How Relay works

• Messages, photos, voice notes, calls and group chats are end-to-end encrypted with the Signal Protocol. Only the devices in the conversation hold the keys.
• Messages don't say who sent them, our servers can't read them, and they're deleted as soon as the recipient's phone confirms they arrived.
• No phone number, and no email unless you want one. An account can be just a username and a passkey.
• When you look someone up, the username or email you search for is blinded on your phone first, so our servers never see it.
• The server keeps no record of your groups — not their names, not their members.

Relay uses the Signal Protocol, through Signal's own open-source library, libsignal. Conversations start with PQXDH, a key exchange designed to resist attack by future quantum computers, and continue with the Double Ratchet, which gives every message a fresh key. A key stolen later can't unlock messages that came before it.

Your keys are generated on your phone. Your identity key is kept in the iPhone's Keychain, protected by a key held in the Secure Enclave, and it leaves your phone only end-to-end encrypted, to your own devices, when you link a new one.

Messages are padded to a handful of fixed sizes before they're encrypted, so the size of what's sent gives little away about what it says.

You sign up with Apple, Google, an email address, or nothing but a passkey — there's no phone number anywhere in it. Email sign-in is handled by Supabase, our authentication provider. Relay's own servers keep a one-way, keyed token derived from your email rather than the address itself, and you can remove the email entirely once you have a passkey.

Passkeys are checked by Relay's own servers, never Supabase. Signing in with one on a new phone also unlocks your chat list, using a secret only the passkey can produce. A recovery key made on your phone does the same if you lose your passkey; our servers keep only a one-way hash of it.

People can't find you by email unless you turn on Find Me by Email; it's off by default. Your username is how people add you.

You can set an account password. Once it's set, signing in to your account on a new phone needs it — so someone who gets into your email still can't take over your Relay account. Signing in on a new phone also signs out your old one.

When someone you've never chatted with messages you, or adds you to a group, it arrives as a request. Until you accept, they don't get read receipts or your typing, name or photo, their photos and videos aren't downloaded, and the notification never shows what they wrote.

You can connect through a proxy someone shares with you. Your phone talks to Relay through it inside an encrypted connection, so the proxy can't read anything or see who you are on Relay — but whoever runs it can see your IP address and that you use Relay, so only use one you trust. Relay checks the proxy before using it, keeps checking it, and warns you if it's blocking you, slowing you down or fails a security check. It never quietly falls back to connecting directly. The proxy software is open source and anyone can run it.

Every message is sent with sealed sender. The sender's identity travels inside the encrypted message, so our server delivers it knowing only which device mailbox it's for — not who it came from. Sealed sender is always on; there's no setting to get wrong.

If the recipient's phone is offline, the encrypted message waits in that mailbox. As soon as the phone collects it and confirms receipt, the server deletes it. A message that's never collected is deleted after 14 days.

Looking someone up uses blinded contact discovery. Your phone scrambles the username or email with a random value before sending it; the server does its half of the calculation on something it can't read, and your phone finishes the match locally. The server never sees what you searched for. To finish the match your phone downloads a batch of directory entries, with the one it needs mixed in among hundreds of random others, so the server learns at most that you looked up someone in that batch.

Relay only looks at your address book if you tap Find Contacts, and your contacts are never uploaded.

A group chat gets the same encryption as a one-to-one chat. The group's name, members and admins are managed by the members' phones and shared between them end-to-end encrypted. Our server keeps no group roster at all.

A group invite link holds its decryption key in the part of the link after the #, which browsers never send to a server — including ours.

Attachments are encrypted on your phone before they're uploaded. The server stores ciphertext it can't read, for up to 14 days so the other phone has time to fetch it, then deletes it whether it was collected or not. Photos have their location and other metadata removed before they're sent.

By default the push notification Apple delivers is an empty wake-up: no sender, no preview, no message. Your phone then fetches the encrypted message from Relay, decrypts it, and draws the notification itself.

If you turn on Faster Alerts, the encrypted message rides inside the push instead. It's still end-to-end encrypted and still sealed, so Apple can't read it or see who sent it.

Voice and video calls use WebRTC and are end-to-end encrypted. With Relay-Only Calls, on by default, a call is relayed through our own call server rather than connecting the two phones directly, so the other person never sees your IP address. If our server can't be reached, the call fails rather than quietly connecting directly.

If our call server is down or close to overloaded, new calls are relayed through Cloudflare's call relay until it recovers. Either relay sees the IP addresses in a call and how much data passes between them — never what's said.

Your message history lives on your phone in a database encrypted with SQLCipher. Its key is wrapped by the Secure Enclave, so the file is unreadable to anything that gets at it outside the app.

Emergency Wipe erases messages and keys on all of your devices at once.

iCloud Backup is optional and off until you turn it on. Your backup is encrypted on your phone with a recovery key that only you hold, then stored in your own iCloud. Apple and Relay see only ciphertext.

That cuts both ways: lose the recovery key and the backup can't be opened, by anyone. A restore brings back your message history; your encrypted sessions start afresh, so your contacts will see your safety number change.

Every conversation has a safety number you can compare with the other person, in person or over a channel you trust. If it matches, no one is sitting in the middle.

If a contact's key changes — a new phone, a reinstall, or something worse — Relay tells you, and holds back new messages to them until you've acknowledged the change.

• Your username, and a keyed one-way token derived from your email if you have one.
• Your passkeys' public keys, and a one-way hash of your recovery key if you've made one.
• Your chat list (who your chats are with, not messages), encrypted so only your account password, passkeys or recovery key can open it.
• Your devices, each with a hashed password, and a hashed account password if you set one.
• Push tokens, so your devices can be woken.
• Your public keys, so people can start encrypted chats with you.
• Encrypted messages waiting for an offline device — until collected, or 14 days.
• Encrypted attachments — up to 14 days.
• Encrypted group invite links, until they expire.

• What you write, send or say — in any readable form.
• Who sent a message (it isn't on the message; see timing below).
• Your address book, or the usernames and emails you search for.
• Your groups: their names, members or admins.
• Your private keys or your backup's recovery key.
• Your location.

Encryption protects what you say. It can't hide everything around it, and we'd rather you knew exactly where the line is.

• Network metadata. Connections to our servers pass through Cloudflare, which can see your IP address, when you connect, and the account identifier attached to signed requests. It can't see message content, and nothing it carries names a message's sender.
• Timing. Sealed messages don't name their sender, but our servers (and Cloudflare) see when each phone connects and sends. Someone recording all of that could try to pair senders with recipients by timing. We don't log it; it's the limit of what sealed sender hides.
• Push notifications. Apple can see that your phone received a push, and when.
• Looking up someone's keys. To start an encrypted chat, your phone downloads the other person's public keys. It does this anonymously: it proves it may contact them with a key it got from the private directory lookup, so our servers can't tell who is asking for whose keys. If the directory can't vouch for the account, it falls back to a request signed by your device.
• Calls. The call relay sees the IP addresses taking part. Turn Relay-Only Calls off and the two phones may connect directly, which shows each person the other's IP address.
• Your device. Messages are decrypted on your phone to be shown to you. Anyone who can unlock it, or malware running on it, can read them.
• The other person. They can screenshot, forward or repeat anything you send. No messenger can change that.
• Your sign-in provider. Supabase holds your email address and sign-in records; Apple or Google do too if you sign in with them.

The privacy policy sets out what we collect and what we could be compelled to hand over. Source code & licences lists the open-source components inside Relay and how to get the app's source. Relay compared puts these choices next to other messengers.

Found a security problem? Write to security@relaymsg.app.