Push notifications

Vouch sends push notifications to audiences built from what it already knows about a device: where it came from, how it has behaved, what it has paid, and traits you have sent. The notification opens a Vouch link, so an open is attributed the same way a tapped link is.

What Vouch does and does not do here

Delivery is a commodity. Apple, Google and the browsers all publish it and none of them charges for it, so Vouch speaks to them directly rather than paying somebody to speak on its behalf.

Three platforms, one audience. A segment does not know what a device is: the same rule reaches an iPhone, an Android handset and a browser, and one send report covers all three.

What Vouch adds is the audience. It is not a messaging suite: there is no email, no SMS, no in-app messaging, and no drag-and-drop journey builder. If you want those, buy them. If you want to message the two thousand people who deposited last month and have not opened the app in a fortnight, that is this.

Credentials

Both platforms are configured per app under Push → Settings.

Apple

From the Apple Developer portal, create a key with the Apple Push Notifications service enabled and download the .p8 file. You need three things beside it: the Key ID, your Team ID, and the app's bundle identifier.

Paste the file's contents exactly as Apple issued them. A key that cannot be parsed is refused while you are looking at the screen rather than at your first send.

Android

Android push can only be delivered by Google, so this one is not optional if you ship on Android. From Google Cloud, create a service account for your Firebase project with the Firebase Cloud Messaging API enabled and download its JSON key.

Both keys are encrypted before they are stored and are never returned by any API. The dashboard reports only whether one is set. To change a key, paste a new one; leaving the field blank keeps the stored key rather than clearing it.

Browsers

Web push needs no credentials from you, which is the one place it differs from the other two. Press Enable web push in settings and Vouch generates the app's VAPID keypair, because a VAPID keypair means nothing until a browser subscribes against it and there is nowhere for you to fetch one from.

It is generated once and never regenerated. Every live subscription is bound to the key it was created with, so a second keypair would silently orphan every subscriber the app already has.

The rest is in the web documentation: a service worker saved at your site root, and Vouch.enablePush called from a click rather than on page load.

Two limits worth knowing before you plan a campaign around it. Safari delivers only to a web app added to the home screen, so realistic reach is Chrome, Android and desktop. And every web push must show a notification: silent background delivery is not available, and a push that displays nothing is counted against the origin.

Registering a device

The SDK registers the platform token against the device Vouch already knows, so the push audience and the attribution audience are the same population.

A device holds one live token. Re-registering replaces it rather than adding another, which is what stops a reinstalled app being messaged twice. A token Apple or Google reject as unregistered is retired immediately and never retried.

Permission state is recorded with the time it was observed, so a send can tell "declined" apart from "never asked". A device that was asked and said no still reports that, because knowing somebody declined is worth keeping.

From the SDK

Vouch never asks for notification permission itself. When to prompt is a product decision with a real cost if taken at the wrong moment, and an SDK is in no position to make it. Ask when it suits your app, then tell Vouch what the answer was.

// iOS: in didRegisterForRemoteNotificationsWithDeviceToken
Vouch.push.register(deviceToken: tokenData)

// When a notification is tapped
if let note = Vouch.push.handle(response.notification.request.content.userInfo) {
    if let url = note.url { Vouch.handle(url: url) }
}

// Android: in FirebaseMessagingService.onNewToken
Vouch.push.register(token)

// When a notification is tapped
Vouch.push.handle(intent.extras)?.url?.let { Vouch.handleUri(Uri.parse(it)) }

// Flutter
await Vouch.push.register(token);

final note = await Vouch.push.handle(message.data);
if (note?.url != null) await Vouch.handle(note!.url!);

// React Native
push.register(token, "granted");

const note = push.handle(message.data);
if (note?.url) handleUrl(note.url);

Every SDK also has report(permission) for a device with no token, and a read that parses a payload without counting an open. Use read for a notification that arrives while the app is in the foreground: nobody has opened anything, and counting it would inflate every campaign.

handle returns null for anything Vouch did not send, so it is safe to call with every notification your app receives rather than guarding first.

Segments

A segment is a saved rule, resolved fresh every time it is used. An audience defined once stays current without being edited.

Rules read four sources and nothing else:

Conditions combine with all of or any of, nested one level deep. Deeper nesting is refused: a rule nobody can read is a rule nobody should send a hundred thousand notifications with.

The money-shaped ones

These fall straight out of your conversion events and ship as templates in the dashboard:

Two behaviours here are deliberate and worth knowing.

"Not in the last 30 days" includes people who never did it at all. Written as a plain comparison it would not, and the audience would quietly exclude exactly the people most worth re-engaging.

A conversion condition only matches identified devices. An anonymous device has not deposited nothing. It is unknown, and Vouch does not treat unknown as zero. Call identify when somebody signs in and they become eligible.

Traits

Traits are how you state facts Vouch has no way to observe: an account tier, a balance band, a KYC state.

curl -X POST https://api.vouch.dev/v1/apps/app_123/traits \
  -H "Authorization: Bearer sk_live_…" \
  -H "Content-Type: application/json" \
  -d '{"user_id":"user_88","traits":[
        {"key":"tier","type":"string","value":"gold"},
        {"key":"balance_band","type":"string","value":"10k-50k"}
      ]}'

Values are typed and stored exactly as given. Vouch does not derive, infer or enrich them.

Sending

Compose a title, a body and the link it opens. The audience is sized before you can send, and the size separates two numbers that are not the same:

• Matching: everybody the rule selects.
• Reachable: those of them who have granted notification permission.

Vouch reports both. An audience of 40,000 where 9,000 have notifications turned off is a useful thing to learn; being quietly told 31,000 is not.

What holds a notification back

Every device that is not sent to is recorded with a reason, so a send explains its own arithmetic. They are applied in this order:

1. Suppression list: a decision you made.
2. No permission: a decision the user made.
3. Frequency cap: a setting of yours.
4. Quiet hours: the same, in the recipient's own timezone.

A device that never reported a timezone is sent to anyway. Guessing at somebody's local midnight is worse than not applying the rule.

Test sends

A send above a configurable size is refused until the same message has gone to a test device. Past that size a typo stops being something you can apologise for.

The suppression list

Identifiers on the suppression list are excluded from every send, including recurring ones created before they were added. There is no override and no dashboard switch to bypass it.

That is deliberate. If you run a betting or credit product, this is what lets you honour a self-exclusion, and a self-exclusion with an off switch is not one. Removing an entry is the only way out.

What the numbers mean

Accepted is not delivered. Neither platform guarantees delivery, and a dashboard implying otherwise would be lying on their behalf. Opened is only observable when the app launches from the notification; it is not a read receipt.

Because a notification opens a Vouch link, its conversions are attributed by the same resolver as every other click. Push performance and campaign performance sit on one axis rather than in two separate worlds.

Compliance

Marketing notifications require opt-in under both Apple's and Google's policies.

Segments built on deposit behaviour are regulated marketing in several jurisdictions when the product is betting or credit. Vouch provides the suppression list, the frequency caps and the audit trail you need to satisfy your regulator. The obligation is yours, and Vouch does not pretend to police it.