01Introduction and Scope
Relay operates a messaging and chat platform that enables individuals and groups to communicate through text, voice, video, and related features. In order to provide these services, Relay processes information about the individuals who create accounts, the communications they exchange, and the environments in which the platform is used. This Privacy Policy explains what information is processed, how it is used, with whom it is shared, how long it is retained, and what rights and choices users have concerning that information.
This Privacy Policy applies to information processed by Relay in its capacity as a controller of personal data. It does not apply to the practices of third parties that Relay does not own or control, including other users of the platform, external websites that may be referenced within messages, or integrations that users authorize to access their accounts. Users should review the privacy practices of any third party service before interacting with it.
By using the platform, you acknowledge that you have read and understood this Privacy Policy. Where processing depends on your consent, Relay will seek that consent at the appropriate time and honor any subsequent withdrawal of consent. This Privacy Policy should be read together with the Terms of Service and any supplemental notices made available within the platform.
02Information We Collect
The information Relay processes falls into several categories, each supporting different aspects of the platform. The categories described below represent the types of information that may be collected in the ordinary course of operating the platform; not every category applies to every user, and certain information is collected only when specific features are used.
Account Information
When you create an account, Relay collects information necessary to identify and authenticate you, including your email address, a password that is stored in hashed form, a chosen username, and any display name, profile photo, biographical description, pronouns, and regional preferences you provide. If you sign in through an identity provider, Relay receives the identifiers and profile details that the identity provider chooses to share in accordance with your authorization.
Communications Content
Relay processes the content of messages you send through the platform, including text, images, video, audio, documents, reactions, stickers, and other material you transmit. The platform is designed to deliver this content to the recipients you select and to make it available to you across your authorized sessions. Content shared within a conversation is accessible to the participants of that conversation and, where applicable, to moderators of the space in which the conversation occurs.
Communications Metadata
In addition to the content of your messages, Relay processes metadata associated with communications, including the identifiers of the sender and recipients, timestamps, message sizes, delivery and read statuses, attachment types, and information about the conversation or group in which the communication occurred. Metadata is essential for the correct routing, ordering, and display of messages.
Device and Connection Information
Relay processes information about the devices and connections used to access the platform, including device type, operating system and version, application version, screen characteristics, language settings, network type, network addresses, and approximate location derived from network addresses. This information is used to operate the platform, to tailor the experience to the capabilities of each device, and to detect abuse.
Usage and Activity Information
Relay processes information about how you interact with the platform, including the features you use, the actions you take, the conversations you access, the volume and frequency of activity, the links you follow within the platform, and the crashes or errors encountered by your client. Usage information is used to maintain the platform, to diagnose issues, and to improve performance.
Contact and Social Graph Information
If you choose to connect with other users, Relay processes information about the connections you establish, including the users you add, follow, block, or mute, and the groups or communities you join. Where you choose to import contact information to find others on the platform, Relay processes only the information needed to match contacts and does not use imported information for unrelated purposes.
Payment Information
If you purchase an optional paid feature or subscription, Relay processes information necessary to complete the transaction, such as billing name, billing address, the last digits of the payment instrument, and confirmation identifiers returned by the payment processor. Full payment card numbers and security codes are handled directly by the payment processor and are not stored by Relay.
Support and Correspondence
When you contact Relay for support, submit a report, or correspond with the legal or trust and safety teams, Relay processes the information you provide in that correspondence, including the content of your message, any attachments, and the contact details associated with your inquiry.
03Methods of Data Collection
Relay collects information through several complementary methods, each tied to the operation of a specific feature or to the protection of the platform. Understanding these methods helps clarify the circumstances under which information enters the platform and the role that users play in that process.
Information Provided Directly
Much of the information Relay processes is provided directly by users, including during registration, when updating a profile, when configuring notification or privacy settings, when composing and sending messages, when creating or joining groups, and when contacting support. Where you provide information directly, you control the content of that information and can correct or update it using the tools available within the platform.
Information Generated Through Use
Some information is generated as a natural consequence of using the platform, including the timestamps associated with messages, the delivery status of communications, the connection logs needed to route traffic, the session identifiers needed to keep you signed in, and the error reports generated when a client encounters a fault. This information is produced by the operation of the platform and is processed for the purposes described in this Privacy Policy.
Information Received From Third Parties
Relay may receive information from third parties in limited circumstances, including identity providers you use to sign in, payment processors that confirm transactions, abuse reporting organizations that share information relevant to the safety of the platform, and service providers that perform functions on behalf of Relay. Information received from third parties is used only for the purposes for which it was shared.
Inferred Information
Relay may derive limited inferences from the information it processes, such as estimating a coarse geographic region from a network address to satisfy regional requirements, or classifying content as likely spam or likely abuse for safety purposes. Inferences are used to operate and protect the platform and are not used to build advertising profiles.
04Purposes of Data Processing
Relay processes information for the purposes described in this section. Each category of information is used only for purposes that are compatible with the reason it was collected and with the expectations of the users who provided it.
Providing and Operating the Platform
Relay processes information to deliver messages, maintain conversations, synchronize content across devices, authenticate users, honor privacy and notification settings, and ensure that the platform functions correctly. Without this processing, the platform could not operate.
Maintaining Security and Integrity
Relay processes information to detect and prevent unauthorized access, to investigate suspected abuse or fraud, to enforce the Terms of Service and supplemental policies, to protect the rights and safety of users and third parties, and to preserve the integrity of platform infrastructure.
Improving and Developing the Platform
Relay processes information to understand how the platform is used, to diagnose issues, to measure the performance of features, to test improvements, and to develop new capabilities. Where feasible, information used for these purposes is aggregated, pseudonymized, or otherwise processed in a manner that limits its identifiability.
Communicating With Users
Relay processes contact information to send transactional communications related to your account, including security alerts, service notices, receipts, and responses to inquiries. Where you have opted in, Relay may send informational communications about features, updates, or educational content. Marketing communications are sent only where permitted by applicable law and are subject to an opt out mechanism.
Supporting Optional Paid Features
Relay processes information necessary to provide optional paid features, including billing, invoicing, fraud prevention, and customer support for paid users.
Complying With Legal Obligations
Relay processes information to comply with applicable laws, regulations, court orders, and lawful requests from public authorities, and to establish, exercise, or defend legal claims.
05Legal Bases for Processing
Where privacy and data protection laws require Relay to identify a legal basis for processing personal data, Relay relies on the bases described below. The applicable basis depends on the specific processing activity and the circumstances in which it occurs.
Performance of a Contract
Much of the processing Relay performs is necessary to provide the platform in accordance with the Terms of Service. This basis applies to the operation of messaging features, account management, delivery of paid features, and related processing that is required to fulfill the agreement with users.
Legitimate Interests
Relay processes certain information in reliance on its legitimate interests in operating, securing, and improving the platform, in preventing and investigating abuse and fraud, in measuring and analyzing the performance of features, and in protecting the rights and safety of users and third parties. Where this basis is relied upon, Relay balances its interests against the interests, rights, and freedoms of the individuals concerned.
Compliance With Legal Obligations
Relay processes information where processing is necessary to comply with legal obligations to which it is subject, including obligations related to tax, consumer protection, content moderation, responses to lawful requests, and record keeping.
Consent
Where processing is based on consent, Relay seeks that consent in a clear and specific manner and provides tools to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing performed before the withdrawal and does not affect processing that relies on a different legal basis.
Vital Interests and Public Interest
In rare circumstances, Relay may process information where necessary to protect the vital interests of an individual, such as where there is an imminent risk to life, or where necessary to perform a task carried out in the public interest, in each case within the limits set by applicable law.
06Data Retention Practices
Relay retains information only for as long as necessary to fulfill the purposes for which it was collected, to satisfy legal or regulatory obligations, to resolve disputes, and to enforce applicable agreements. The retention period that applies to a particular category of information depends on the nature of the information, the purpose of the processing, and the legal requirements that govern it.
Account Information
Account information is retained for as long as an account remains active. When an account is deleted, the associated information is removed from the production environment within a reasonable period, subject to limited retention of identifiers and records needed to prevent the recreation of accounts that have been terminated for serious violations, to comply with legal obligations, and to protect against liability.
Message Content
Message content remains available to participants of a conversation until it is deleted by the sender, by the recipient in the case of content they control, or by an administrator of the relevant space. When a message is deleted, it is removed from the view of participants promptly and from production storage within a reasonable period. Backup copies may persist for a limited additional period before being overwritten in the ordinary course of backup rotation.
Metadata and Logs
Connection logs, security logs, and technical telemetry are retained for limited periods defined by operational need and security best practice, typically measured in weeks or months rather than years. Retention periods are set with reference to the specific purpose each log supports.
Support Correspondence
Records of support correspondence are retained for the period necessary to provide support, to resolve related matters, and to support quality assurance and training. After that period, records are deleted or anonymized.
Legal Holds
Where information is subject to a legal hold, preservation obligation, or pending legal claim, Relay retains the information for the duration of the hold or obligation, notwithstanding the retention periods described above.
07Data Sharing and Third Party Disclosures
Relay does not sell personal information. Relay shares information only as necessary to operate the platform, to comply with legal obligations, or with the authorization of the user to whom the information relates. The categories of recipients with whom information may be shared are described below.
Other Users
By design, messages and related content are shared with the recipients you select, and profile information is shared with users to whom you choose to display it. Information disclosed within a conversation is visible to the participants of that conversation and, where applicable, to administrators and moderators of the relevant space.
Service Providers
Relay engages service providers to perform functions that support the platform, including cloud hosting, content delivery, storage, analytics, security, fraud prevention, customer support, payment processing, communications delivery, and translation. Service providers process information only under written instructions from Relay, only for the purposes for which they were engaged, and subject to contractual safeguards that are consistent with applicable data protection law.
Authorized Integrations
Where you authorize an integration, bot, or external application to access your account or content, Relay shares the relevant information with that integration in accordance with the permissions you have granted. You may review and revoke authorizations through the platform settings.
Corporate Transactions
If Relay is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, information may be transferred as part of that transaction. In such cases, Relay will seek to ensure that the recipient is bound by commitments consistent with this Privacy Policy or will provide notice of material changes.
Legal and Safety Disclosures
Relay may disclose information where it has a good faith belief that disclosure is necessary to comply with applicable law, to respond to lawful requests from public authorities, to enforce the Terms of Service, to detect or prevent fraud or abuse, to respond to emergencies involving a risk to life or physical safety, or to establish, exercise, or defend legal claims. Where permitted, Relay seeks to narrow disclosures to what is strictly necessary and to challenge requests that appear to be overbroad or unlawful.
Aggregated or Deidentified Information
Relay may share aggregated or deidentified information that does not identify any individual, for research, reporting, or similar purposes, in a manner that does not allow recipients to reidentify the individuals to whom the information originally related.
08International Data Transfers
Relay operates globally and may process information in countries other than the country in which a user is located, including countries that may have data protection laws that differ from those of the user's country of residence. Transfers occur in connection with hosting infrastructure, service providers, corporate functions, and the delivery of communications to recipients located in different jurisdictions.
Where personal data is transferred from a jurisdiction that imposes requirements on international transfers, Relay implements appropriate safeguards to protect the information. Depending on the circumstances, these safeguards may include the use of standard contractual clauses approved by the relevant authority, reliance on adequacy decisions issued by competent regulators, implementation of supplementary technical and organizational measures, and reliance on specific derogations available under applicable law. Information about the safeguards applicable to a specific transfer is available upon request through the contact channels listed in this Privacy Policy.
09User Rights and Controls
Depending on your jurisdiction, you may have rights regarding the personal information Relay processes about you. Relay recognizes the rights described below and provides tools and contact channels through which those rights can be exercised. Where applicable law grants additional rights, those rights will be honored in accordance with the relevant legal framework.
Access
You may request confirmation of whether Relay processes personal information about you and may request a copy of that information. Where feasible, the information will be provided in a commonly used electronic format.
Correction
You may request that inaccurate or incomplete personal information be corrected. Many categories of information can be corrected directly through the account settings; other corrections may be requested through the contact channels listed in this Privacy Policy.
Deletion
You may request that personal information be deleted, subject to exceptions provided by applicable law, including exceptions for information that is necessary to provide the platform to other users, to comply with legal obligations, to detect or prevent fraud or abuse, or to establish, exercise, or defend legal claims.
Restriction and Objection
You may request that certain processing activities be restricted, or object to processing based on legitimate interests, where applicable law provides such a right. Relay will evaluate the request in accordance with the applicable legal framework.
Portability
Where applicable law provides a right to data portability, you may request a copy of certain personal information in a structured, commonly used, machine readable format, and may request that Relay transmit that information to another service where technically feasible.
Withdrawal of Consent
Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing performed before the withdrawal.
Complaints
If you believe that the processing of your personal information violates applicable law, you have the right to lodge a complaint with the supervisory authority in your country of residence, place of work, or place of the alleged violation, in addition to any other remedy available to you.
Exercising Your Rights
Requests to exercise rights may be submitted through the contact channels listed in this Privacy Policy. To protect your information, Relay may verify your identity before acting on a request. Relay will respond within the timeframe required by applicable law and will explain any limitations that apply to the response.
10Security Measures and Safeguards
Relay maintains a program of administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, and destruction. The safeguards are informed by generally recognized industry practice and are reviewed periodically in light of evolving threats, technological developments, and operational experience.
Safeguards include the use of encryption in transit between clients and platform infrastructure, the use of encryption at rest for stored data where appropriate, access controls that limit internal access to personal information on a need to know basis, authentication controls for employees and contractors, logging and monitoring of access to production systems, secure development practices, regular security assessments, and incident response procedures that address the detection, containment, and remediation of security events.
No system can guarantee absolute security. Users play an important role in protecting their own information, including by using strong and unique passwords, enabling multifactor authentication where available, keeping their devices and software up to date, and promptly reporting suspected security incidents through the contact channels listed in this Privacy Policy.
11Abuse Prevention and Safety Systems
The platform includes systems designed to detect and mitigate abuse, harassment, spam, malware distribution, and other forms of misuse. These systems combine automated detection with human review and rely on information such as message metadata, reported content, account behavior patterns, and signals derived from device and connection information.
Where a communication is flagged as potentially violating the Terms of Service or applicable law, Relay may review the flagged content and associated context to determine an appropriate response. Enforcement actions may include warnings, removal of content, restrictions on specific features, suspension of accounts, and termination of accounts, as described in the Terms of Service. Information related to enforcement actions is retained for the period necessary to operate the systems, to support appeals, and to address repeat or coordinated abuse.
Where required or appropriate, Relay reports specific categories of illegal content, such as material depicting the sexual exploitation of minors, to recognized reporting organizations and to law enforcement in accordance with applicable law. Cooperation with these organizations is governed by established protocols designed to protect the integrity of investigations and the privacy of uninvolved users.
12Cookies and Similar Technologies
The web and desktop clients of the platform use cookies, local storage, and similar technologies to maintain user sessions, remember preferences, support security features, and measure the performance of the platform. Cookies that are strictly necessary to provide the services you request are set without separate consent. Optional cookies, including those used for analytics where permitted, are set only with your consent, where consent is required by applicable law.
You can manage cookies through your browser settings, which typically allow you to block cookies, to delete existing cookies, or to be notified when cookies are set. Blocking or deleting strictly necessary cookies may affect the functioning of the platform. Where applicable, the platform provides an in product control for managing optional analytics cookies.
13Children and Age Related Restrictions
The platform is not directed to children under the minimum age specified in the Terms of Service. Relay does not knowingly collect personal information from individuals below that minimum age. If Relay becomes aware that it has collected personal information from an individual below the minimum age without the consent of a parent or legal guardian, Relay will take appropriate steps to delete the information and to terminate the associated account.
For users between the minimum age and the age of majority in their jurisdiction, Relay may apply additional safeguards designed to protect younger users, including limitations on the visibility of profile information, default privacy settings oriented toward greater protection, and restrictions on the receipt of messages from accounts with which the user has not connected.
Parents and legal guardians who believe that a child under the minimum age has provided personal information to the platform should contact Relay through the channels listed in this Privacy Policy so that appropriate action can be taken.
14Automated Decision Making
Relay uses automated systems to perform routine operational tasks, including routing messages, filtering spam, detecting abusive content, and authenticating access. These systems support the operation of the platform and the enforcement of its rules. Relay does not use these systems to make decisions that produce legal effects concerning individuals or similarly significant effects, except where such decisions are necessary for the performance of a contract with the user, are authorized by applicable law, or are based on the user's explicit consent.
Where an automated system contributes to an enforcement decision that materially affects an account, human review is available through the appeals process described in the Terms of Service. Users may request information about the logic involved in a specific automated decision where applicable law provides such a right.
15Changes to the Policy
Relay may update this Privacy Policy from time to time to reflect changes in the platform, in applicable law, or in the privacy practices of Relay. When a material change is made, Relay will provide notice through the platform, by email to the address associated with your account, or by other reasonable means before the change takes effect, except that changes required by law may take effect on the date specified by that law.
The effective date of the current version of this Privacy Policy is indicated at the top of the page. Your continued use of the platform after a revised version becomes effective constitutes your acknowledgment of the revised version. Relay maintains a record of prior versions and will make earlier versions available upon reasonable request.
16Contact Information
Questions, comments, and requests concerning this Privacy Policy or the processing of personal information may be directed to the Relay privacy team by email at privacy@relay.app. Requests to exercise rights under applicable data protection law may be submitted to the same address and should include enough information to identify the account or records at issue.
General support inquiries may be sent to support@relay.app. Legal notices may be sent to legal@relay.app. Reports concerning content that may violate the Terms of Service or applicable law may be submitted through the in product reporting tools or by email to trust@relay.app.
Where required by applicable law, Relay will designate a data protection officer or representative and will publish the relevant contact details through this Privacy Policy or a dedicated notice within the platform.