Own your push tokens.

Sending a push through APNs or FCM is free. OneSignal became the default because it handles everything around the send. Here is what that costs once your app grows, in OneSignal's own words.

• The Free plan caps mobile push at 1,000 MAU

  “On the Free plan, you must have fewer than 1,000 monthly active users (MAU) to send mobile push and in-app messages.” The cap applies to your whole organization, summed across all its apps, over a trailing 30 days. MAU “does not depend on subscription status”, so devices that never allowed notifications still count. Go over, and mobile push stops sending until you upgrade, after a 24-hour grace period.

  Source: OneSignal Billing FAQ

• Past the cap, the bill grows with every user

  The Growth plan “starts at $19/mo”, and mobile push adds “$0.012 per monthly active user”. At list price that comes to about $139 a month at 10,000 MAU and about $619 at 50,000. That's our arithmetic: $19 + MAU × $0.012.

  Source: OneSignal pricing, checked 9 November 2026

• Your audience is hard to take with you

  OneSignal's iOS SDK is released under a “Modified MIT License” whose second clause says copies “may only be used in connection with services provided by OneSignal.” Leaving means a new SDK, a new app release, and a long tail of users still on the old version.

  Source: OneSignal-iOS-SDK license

Below 1,000 MAU, OneSignal's Free plan is a good deal and a mature product. Zilcast is for apps that have outgrown it.

1. Sending core

   Direct APNs with .p8 token auth, so your iOS app needs no Firebase. FCM HTTP v1 for Android. Dead tokens are removed as soon as APNs or FCM reports them. A send API with idempotency keys, plus test devices.

2. SDKs for Swift and Flutter

   Log users in and out to tie devices to accounts, set attributes, track events and opens, handle deep links. React Native and Expo apps can send the tokens they already collect.

3. Campaigns

   Segments built from attributes, last seen, platform, app version, country and language, with a live audience count. Send now, at a set time, or at each recipient's local time.

4. Dashboard and honest metrics

   Compose and send without shipping code. Reports keep “accepted by APNs or FCM” separate from “opened”, and never show a “delivered” number the platforms don't actually report.

5. Migration and self-hosting

   The OneSignal importer with bridge mode. docker compose up for the app and Postgres. A migration guide. No telemetry by default.

Not in scope: email, SMS, WhatsApp and web push. Zilcast is mobile push only.

OneSignal's subscription export includes each device's push token. Those tokens come from Apple and Google, and your APNs key and Firebase project already belong to you. So the planned importer can reach your existing audience on the day you switch, while the app update with the new SDK rolls out.

1. Export your subscriptions from OneSignal, from the dashboard or with the CSV export API.
2. Import the file into Zilcast. It reads each token and its platform.
3. Send in bridge mode. Campaigns reach people still on your current app version.
4. Ship the release with the Zilcast SDK. As people update, they move over and the imported tokens retire.

Bridge mode is temporary by design: imported tokens fade as people change phones or reinstall, so the SDK swap is the lasting fix. We're testing the Android side of this in a technical spike right now.

Source: OneSignal docs, Exporting data

Tapping “Allow” on the system prompt is not consent to marketing. Zilcast keeps the two apart.

Marketing or transactional

Every campaign is labelled one or the other. Marketing campaigns reach only people who opted in, and the server enforces that filter.

Preference center

A ready-made settings screen for SwiftUI and Flutter, so people can pick topics or opt out inside your app.

Consent log

An append-only record of who agreed to what, and when. Export it whenever you need it.

The rules this is built for

• Apple App Review Guideline 4.5.4: promotional push needs explicit opt-in “via consent language displayed in your app's UI”, and a way to opt out inside the app.
• GDPR, Article 7: you must be able to show that a person consented.
• KVKK announcement of 14 January 2026 (Turkey): bundling order updates and campaign notifications under a single consent breaks the principle of granular explicit consent.

These are tools that make compliance easier, not legal advice.

Server: AGPL-3.0

Run it, change it, self-host it. Anyone who offers a modified version as a service has to publish their changes.

SDKs: MIT

Use them in any app, with any backend. No clause tying them to our service.

The core stays AGPL. Segments and scheduled campaigns stay in the open-source edition. No telemetry by default.

Tell us what you'd pay in the waitlist form. Your answer shapes the tiers.