limits in section 4.1; it adds higher limits for those who want them. We never charge you unless you sign up and agree to pay.
4. Fair use
4.1. Current limits:
| What | Limit |
|---|---|
| Notifications to one registration (one phone and one server) | 30 per minute |
| Send requests from one IP address | 1,200 per minute |
| New registrations from one IP address | 10 per minute |
| Size of one encrypted message | 2,800 bytes |
Over a limit, the Relay answers HTTP 429 with Retry-After, and your server shows it on the device.
4.2. You must not:
- use the Relay for anything other than InfraInbox notifications to phones whose users paired them with your server;
- send marketing, bulk or unsolicited messages;
- spread sending across many VAPID keys or IP addresses to get around a limit;
- load-test, scan or attack the Relay, or try to reach other registrations (our security policy covers good-faith research);
- use the Relay from software that pretends to be InfraInbox to reach phones that never paired with it;
- use the Relay in breach of the law, EU or UN sanctions, or Apple’s terms for push notifications.
4.3. A daily limit per server key. We count notifications per VAPID key per day. If we set a daily limit, we publish it here at least 30 days before it applies, set high enough that a normal homelab never reaches it.
4.4. Critical alerts break through Do Not Disturb. They are sent as critical only where Apple has granted us the entitlement and the app user has turned them on for that server. Use them only for what is genuinely urgent.
5. Abuse controls and suspension
5.1. We may block, or lower the limits for, one VAPID key, registration or IP address, without notice, where we reasonably believe it breaches section 4, is compromised, or puts the Relay, Apple’s trust in our credentials, or other users at risk. We use the least intrusive measure that works.
5.2. A blocked key or registration gets an error from the Relay, which your server shows. We don’t know who runs a server, so we can’t contact you directly. To ask why, or to object, write to contact@innovasoftware.ro and include your server’s public VAPID key. A person reviews it and answers.
5.3. We may require Apple’s App Attest when phones register, if abuse appears.
6. Availability, changes and shutdown
6.1. No uptime commitment. The Relay has no service level agreement. It depends on Apple’s push service, which we don’t control.
6.2. Keep a fallback. The Relay is a single path to the iPhone app. For alerts that really matter, add at least one destination that doesn’t depend on it, such as Telegram, Slack, Discord or a webhook.
6.3. Changes. We may raise limits at any time. We give at least 30 days’ notice before lowering the limits in section 4.1 for everyone, and at least 90 days’ notice, keeping the old protocol working meanwhile, before a protocol change that needs a server update. Security fixes may apply at once.
6.4. Shutdown. If we stop running the Relay, we give at least 180 days’ notice. Other destinations keep working, and the server also supports a self-built app with your own Apple push key (push.apns.*).
7. Liability
7.1. Never excluded or limited: loss caused by our intent or gross negligence (Romanian Civil Code, Art. 1355(1)); harm to life, body or health; product-liability claims; liability under GDPR Art. 82; and anything else the law does not allow us to exclude.
7.2. Consumers: the Relay is free, and a missed push is a foreseeable risk that section 6.2 tells you how to cover. As far as the law allows, we are not liable for damage to your property, including data, caused only by our slight negligence (Civil Code, Art. 1355(2)). Your statutory rights are otherwise unaffected.
7.3. Businesses: subject to section 7.1, we are not liable for indirect loss, lost profit, or loss caused by a late or undelivered notification, and our total liability is limited to EUR 100.
8. Law, disputes and changes
8.1. Sections 1.5 (language: these terms are also published in Romanian, equally binding), 2 (consumers and businesses), 21 (law and disputes) and 22 (general) of the InfraInbox Cloud Terms of Service apply to these terms too, including the consumer protections on law and courts and the SAL-ANPC route.
8.2. We may change these terms for the reasons in section 19.1 of the Terms of Service, and publish a change at least 30 days before it applies. If you don’t agree, stop using the Relay: turn it off on your server, or unpair the app.
8.3. Contact: contact@innovasoftware.ro. Security reports: our security policy.