Terms of Service

1. What Nezuko is

Nezuko is a web push notification service. Site owners embed a small script on their websites to let visitors subscribe to browser notifications. Nezuko stores push subscription endpoints on behalf of site owners and delivers messages via the browser's push service (Google FCM, Mozilla autopush, Apple APNs).

2. Your account

Your account is a randomly-generated 16-digit code. This code is the sole credential. If you lose it, the account and all its data are permanently inaccessible — there is no recovery, no reset, no support ticket that can restore it. You are solely responsible for storing your code securely.

3. Acceptable use — what you MAY NOT do

• Send unsolicited notifications, spam, or repeated content unrelated to what your visitors opted in for.
• Send more than a reasonable frequency of notifications. As a soft guideline: no more than a few notifications per subscriber per day, unless your service inherently demands it (e.g. chat).
• Send notifications on behalf of a domain you do not own or control.
• Send notifications containing sexual, violent, harassing, hateful content
• Send phishing, malware links, cryptocurrency scams, fake giveaways, or fake login prompts.

4. Origin lock

Every site you register is bound to one origin (protocol + host). Subscriptions coming from a different origin are rejected server-side. You may not register origins you do not own. If we detect abuse of this, we will delete the site and its subscribers.

5. Data we store

• The salted hash of your 16-digit code (never the code itself in plaintext).
• The sites you register: name, origin, timestamps.
• Push subscription endpoints and public keys provided by your visitors' browsers. These are opaque tokens routed to browser vendors — Nezuko cannot read the identity of a subscriber from them.
• Notification history: title, body, click URL, delivery counts, timestamps.
• Short-lived login-attempt records (IP + timestamp) to rate-limit brute-force. Auto-expire in 15 minutes.

6. What we do NOT store

• Emails. We never ask for one.
• Names, phone numbers, addresses, or any personally identifying account information.
• Cookies for tracking. The only cookie is your session, and it exists solely so you stay signed in.
• Any analytics or fingerprinting from the embed script.

7. Deletion

Deleting a site deletes its subscribers and notification history. There is no separate account-delete button — because there is no personal data attached to the account beyond the code hash. Losing your code effectively deletes the account.

8. Availability

Nezuko is provided as-is, with no uptime SLA. Delivery depends on browser push services, which are outside our control. Some browsers (notably Brave with default settings, and all private/incognito windows) may reject push subscriptions — this is a browser policy, not a Nezuko failure.

9. Changes

These terms may change. Continued use of Nezuko after changes constitutes acceptance. Material changes will be noted on this page.