Privacy Policy

• An account is a username, plus an email address only if you want one. No real name, no phone number.
• Our servers never see your messages in readable form, and keep no record of who you exchanged them with.
• Compelled to hand over everything we hold about a user, we could produce their username and email address (if the account has one), when they signed up and signed in, how many devices they use, and any undelivered message as data we can't read. Not a contact list, not a history, not a single readable word of their chats — unless someone chose to include messages in an abuse report.
• The waitlist on this website is the one list we keep, and we delete it after launch.

Relay is operated by Morgan Daly, in Queensland, Australia. For anything in this policy, including a request about your data, write to privacy@relaymsg.app — that address reaches a person, not a ticketing queue.

We're responsible for the account email and the waitlist. For messages sent through the app we're a conduit: we carry encrypted data we can't read and don't keep.

An account is a username and a way to sign in: an email address, a passkey, or both. We store the username, and the address if you use one. Passwords are stored only as a hash — we never see them, and we can't recover them for you.

You don't have to give us an email. You can sign up with just a username and a passkey, and remove the email from an existing account once it has a passkey. Removing it deletes the address from Relay and from our sign-in provider, so neither could link your account to an email afterwards. The trade-off: there's no "forgot password" by email, so if you lose your passkey and your recovery key, nobody — including us — can get you back in.

A recovery key is a random code that signs you in without a password, email code or passkey. It's made on your phone. We keep only a one-way hash of it, which can check a key but can't be turned back into one. Your phone keeps the key itself, and an encrypted copy travels with your chat list (below), so you can view it again on a new phone.

Your username is public. It's how people add you, and it appears in invite links you share. Pick it with that in mind.

Your email address isn't public, and we don't send marketing to it. Use any address you like — a forwarding alias works as well as your everyday one, and we'd rather you did that than hand us something you care about. Nothing in Relay checks who you really are.

People can't find you by your email address unless you turn on Find Me by Email in the app — it's off by default. Even then, lookups are blinded, so our servers never see the addresses being searched.

If you set an account password or create a passkey, we also keep an encrypted copy of your chat list (who your chats and groups are with, not your messages) with your account, so signing back in brings your chats back. It's encrypted on your phone, and only your account password, your passkeys or your recovery key can open it — we can't read it.

We also hold a push token for each of your devices, issued by Apple, so we can wake the device when something arrives for it. It's tied to your account and goes when the account does.

Phone number sign-in is planned. When it arrives this policy will be updated before it ships, and the change called out at the top of this page.

Messages are encrypted on your device with the Signal Protocol — a post-quantum key exchange, then the Double Ratchet — to keys held only on the devices in the conversation. Your keys are generated on your phone and never reach us — they leave it only end-to-end encrypted, to your own devices when you link one — which is also why we can't recover anything for you.

While a message is in transit our servers hold an encrypted payload and the public key material needed to deliver it. Once your phone collects it, the payload is deleted. There is no message history on our side to keep, search, or surrender.

Attachments work slightly differently: a file has to stay available long enough for the other device to fetch it, so attachment data is held — encrypted, and unreadable to us — for up to 14 days, then purged whether it was collected or not.

If you report someone, you choose a reason and can add details. You can also choose to include their most recent messages to you (up to the last ten in your one-to-one chat). Those are decrypted on your phone and sent to us readable, so we can act on the report — it's the one way message content ever reaches us, and only if you choose it. Nothing else from the chat is shared, and the person you reported isn't told.

A report is linked to both accounts and kept for 180 days, then deleted. Reports you filed are deleted sooner if you delete your account.

• Your address book. Relay only looks at your contacts if you tap Find Contacts, and then only their email addresses, which are blinded on your device before the check — we never see them, and nothing from your address book is stored.
• Your message content. Encryption happens on your device, to keys we don't hold. The only exception is messages someone chooses to include in an abuse report.
• Who you talk to. Messages are sealed so they don't say who sent them; a waiting message is held only against the recipient's device until it's delivered, and we keep no record of who messages whom. Like any online service, our servers see the network address each connection comes from and when, so someone watching them closely could try to pair senders and recipients by timing. We don't log that.
• Your location. The app asks for location only if you share your live location in a chat or turn on showing your device's region to your own devices. Both travel end-to-end encrypted; our servers never receive your location.
• Usage analytics. No analytics SDK, no crash reporter, no attribution framework is bundled in the app.

Push notifications route through Apple, which is unavoidable on iOS. We send Apple a content-free wake-up signal — no sender, no preview, no conversation reference. Your device fetches and decrypts the message itself, then draws the notification.

Apple can observe that a device received a push. Apple's handling of that is governed by Apple's privacy policy, not ours.

Connections to Relay's servers pass through Cloudflare, which shields them from attacks that could take the service offline. To do that, Cloudflare handles our traffic on our behalf and can see connection details: your IP address, when a request was made, which part of the service it was for, and the account identifier the app attaches to signed requests.

Cloudflare cannot read your messages, contacts or groups — those are encrypted on your device before they leave it — and nothing it carries names the sender of a message. Because it carries the traffic, though, it could in principle try to match up who is messaging whom from timing and the mailbox each message is addressed to. Cloudflare processes connection data under its data-processing terms, doesn't sell it, and keeps logs only briefly; like any provider, it can be legally required to disclose what it holds. Its handling is governed by Cloudflare's privacy policy.

For privacy, calls are relayed through our own server instead of connecting your phone directly to the other person's. That server sees the IP addresses taking part in a call, never what's said, and it isn't routed through Cloudflare.

If our call server is down or close to overloaded — for example during an attack — new calls are relayed through Cloudflare's call relay instead, until ours recovers. While that happens Cloudflare sees the same thing our server would: the IP addresses taking part in a call and how much data passes between them. Calls stay end-to-end encrypted, so Cloudflare can't hear or see them, and we don't tell Cloudflare who you are.

If Relay is blocked where you are, you can connect through a proxy that someone shares with you. Proxies are run by other people, not by us, and we don't know who runs them.

Your phone connects to Relay through a proxy inside an encrypted connection, so the person running it can't read your messages, see who you talk to, or see which account is yours. But they can see your IP address, that you're using Relay, and when, and they could keep a record of that. Their handling of it isn't covered by this policy. Only use a proxy run by someone you trust; the app asks you to confirm this before it uses one.

When you use a proxy, our servers see the proxy's IP address rather than yours. A proxy link (relaymsg.app/proxy#…) keeps the proxy's address in the part of the link that's never sent to our website.

Signing in — with an email and password, Apple, or Google — is handled by Supabase, our authentication provider. It stores your email address, a securely hashed password if you created one, which sign-in method you use, and basic sign-in records such as the time and IP address of each sign-in. The detailed sign-in log is deleted after 24 hours. Beyond that, Supabase keeps the time you last signed in and, while you stay signed in, the IP address and device type your current session started from. Relay's own servers keep only a keyed token derived from your email, not the address itself. It can't be turned back into an address, but with our server's secret key it can be checked against an address someone already has.

If you sign in with Google, Google also sends the name on your Google account and a link to its profile photo. They're discarded before they're saved, so neither Supabase nor Relay keeps them. Sign in with Apple can share your name too, but that stays on your phone and is only used to suggest a display name.

Passkeys are checked by Relay's own servers, not Supabase. We store each passkey's public key, a name for it (such as "iPhone") and the day it was added. A passkey sign-in sends nothing to Supabase.

Your sign-in details and your Relay account are linked — that's what lets you sign back in on a new phone. So together, Supabase and our servers can tell which Relay username belongs to an email address, and when it signed in. Neither can tell anyone what you've said or who you've talked to.

Supabase may host this data outside Australia, and its handling is governed by Supabase's privacy policy.

Some of what Relay depends on runs outside Australia. Apple's push infrastructure is global, Cloudflare's network operates worldwide, and the service that sends the waitlist email may be hosted overseas.

Where that happens, everything in this policy still applies. Your messages stay encrypted end to end throughout, so a provider carrying or hosting them cannot read them — which is the point of encrypting before anything leaves your phone rather than trusting the infrastructure in between.

Connections between the app and our servers are encrypted in transit, and the message payloads they carry are separately encrypted end to end. Access to our infrastructure is limited to the people who need it to run the service.

On your device, the message database is encrypted with SQLCipher, so the history sitting on your phone isn't readable by anything that manages to get at the file.

The strongest protection here isn't a policy commitment — it's that we don't hold the material in the first place. A breach of our servers exposes ciphertext we can't read ourselves.

If a breach ever did occur that was likely to cause you serious harm, we'll notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires — promptly, and without waiting to have every detail.

No cookies, no analytics, no tracking pixel, no session identifier, no advertising tag. Fonts are served from this site, so loading a page here sends nothing to Google or any other third party.

Our host keeps short-lived access logs for operational and abuse-prevention purposes. These contain IP addresses and are retained for 30 days, then deleted.

If you enter an email address on this site, we store that address and the date you submitted it. We use it for exactly one thing: a single message telling you Relay is available.

No newsletter, no sharing, no profile. Within 30 days of launch, the entire list is deleted. You can have your address removed sooner by writing to privacy@relaymsg.app — no verification loop, no retention offer.

The lawful basis is your consent, given by submitting the form, and you may withdraw it at any time.

We respond to valid legal process, and we can only produce what exists. For a Relay user that's their username, their email address if the account has one, their sign-in records held by Supabase (the time of their last sign-in, the IP address their current session started from, and the time and IP address of any sign-in in the past 24 hours), the day their account and each of their devices was created, abuse reports they filed or were named in, whether they've set a recovery key (but not the key itself — we only hold a hash of it), and any undelivered message as encrypted data we can't read. There's no message history or contact list to disclose.

Where we're legally permitted to tell you your data was requested, we will.

You can ask what we hold about you, ask us to correct it, and ask us to delete it. Write to privacy@relaymsg.app and we'll act within 30 days. For the app these requests are largely moot — beyond the account email there is nothing tied to you.

In Australia the Australian Privacy Principles set those rights out. In the UK or EU the equivalents are the UK GDPR and GDPR.

If you think we've handled your data badly, tell us first at privacy@relaymsg.app. We'll acknowledge within five working days and give you a considered answer within 30.

If that answer doesn't satisfy you, you can take it to the Office of the Australian Information Commissioner, or to your national data protection authority if you're in the UK or EU. You don't need our permission, and you don't have to come to us first.

Relay isn't directed at children under 13, and we don't knowingly collect their data. Since we collect no identifying data beyond an email address, we have no mechanism to determine a user's age, and we don't attempt to build one.

If this policy changes in a way that affects what we collect, we'll say so plainly at the top of this page and in the app before the change takes effect. Previous versions stay available so you can see what changed.