Privacy Policy

We collect only what the service requires in order to function. The complete list follows.

The following are stated explicitly because their absence is a deliberate design decision rather than an oversight.

• No analytics. There is no analytics platform of any kind on the Relay-It website or in the application.
• No advertising or tracking pixels. No ad networks, no retargeting, and no cross-site tracking.
• No tracking cookies. Section 7 sets out the two items stored on your device.
• No location data. Relay-It never requests or records your location. Photographs you send may contain location information within their own file metadata; that is a property of the file and is not something we extract, read, or index.
• No access to contacts or address books. Invitations are links you choose to share.
• No use of your content to train artificial intelligence models, by us or by any third party.
• No sale, rental, or trade of personal information to any party, for any purpose.

A room is a shared surface, and every member of it sees the same contents. Two consequences follow. Both are intentional, and both are set out here rather than left to be discovered.

The first exists because in a shared transfer space the recipient is usually best placed to clear an item once it has been collected. The second exists because a room of wholly unidentified members is less safe for everyone than one in which the person who assembled the room can account for who is in it. Neither can be changed quietly; any change would be notified under section 12.

You should invite into a room only those people with whom you are content to share both of the above.

All content sent through Relay-It is permanently deleted 30 days after it arrives. A scheduled process runs daily, identifies content that has reached 30 days, deletes the stored files, and removes the associated records.

This applies on every plan. No tier purchases longer retention, and no tier will.

We retain your account record — your email address and plan status — for as long as your account exists, and payment records for as long as required for tax and accounting purposes.

Deletion removes content from the live service. Encrypted infrastructure backups maintained by our hosting providers may retain fragments for a short additional period before expiring on their own schedule. Those backups exist solely for disaster recovery and are not available as a means of retrieving expired content.

Personal information is used to operate the service you have paid for, and for no other purpose. Specifically:

• To authenticate you and maintain your signed-in session.
• To transfer content between the devices and members of your rooms.
• To deliver push notifications, where you have enabled them.
• To determine which plan applies to your account and what limits follow from it.
• To send necessary account and security correspondence, including sign-in codes, receipts, and notice of changes that affect you.
• To diagnose faults and to maintain the security and availability of the service.

We do not profile you, score you, or construct an advertising picture of you. Relay-It operates no marketing mailing list.

We share personal information only with the infrastructure providers necessary to operate the service, and only to the extent each requires:

• Supabase — database, authentication, and file storage. Accounts, room memberships, and content reside here. (Privacy policy)
• Vercel — hosting and delivery of the website and application. (Privacy policy)
• Stripe — payment processing. Stripe handles card details directly; we neither receive nor store them. (Privacy policy)
• Resend — delivery of sign-in codes and account correspondence. (Privacy policy)
• Push delivery services — where notifications are enabled, delivery occurs through the push service built into your browser or operating system, operated by Apple, Google, or Mozilla depending on your device.

These providers process data on our instructions and are not permitted to use it for their own purposes. Some are located outside Canada, which means your information may be processed in other jurisdictions and may be subject to lawful access requests there.

We may also disclose information where legally compelled to do so by valid legal process, or where necessary to protect the security of the service or the safety of any person. In view of section 4, there is in most cases very little in existence to disclose.

Relay-It uses your browser's local storage, rather than tracking cookies, for two items:

• Your authentication session, so that you are not required to enter a sign-in code each time you open the application.
• Your light or dark appearance preference.

Both remain on your device, neither is transmitted for tracking purposes, and clearing your browser data removes them.

You may request access to the personal information we hold about you, request correction of it, or request deletion of your account and all information associated with it.

Several controls are already available to you within the application. You may delete individual items, leave a room, and — for rooms you created — remove members and delete the room. In addition, all content deletes itself after 30 days without any request being necessary.

All traffic is encrypted in transit using TLS, and stored data is encrypted at rest by our hosting providers. Access to rooms, content, and files is enforced at the database and storage layer rather than solely within the application, meaning the server itself declines to return data belonging to a room of which you are not a member.

A full security review of the service was completed in July 2026, covering database access rules, server functions, storage permissions, and the payment path.

No system is perfectly secure and we do not claim otherwise. If you believe you have identified a security issue, please write to hello@relay-it.io. Such reports are welcome.

Relay-It is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has created an account, please write to us and we will remove it.

Relay-It is operated from British Columbia, Canada. We handle personal information in accordance with Canadian federal privacy legislation, being the Personal Information Protection and Electronic Documents Act (PIPEDA), and applicable British Columbia legislation.

If you are located in a jurisdiction conferring additional rights — including the United Kingdom, the European Economic Area, or certain United States jurisdictions — please write to us and we will give effect to those rights.

We may amend this policy from time to time. Where an amendment materially affects you, we will give notice by email or by notice within the application, rather than by silently revising the date above. Continued use of Relay-It following an amendment constitutes acceptance of the amended policy.

Superseded versions are available on request.

Questions about this policy, or requests concerning your own personal information, should be directed to hello@relay-it.io.

Relay-It, British Columbia, Canada.