Push notifications are live. When someone messages you, your phone or laptop tells you who it was and what they said, the way you’d expect from any messenger. The part that took the thought was making that true without quietly breaking the promise the rest of the app is built on.
The version we didn’t build
The straightforward way to put a message into a notification is to do the work on the server. The provider already holds the message, decrypts it, writes “Mum: see you at five” into the notification payload, and ships it off to be delivered. It’s one less round trip and it always works.
It also means the server reads every message in order to announce it. For most messengers that’s no change — they could read your messages anyway. For Shoal it would have been a hole cut straight through the middle of everything else we say, and one of the only places our servers handled message contents in the clear.
So we didn’t do that.
What we shipped instead
The notification is assembled on your own device. When a message is sent, our server fans out a small encrypted payload to the push service your operating system uses — Apple’s, Google’s, or Mozilla’s. That payload carries the ciphertext and the wrapped key material, not the message. Your device wakes a tiny piece of background code, unwraps the conversation key, decrypts the message locally, and only then draws the notification you see.
The push services in the middle are couriers. They carry a sealed envelope from us to your device and never hold the key to open it. The first and only place the message becomes readable text is the device it was always meant for.
Some honest limits
This approach asks more of the device, and devices vary. On iPhones and iPads, notifications with content only arrive once you’ve installed Shoal to your home screen — that’s an Apple rule for web apps, not a choice of ours. Some platforms give that background code a short, strict window to do its work, so on a few older devices you’ll occasionally get a generic “New message” rather than the decrypted preview. You can turn notifications on or off per device from Settings.
There’s one deliberately generic case worth calling out: a shared family device that nobody has picked themselves yet. A notification there shows nothing about who it’s for or what it says, because the device doesn’t know who’s holding it. We wrote about that separately in the family tablet.
How this fits with everything else
A notification is just a message announcing itself, so the same rules apply: it respects admin oversight, it’s gated by active hours, and it carries voice notes and photos the same way it carries text. The architectural limits of our encryption model are described plainly on the privacy page, and the security page lists what we hold, and how.
As ever: try Shoal, and if a notification ever shows you something it shouldn’t, tell us at [email protected].