Scatto for iOSApp Privacy Notice

Last updated 5 August 2026

This notice covers the Scatto iOS app itself: what it stores on your device, what it sends where, and what our push relay holds. It is deliberately separate from the scatto.social privacy policy, which covers the instance — the server that holds your account, your posts, and your media. If you use the app to sign in to scatto.social, both apply: this one to the app, that one to the server.

Scatto is a client for Pixelfed instances. It has no backend of its own beyond the push relay described below, and no account system of its own — you sign in to an instance, and that instance is where your data lives.

In short: no analytics, no advertising, no tracking, no profiling, and no third-party SDKs. The app talks to the instance you sign in to, and — only if you turn on notifications — to our push relay and to Apple.

Controller

The controller responsible for processing personal data under the GDPR is:

Vinzenz Greger
Eschenweg 17
85640 Putzbrunn
Germany
info@hever.de

See also our Impressum. No data protection officer is appointed, as the statutory thresholds for doing so are not met.

What the app stores on your device

Your sign-in credentials for the instance — the OAuth access token the instance issues when you log in. It is held in the app's own storage on your device, which iOS encrypts along with everything else the app keeps, and it is deleted when you sign that account out or remove the app. The app never sees or stores your password: signing in happens in a web view served by the instance itself, and only the resulting token comes back.
Your instance address and account handle, so the app knows where to connect and which account is which.
App settings — your display and notification preferences.
A cache of content already fetched — timelines, images, video and profile data, so the app is not re-downloading the same things. This is ordinary local cache.

None of this is transmitted anywhere except as described below. Signing out clears your credentials; deleting the app removes all of it from the device.

What the app sends to your instance

Everything you would expect a Pixelfed client to send, over HTTPS, using the instance's public API: your login, the posts, photos, videos, captions, alt text and comments you create, and your interactions (likes, bookmarks, follows, mutes, blocks, reports). The instance also sees the technical data any web request carries — your IP address, a user-agent identifying the app, and request timestamps.

How the instance handles all of that is the instance's business, and for scatto.social it is described in the instance privacy policy. If you sign in to a different instance, that instance's policy applies instead — we have no access to it and no relationship with it.

Direct messages are not end-to-end encrypted, in Pixelfed generally and so in this app. Do not use them for sensitive information.

Push notifications

Push is off until you turn it on. If you never enable it, nothing in this section happens, no data reaches our relay, and nothing about you leaves the EU/EEA through Apple.

Why a relay exists

Pixelfed sends notifications using the Web Push protocol, which iOS apps cannot receive: Apple's push transport is APNs, a different protocol. So we run a small relay at push.scatto.social that stands in as the Web Push endpoint, receives the notification from the instance, and forwards it to Apple as a native push. It runs on the same German server that hosts scatto.social.

What happens when you enable it

The app asks iOS for a push device token and sends it to the relay, together with a device label and your account handle (e.g. you@scatto.social), over HTTPS.
The relay creates an encryption keypair for that subscription and hands the app a push endpoint address.
The app registers that endpoint with your instance.
From then on, each time something happens on your account, the instance encrypts a short notification and sends it to the relay.

The relay reads your notifications

The instance encrypts each notification, and the relay decrypts it — on the server, not on your device — to read its title and body (for example, "vinz liked your photo") so it can pass them to Apple as the text you see on your lock screen.

Decrypting on the relay rather than in the app is a deliberate simplification: it keeps the app free of a notification-service extension, at the cost of the relay seeing the notification text in the clear. We would rather say so plainly than leave it implied.

The notification text is not stored. It exists in the relay's memory for as long as it takes to forward the message, and is written neither to the database nor to logs. The relay's own logs record the subscription id, the type of notification (like, follow, comment…), the badge number, and any errors — not the title, the body, or who it was about.

What the relay does hold

One row per subscription, in a small database on that server:

Held	What it is
Subscription id	A random identifier for this app-and-account pairing
APNs device token	Apple's address for your device — needed to deliver a push
Encryption keys	The keypair used to decrypt notifications from the instance
Device label	A name for the device, so one subscription can be told from another
Account handle	Which signed-in account this subscription belongs to
Created-at timestamp	When the subscription was registered
Badge count and preferences	The unread badge number and your badge/sound settings

The device label deserves a note: it defaults to the device name iOS reports, and on most iPhones that name contains the owner's first name ("Anna's iPhone"). It exists only so that two devices on one account can be told apart. You can rename your device in iOS Settings → General → About → Name before enabling notifications, and it will be stored as you set it.

The relay does not hold your posts, your media, your followers, your instance password, or your instance access token.

The web server in front of the relay writes ordinary access logs — IP address, timestamp, and the request line — kept for 14 days and then deleted, unless a specific entry is needed longer to investigate a concrete security incident.

Apple

Delivering a push necessarily means sending it to Apple Inc. (United States), which operates APNs. Apple receives your device token, the notification title and body, the badge number, and the identifiers the app uses to open the right post or profile when you tap it. Apple is certified under the EU–US Data Privacy Framework, for which the European Commission has issued an adequacy decision (Art. 45 GDPR).

You can avoid this transfer entirely by leaving notifications off, or by turning them off later.

Turning it off, and deletion

Turn notifications off in the app, or in iOS Settings, and the app stops registering for push. To have the subscription row itself deleted from the relay, turn notifications off and write to info@hever.de — we will delete it. Re-enabling push, reinstalling the app, or signing in again replaces the existing row for that device and account rather than adding a second one.

Data collected, in Apple's terms

The App Store privacy questionnaire and the app's privacy manifest use Apple's own categories. In those terms, the app collects:

Apple category	In practice	Linked to you?	Tracking?
Device ID	The APNs device token, for push	Yes	No
User ID	Your account handle on the instance	Yes	No
Photos or videos	The photos and videos you post	Yes	No
Other user content	The captions, alt text and comments you write; notification text passing through the relay	Yes	No
Other data	The device label; the address of the instance you connect to	Yes	No

Photos and videos are declared under their own category rather than folded into "other user content": posting them is what the app is for, and the specific category says so plainly.

All of it is collected for app functionality only. Nothing is used for advertising, marketing, analytics, personalisation, or product measurement. Nothing is used for tracking as Apple defines it: no data is linked with data from other companies' apps or websites, and none is shared with data brokers or advertising networks. The app contains no third-party analytics, crash-reporting, or advertising SDKs.

Legal bases

Running the app and connecting you to your instance — performance of a contract, Art. 6(1)(b) GDPR.
Push notifications — your consent, Art. 6(1)(a) GDPR, given by enabling them in the app and in the iOS permission prompt. You can withdraw it at any time by turning them off, with effect for the future.
Keeping the relay secure and working (rate limiting, error logs, access logs) — legitimate interests, Art. 6(1)(f) GDPR.

Retention

On your device: until you sign out or delete the app.
Push subscription in the relay: until you turn notifications off and ask for deletion, or the subscription is replaced by a new registration for the same device and account. Subscriptions Apple reports as permanently invalid (app deleted, token expired) are removed.
Notification content: not retained — forwarded and discarded.
Relay access logs: 14 days.

Your rights

Under the GDPR you have the right to access (Art. 15), rectify (Art. 16), erase (Art. 17), restrict (Art. 18), port (Art. 20) and object (Art. 21), and to withdraw consent at any time with effect for the future (Art. 7(3)). For anything held on the instance, use the instance's own tools and its privacy policy. For anything held by the app or the relay, write to info@hever.de.

You also have the right to lodge a complaint with a supervisory authority (Art. 77). The authority competent for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 27, 91522 Ansbach, Germany. You may also complain to the authority where you live or work.

Children

You must be at least 16 years old (or the minimum digital-consent age in your country, whichever is higher) to use the app with scatto.social.

Changes

We may update this notice. Material changes will be announced on scatto.social and reflected here, with the date at the top updated.

Contact

Questions or requests: info@hever.de.