← All privacy impact assessments

PIA: message text, and task and event titles, in notifications

Status: this assessment is HQ's PIA-010, approved with conditions N1–N20 by the founder on 25 October 2026 (F1–F3 as recommended), restated as built. Nothing here reaches anyone yet. It stays dark until three things are true together: the app on the phone carries privacy policy v3.15, which describes it; the phone has reported that it can show text (an Android phone has created the two private channels, an iPhone has sent a marker); and we have turned the server's switch on. Any one of them missing means every notification stays generic. Nothing here is legal advice.

It amends, dated, the content encryption assessment §3.9 ("every push generic"), targeted notices ("no title") and member and group types (the preview switch).

1. Purpose and scope

The founder's request, 25 October 2026: "Restore the ability of previews of messages etc to be shown in the pop up notifications. Default on." Showing someone what was said to them, in their own group, is the purpose of a chat message and of a task's title. It is a choice about display, not a new use.

In scope: a chat notification shows "Sam: " and the start of the message (about 140 characters), or "Sam sent a photo"; a new-task notification, a task or event reminder and the "added a task for you" notice show the task's or event's title. Out of scope, and generic as before: encrypted groups (no notification extension now), Device-only groups, baby handoffs and notes, Mail Sifter, the assistant, ceremonies, routines, event confirmations, cross-group events, glances and Live Activities. Notes, places and descriptions never appear in any notification.

2. Data involved

Item Holds Leaves us to Kept
Chat text the start of a message or of a photo's caption (at most 140 characters, cut between whole characters), the sender's and the group's names Expo (650 Industries, Inc., United States), then Apple's or Google's notification service (United States); the recipient's phone, lock screen, notification history, paired watch, car Expo, Apple, Google: while delivering, and for an offline phone up to one day (§5); the phone: until dismissed
A title a task's or event's title, at most 140 characters the same the same

Nothing new is stored by us. The database already holds this text, unencrypted, for every group whose chat isn't encrypted (all groups made after 18 October 2026). What's new is the disclosure to three processors overseas and the display on surfaces outside the app. The database trigger sends the notification function ids only, and the function reads the row when the notification goes: no message text sits in the database's outgoing-request queue, its responses, our logs, our delivery record or the function's replies.

3. Who gets text (the gates)

Text appears only when every one of these holds at the moment of sending. If any can't be read, the notification is generic: it is never dropped for that reason, and it never carries text.

Who gets a notification at all is unchanged: active members except the sender, minus mutes and blocks.

What the text is: the message's own words, with spaces and line breaks collapsed. Never the quote a reply carries, an attachment's name, a link to our storage, a signed link or an image. A photo with no caption is "Sam sent a photo"; a card, a shared plan, a reminder line or anything that isn't plain words gets the usual sentence. A title is the title only, read from the task or event itself when the notification goes, never from what the sender's phone said it was. A routine's title never shows, in any of the three title notifications.

4. Old phones and Android lock screens

Older app versions never get text. A phone reports what it can show when it registers for notifications: an Android phone lists the two new channels once it has created them, an iPhone adds a marker. The app creates the channels and sends the marker only once its bundled privacy policy is v3.15. So the switch, its explanation and the private channels are on a phone before any text can reach it, whatever order the server and the app are updated in.

On Android, words only once the phone is unlocked. Text goes only on the new "Messages that show the words" and "Tasks and reminders that show titles" channels (names proposed), never on the existing channels, one of which shows everything on the lock screen. A member's own Android setting wins: a phone reports a private channel only while neither it nor the channel it mirrors is switched off, so someone who turned off "Group Messages" doesn't start getting messages again, now with the words, and someone who turns off a private channel still gets the generic notification on the old one. The phone reports again every time the app comes back to the foreground, not only at launch, and our server trusts a report for at most seven days: a phone that hasn't reported within a week gets the generic notification until it does. So a channel switched off in Android settings while GroupApp is never reopened can still get words for up to seven days (accepted by the founder, 29 October 2026; §9). Their lock-screen setting is permanent once a phone creates them. PRIVATE hides the words on a locked phone only when the phone's own "sensitive content" setting allows. On an Android 15 emulator at factory settings, with a PIN set, a PRIVATE notification showed its whole text on the locked screen (checked 29 October 2026). So both channels use SECRET, which shows nothing on a locked screen until the phone is unlocked (F3). That hides the whole notification, not only its words: with text on, an Android member's task and event reminders make their sound but don't appear on the lock screen until unlock, and the switch's helper says so. The founder's physical-phone check confirms this before the release. On an iPhone, the phone's own Show Previews setting decides.

5. Overseas disclosure and the processors (APP 8)

Expo, Apple and Google already carry every notification we send and are named in the privacy policy. What changes is that some notifications now carry words. None of the three gives a retention commitment we can verify, so nothing we say claims the words "aren't stored" (R1).

So every notification carrying words sets a time to live of at most one day (a reminder: until one hour after its time, never more than a day), and Apple and Google drop it rather than hold it for weeks.

6. Turning it off without a release

A value in the database's Vault, read only by the notification functions, turns text on. Only the exact value "on" does; a missing, unreadable or different value means every notification is generic. It isn't set at release. We set it once the release is out; removing or changing it turns every notification back to generic within the next send. If text ever reaches anyone §3 excludes, we turn it off the same day, add an entry to this register, and fix the cause before turning it on again.

7. Children

Under 16: never text, whatever the switch holds; the switch shows as off with "Off. This is the same for every account under 16.", and the child's "What your parent can see" page lists it with the other settled settings. A child account with no birth month on record is treated as under 16. 16 and 17: on by default with their own switch (founder, 25 October 2026), as the Children's Code allows for older children given a clear notice in their own policy. A child who turns 16 keeps what the switch held (F2): nothing turns it on for them. A message from anyone under 16 shows only that they sent one (F1), so a child's words don't reach overseas processors or other people's lock screens.

8. Structural versus conventional

Property How it holds Pinned by
The trigger sends ids only the trigger's body the database tests over the outgoing-request queue
Recipient gates (switch, age, child with no month, wall or profile) one database function, service role only, booleans only the recipient-gate database tests
Our switch fails closed only the exact value "on" is true the same tests
Every other gate fails closed, per recipient and per device one shared gate every sender asks the gate's unit matrix; each sender's handler tests
Only the four named senders may carry words, and each calls the gate a register of senders in two lists the generic-pushes check, with fixtures it must catch
No words in logs, replies or the delivery record log lines carry codes, counts and error class names the same check's log scan; handler tests with failing Expo and database fakes
Old app versions get no words the phone reports the capability only under policy v3.15 the phone's gate tests; the server's capability tests
Words after unlock on Android the private channels' visibility, SECRET device check: the emulator showed PRIVATE leaks at factory settings; physical phone before release
The words shown on watches, cars and shared tablets not ours to control (R2) —

9. Residual risks accepted (PIA-010 §7)

Amended 31 October 2026 (HQ PIA-016, reactions and deleting your own message). The read at send time (N2) now treats a deleted message as gone: a message deleted before its notification is sent gets no notification, the same answer as a message that is no longer there, and its "Message deleted" placeholder is never sent as text. A notification already delivered can't be withdrawn: notifications carry no id that would let us replace or remove one, so a phone may still show the start of a message its author has since deleted. The delete confirmation says so wherever a notification could have carried the words.

10. Review trigger

Reassess before: encrypted groups getting words (a notification extension, which needs its own assessment); any note, place, description, baby note, Mail Sifter or assistant text in a notification; a longer time to live; a group-level switch; any change to who gets a notification.

11. Sources