Quick links

Stay tuned, Stay Notified.

Zona is the inbox on your phone for everything your machines have to say. Scripts, servers, CI jobs and AI agents send one HTTPS request or call one MCP tool, and the alert is waiting on your iPhone.

Your machines · tap one to send

Zonastores it, then pushes

iPhone · Inbox

  1. home-pcrendernowRender finishedfinal-cut.mp4 is ready on the desktop. Preview attached.
  2. ci-runner-04build1mHigh severity. Build failed on mainauth.spec.ts: 3 tests failed after the dependency bump.
  3. nas-backupbackup3mLow severity. Nightly backup completeOffsite copy verified and checksums match.
What prod-api sent
await fetch("https://gerncrjtrdjtjvybvseb.supabase.co/functions/v1/notify", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ZONA_SOURCE_TOKEN}`,
    "Idempotency-Key": `incident-${incident.id}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    title: "5xx spike on /checkout",
    body: "Error rate stayed above the threshold for five minutes.",
    category: "incident",
    severity: "critical",
    todo: ["Drain the queue", "Restart the worker", "Verify the dashboard"],
  }),
});

202 Accepted{ "notificationId": "87c4215a-…", "idempotentReplay": false, "pushQueued": 1 }

Your first alert in three steps

No SDK and no agent to install. A source token and one HTTPS request are everything a sender needs.

  1. 1.0

    Get Zona on iPhone

    Zona is in a private TestFlight preview and coming to the App Store. Once it is on your iPhone, you can start as a private guest.

  2. 2.0

    Create a source and copy its token

    Open Sources, name the machine or app that will send, and copy its token. Zona shows the complete token only once, so put it straight into an environment variable or CI secret.

    zona_live_followed by your secretshown once
  3. 3.0

    Send one request

    POST a title and body with the token and an Idempotency-Key. A 202 means the alert is stored in your inbox.

    POST /functions/v1/notify 202 Accepted

Follow the quickstart

Let your AI agent tell you when it is done

The Zona MCP server gives Claude, Cursor, Grok and other stdio hosts three tools. It reads your source token from a local file and never prints it, so the agent can reach your phone without ever seeing the secret.

zona_notify
Send an alert with a title and body, plus optional category, severity and up to five PNG, JPEG or WebP images.
zona_ping
Send a short test notification to confirm the token and the /notify path work.
zona_status
Check that the token file exists. It never returns the token.
Download MCP

v1.0.0 · MIT · Node.js 20+

MCP host config
{
  "mcpServers": {
    "zona": {
      "command": "node",
      "args": ["/absolute/path/to/zona-mcp/server.mjs"]
    }
  }
}

Token file

~/.zona/token

One line, the zona_live_ token from Sources. On Windows it lives at%USERPROFILE%\.zona\token, or set ZONA_SOURCE_TOKEN.

What arrives on your phone

Everything a sender can set is a documented field. Everything else, from the source name to the sound, is decided by the token and your settings in Zona.

Zona capabilities, what each means, and the API field or app setting that controls it
CapabilityWhat it meansField or setting
SeverityFour levels put a coloured ring around the alert’s source, thicker the more urgent it is. While the alert is unread the ring pulses, faster for more urgent levels, and it stays still with Reduce Motion on. Severity never changes delivery priority or sound.severityJSON field
CategoriesA short label of up to 80 characters, such as build, backup or deploy, to tell alerts apart at a glance.categoryJSON field
ChecklistsUp to 20 follow-up items. You tick them off or remove them on the phone; ticked state survives a retry.todoJSON field
ImagesUp to five PNG, JPEG or WebP images per alert, with a swipeable preview and a full-screen zoom viewer.attachmentMultipart part
Context dataA JSON object of up to 4 KiB stored with the alert, for build IDs, branches or anything your tools need.dataJSON field
Per-source soundsEach source gets its own notification sound, so you can hear which machine spoke. Senders cannot override it.Sources › Notification soundIn the app
Quiet hoursAccount and per-source schedules skip the push and the in-app banner. The alert is still stored and searchable in your inbox.Settings › Quiet hoursIn the app
In-app bannersWhile Zona is open, a new alert drops in as a banner at the top of the screen, and several at once combine into one. Quiet hours and hidden previews still apply.Settings › In-app bannersIn the app
Safe retriesRetry with the same key and content and Zona returns the original alert with 200. No duplicate is created.Idempotency-KeyHTTP header
Key rotationA source can hold several keys you pause or revoke one at a time, while its name, sound and history stay put.Sources › Access keysIn the app
Inbox toolsSearch, filters that combine several sources and severities with unread, pinned or recent alerts, saved filters, pinning, and repeats folded into one thread.InboxIn the app
Live Status and widgetOn iPhone, unread activity on the Lock Screen and Dynamic Island while Zona is running, plus an unread widget.Settings › Live StatusIn the app

Every field in the API reference

Limits in writing. Keys you can revoke.

Inbox retention for guest, Standard and Zona Plus accounts. Images follow their alert.
1 / 7 / 30days
Accepted requests per standard account across all sources in a rolling minute; each source is also capped at 60 and guests have lower caps. Past that, Zona answers 429 with Retry-After.
20per minute
PNG, JPEG or WebP files per alert, sharing one byte budget for the plan.
5images
A new source key is shown once. Zona keeps only its SHA-256 hash and cannot show it again.
1reveal per key

Documented defaults. The retention shown in Settings is authoritative for your account.

  • Hashed source keys

    Zona stores a SHA-256 hash of each key and derives the source and owner from it, so a sender cannot pose as another source.

  • Isolated accounts

    Supabase Auth and row-level security separate every account. Senders reach one bounded endpoint and never the database.

  • No ads, no tracking

    Zona does not sell personal data, serve behavioural advertising, or track you across other companies’ apps or websites.

  • Yours to delete

    Revoke one key, delete a single alert, or permanently delete your Zona account and its app data from Settings.

Questions people ask first

My script got a 202, but no banner showed up. Did the alert arrive?

Yes. A 202 means the alert is stored in your inbox. The banner can still be skipped by quiet hours, by push being turned off, or because the phone has no notification permission. If Zona is open when the alert arrives, Zona shows its own banner instead of the system one, even with push off, but never during quiet hours or with In-app banners off in Settings. Open the inbox first, then copy the safe diagnostics from Settings → App Status if something looks wrong.

What happens when my job retries after a timeout?

Send the same Idempotency-Key with the same content. Zona returns the original alert with a200 and creates no duplicate. Minting a new key on every retry is what causes double alerts.

I lost a source token. Can Zona show it to me again?

No, Zona only keeps a hash of it. Add a new key to the same source in Sources, update the sender, then revoke the old key. The source keeps its name, sound and history.

More answers in Support

Stay tuned, Stay Notified.

Put Zona on your iPhone, create a source, and the next thing your machines have to say will be waiting for you.