ReNotify Is Now Open Source

An app that keeps your notification history reads everything that lands on your phone: the message your partner sent, the code from your bank, the name of the person who just liked your photo. Asking you to trust that with a privacy policy has always felt thin to us. So ReNotify is now open source. The complete notification history app is public on GitHub under the GPLv3, and anyone can read what it does with a notification, build it themselves, or install a signed APK from the release page.

This post explains what is in that repository, what is different about the version on Google Play, what we changed before we opened it, and how you can check our claims without taking our word for any of them.

Why an app like this should be open

Most apps ask for permissions that are easy to reason about. A camera app wants the camera. A notification history needs notification access, and that permission is different in kind: once granted, Android hands the app the title and text of every notification from every app, as it arrives. We wrote about what an app with notification access can actually read, and the honest summary is that it is close to everything you see in your shade.

For an app holding that much, "trust us" is the weakest possible answer. A privacy policy describes intentions. Source code describes behaviour. When the code is public, the question "does this app upload my messages?" stops being a matter of belief and becomes something a developer can answer in an afternoon by reading the listener service and the one class that talks to the network.

What the open source edition is

The repository is called ReNotify-App-OpenSource. It contains the same app you know: the history grouped by app, resending with the original time, reminders, rules that hide or silence, the status bar filter, widgets, trends and auto-delete. The ideas we started ReNotify with are all in there.

The open source edition differs in one important way: every feature is free. There is nothing to unlock, no trial, no purchase, and no banner for our other apps. It installs under its own app id, com.renotify.oss, so it sits next to the Play Store version instead of replacing it.

The code is licensed under the GNU General Public License v3.0. You may read it, change it and share it, and if you publish a modified version, your changes stay open too. The name ReNotify and the icon are not part of that license, so a fork has to go by another name.

Rules and the status bar filter behave exactly as they do on Play, including the part we care most about: calls, alarms, calendar reminders, navigation, media players and running services are never hidden or silenced, by any rule or filter.

What the Play Store edition adds

The version on Google Play is built from the same source. It adds the things that pay for the work, and we would rather list them than have someone find them:

• Pro is a one-time purchase through Google Play Billing. The free version keeps the last 7 days of history and comes with a 7 day Pro trial.
• The free version shows a small banner for our own apps. There is no ad network behind it.
• The RevenueCat SDK runs in observer mode to count revenue. It contacts RevenueCat when the app starts, with a random identifier, and receives purchase confirmations. It never sees notification content, names or email addresses.

One limit is worth saying plainly. You can read and build the open source edition yourself, but you cannot compare an APK downloaded from Google Play byte for byte with this repository. If verifying the code you run matters to you, install the open source edition.

What we changed before opening it

Publishing the code meant reading our own app the way a stranger would. Three things did not survive that reading.

First, usage statistics were switched on by default. They never contained notification content, only a random ID, the app and Android version, the language and the number of stored entries, but a statistic the app does not need to work should not run before you agree. Since version 1.8.6 the app asks once, and until you say yes nothing is sent, crash reports included.

Second, we called those statistics anonymous. Because the random ID stays the same from one report to the next, they are pseudonymous, and the privacy policy now says so.

Third, our server kept the IP address of every newly registered device. It now keeps only a salted hash for at most two days, used to stop automated mass registrations, and it deletes the records of any installation that has not reported for 90 days.

The open source edition goes one step further. It has no statistics server at all. The setting is an empty placeholder, so the app never asks and never connects. Whoever builds their own copy can point it at their own server, and then the same consent rule applies.

How to check it yourself

You do not need to be an Android developer to get something out of the repository, but if you are, these are the places worth reading first:

• The listener service, which receives every notification and writes it to the local database. It is the only place notification text enters the app.
• The telemetry package, the only code that opens a network connection. In the open source build its server address is empty.
• The README, which lists every permission and why the app needs it, and the exact JSON the statistics would send.

To install the release APK and be sure it comes from us, compare its signing certificate with the SHA-256 fingerprint printed in the README. If you find a security problem, please write to dev@fluxera.us instead of opening a public issue. Everything else, bugs and ideas included, is welcome as an issue on GitHub.

Nothing about how ReNotify works for you changes today. Your history still lives in a local database on your phone and still disappears with the app. What changes is that you no longer have to take that sentence on faith. If you want a history that keeps what your shade forgets, ReNotify is on Google Play, and the open source edition is on GitHub, free in every feature.