Privacy Policy

Relay is an email app. That means it handles some of the most personal data you have. This policy says exactly what Relay keeps, where, for how long and why, based on how the apps and Relay's server actually work. If anything here is unclear, write to us at marek@diferentlabs.com.

1. The short version #

• On a Mac or iPhone, your mail stays on the device. The apps download it straight from Gmail or your mail server. Mailbox passwords and Google tokens are kept on the device, encrypted with a key in the Keychain, and never stored on Relay's server.
• Relay on the web is different by design: your mail is fetched, cached and worked on by Relay's server (on Fly.io in Amsterdam), in a process that serves only you, with your passwords and tokens encrypted.
• Relay's server is small on purpose. It signs you in, keeps your settings and the assistant's notes in sync (encrypted), counts read-status opens and hosts large-file links. It runs on Cloudflare, with stored data in the United States.
• AI: when the assistant works on an email, the parts it needs go through Relay's server to Anthropic's Claude. Relay records what a request cost, not what it said. Neither we nor Anthropic use it to train AI models.
• Read status records opens and clicks of the mail you choose to track. Readers' IP addresses are stored only as salted hashes.
• No ads, no selling, no sharing for advertising. The website sets no cookies and loads nothing from anyone else.
• You can delete your Relay account yourself, in the app's Settings, and its data on Relay's server goes at once (section 8.1).

2. Who we are, and our role #

Relay is provided by diferent LLC, 8 The Green, STE A, Dover, DE 19901, USA ("we", "us"). You can reach us, including about privacy and data protection, at marek@diferentlabs.com. We have not appointed a data protection officer, as we are not required to.

Under the EU and UK General Data Protection Regulation (GDPR and UK GDPR) and similar laws, we have two roles:

• We are the controller of the data we use to run Relay as a service of our own: your Relay account, devices and sign-in, usage and limits, billing status, support emails, security and abuse prevention, the website and the waitlist.
• We act as a processor (service provider) for you for the content we handle on your behalf and on your instructions: the mail, attachments and contacts in your mailboxes when Relay on the web or the AI features process them, the data you sync (settings, notes, drafts history), your large files, and read-status data about the people you email. You decide whether to use these features and for which mail. If you are a business, our Data Processing Addendum governs this processing. If you use Relay only for personal or household purposes, data protection law may not treat you as a controller; we then handle this data only as needed to provide the features you turned on, under this policy.

Purchases of Pro are sold through Link, by Stripe, under Stripe Managed Payments. Stripe, through Link, is the merchant of record and processes payment data as an independent controller, under its own privacy policy (section 4.10).

3. What stays on your device #

The Mac and iPhone apps connect directly to your mail provider (Gmail, iCloud, Outlook, Fastmail or any IMAP and SMTP server). Your mail, attachments, drafts, search index and the app's own database are kept on the device. On the Mac, passwords and tokens are encrypted with a key held by the macOS Keychain; on the iPhone, they are kept in the iOS Keychain, available only on that device after it is first unlocked. When you remove Relay from a device, what it stored there goes with it.

From the device, the apps also contact a few fixed services directly:

• Sender photos (setting "Sender photos", on by default): to show a picture next to a sender, the app asks Gravatar for the photo that belongs to a SHA-256 hash of the sender's address, and for business domains asks Google's favicon service for the domain's logo. It never contacts the sender's own servers. Results are cached for a week. You can turn this off in Settings.
• Updates (Mac): the app downloads new versions from GitHub, where our releases are published.
• Dictation: see section 4.9.

Relay also blocks the tracking pixels in the mail you receive by default, so senders do not learn when you read their mail.

4. What we process, why, and on what legal basis #

The legal bases below are those of the GDPR and UK GDPR: performance of our contract with you (Art. 6(1)(b)), our legitimate interests (Art. 6(1)(f)), your consent (Art. 6(1)(a)) and legal obligations (Art. 6(1)(c)). Where we act as your processor, the legal basis is yours, and we process on your instructions. Retention for each category is in section 8.

4.1 Your Relay account and devices

What: the mailbox addresses you proved (each with how it was proved: Google or a code), your name and, if you signed in with Google, the URL of your Google profile photo; a random account ID; when the account was created and last used; its status and any limits we set for it. For each signed-in device: its name, platform (Mac, iPhone or Web), app version, when it was created and last used, and its refresh token stored only as a hash. One-time sign-in codes are stored as hashes, with a salted hash of the requesting IP address for rate limits.

Why: to create your account, sign you in, keep it secure and apply your plan. Basis: contract; legitimate interests in security and preventing abuse.

4.2 What you sync between your devices

What: your settings and signature; your tabs and the senders you filed; your mailbox setup (server names, ports and usernames, never passwords); snoozes and reminders (with the Message-ID of the mail they belong to); what the assistant learned: general notes, notes about specific people, its proposals, the writing voice it learned for each mailbox (with short samples of your own sent mail), and a history of your edits to its drafts (the draft and what you sent, the latest 200); and photos you set for contacts. Each item is encrypted on Relay's server (AES-256-GCM) before it is stored. The server holds the key, so this is encryption at rest, not end-to-end encryption.

Why: so a new device, or Relay installed again, comes back the same. Basis: contract (we act as your processor for the content).

4.3 The assistant and other AI features

What is sent: when the assistant is turned on (it is by default), Relay looks at new mail that may need you. Simple rules run on your device first; mail that may need you is then read by an AI model to decide what it asks of you, and if needed the assistant investigates: it reads the conversation, searches your mailbox, opens attachments such as PDFs, and prepares a card with a draft. When you ask (for example "find the lease and send it to Lena"), it does the same for your request. For each of these, the parts of your mail, attachments, notes, writing voice and instructions that the task needs are sent from your device (or, on the web, from your process on our server) through Relay's server to Anthropic, which runs the Claude models. When you ask the assistant to look something up on the web, it uses Anthropic's web search, which sends search queries (not your mail) to search providers chosen by Anthropic.

What Relay keeps: Relay's server passes the request through and does not store its content. For each AI call it keeps a record of what it was for (for example "draft" or "triage"), the model, the platform, the number of tokens and the estimated cost, and a daily total per account, to apply your plan's limits and understand costs. Cards the assistant prepared on one of your devices are kept encrypted on the server so your other devices can show them. What happened to each card (shown, sent, how much you edited it, dismissed) is recorded to measure the assistant's quality; if you press "Not right" and write a note, the note is stored encrypted and our team can read it to improve the assistant.

Anthropic: under Anthropic's commercial terms, Anthropic does not use the inputs and outputs it receives through its API to train its models, and it deletes them after a limited period (under its current policy, at most 30 days by default), except where it must keep them longer to enforce its usage policies or to comply with the law, as described in Anthropic's own documentation. Anthropic processes this data in the United States.

No training by us: we do not use your mail, files or AI requests to train AI models.

Your choice: you can turn the assistant off in Settings. The AI features only work when you have a Relay account and AI is available on your plan. Basis: contract (we act as your processor for the content); legitimate interests for the cost records and quality measures.

The mail the assistant reads includes messages other people sent you. Where the GDPR applies, the basis for processing their data in this way is your legitimate interest (and ours on your behalf) in managing your own mail efficiently, with the safeguards described here: no training, no storage of content on Relay's server, encryption of what is kept, and short retention by our provider.

4.4 Read status: data about the people you email

Read status and link tracking are on by default for new mail in the Relay apps; each can be turned off in Settings, and tracking can be turned off for one message in the composer. When they are on, the app adds a tiny invisible image to the message, rewrites its links, and registers the message with Relay's server. For mail to 2 to 25 people, each person gets their own copy with its own image.

What we store for each tracked message: a random ID, when it was sent, the links in it (to send clicks on), and an encrypted description so your devices can show it: its subject, Message-ID, the recipients' names and addresses, and the sent time. The recipients are never stored in plain text.

What we store when a tracked message is opened or a link is clicked: the time; whether it was an open, a reading-time measurement or a click (and which link); how long it stayed open; our verdict on whether it was a person or something else (Gmail's image proxy, Apple Mail Privacy Protection, a security scanner, a prefetch, or your own device) and why; the kind of device or mail app (for example "iPhone" or "Outlook"), worked out from the user agent, which itself is not stored; for opens by people, the approximate city and country, from Cloudflare's IP-based location; and a salted SHA-256 hash of the IP address, truncated, used to recognise repeat opens and scanners. The IP address itself is not stored, nor is any cookie or device identifier set on the recipient's device.

To leave out your own opens, the app tells the server the public IP address of your own network, which is stored only as a salted hash.

Why: to show you, the sender, whether and when your mail was read. Basis: we process this data on behalf of the sender who chose to track the message. The sender is responsible for having a legal basis, for telling recipients where the law requires it, and, in the EU, EEA and UK, usually for getting the recipient's prior consent under the ePrivacy rules (see our Terms, section 14, and Acceptable Use Policy, section 1). Where we are a controller of this data (for example, for detecting scanners and abuse), our basis is our legitimate interest in providing an accurate, secure service.

If you received mail sent with Relay: you can stop read status from working by turning off remote images in your mail app (many apps and Apple Mail Privacy Protection already prevent it). You can ask us to delete the data about your opens, or object to it, by writing to marek@diferentlabs.com; please include the email you received or its sending address and date, so we can find it. We will also pass your request to the sender where appropriate.

4.5 Large-file links

What: the file you upload, its name, size and type, when it was uploaded and expires, and how many downloads were started. The file is stored in Cloudflare R2. The download page shows your name, the file's name and size, and until when it is available, to anyone with the link. Why: to deliver files too large for email. Basis: contract (we act as your processor for the file).

4.6 Relay on the web

What: Relay on the web runs the same app on our server for you: your process fetches and caches your mail, attachments and drafts from your mail provider, keeps its own database of them, runs the assistant and read status, and stores files you add to the composer (kept 30 days). Your mailbox passwords, Google refresh tokens and Relay tokens are encrypted with AES-256-GCM, with a key derived for your account alone. Your browser gets a session cookie; the server stores only a hash of it. All of this is stored on a disk at Fly.io in Amsterdam, the Netherlands. Why: a browser cannot hold your mailbox the way a Mac can. Basis: contract (we act as your processor for the mail).

4.7 Usage, limits and plan

What: per account and day, how many AI actions, AI searches, background AI tasks, assistant investigations, voice dictations and tracked messages you used, with token counts and estimated costs. Why: to apply your plan's allowances and fair use, and to understand and control our costs. Basis: contract; legitimate interests.

4.8 Google sign-in and Gmail

When you add a Gmail or Google Workspace mailbox with Google, or sign in with Google, see section 11 for exactly what we access and the Google API Services User Data Policy.

4.9 Dictation

When Relay offers dictation through Wispr Flow (only when we have it enabled), your voice is recorded on your device and streamed from the device directly to Wispr Flow, together with context that improves recognition: your name and email address, the names of the people in the conversation, the text of up to the last six messages of the conversation (shortened), and what you have already written. Relay's server only issues a short-lived token for it and counts how many you used; it does not receive the audio. Wispr Flow processes this under its own terms, in the United States. On iPhone, when Wispr Flow is not used, dictation uses Apple's on-device speech recognition. Basis: contract; you choose to use dictation each time you press the microphone.

4.10 Purchases

Pro is sold through Link, by Stripe, as merchant of record. Stripe and Link collect your payment details, billing address and tax information, handle the purchase, send your receipts and invoices, and keep their own records of it, under their own privacy policy and to meet their tax and legal obligations. We receive from Stripe what we need to give you the plan you bought: the link between your Relay account and your Stripe customer record, your email address, the plan and billing period, the subscription's status, trial and renewal dates, your country, and the amounts charged and refunded. We never see your full card number. Basis: contract; legal obligations (accounting and tax).

4.11 Support and communication

When you email us, we keep the conversation to help you and to improve Relay. We send service emails (sign-in codes, notices about your account, plan, trial, renewal or these policies). Receipts, invoices and refund notices for Pro are emailed to you by Link, not by us. We do not send marketing email without your consent, and you can unsubscribe at any time. Basis: contract; legitimate interests; consent for marketing.

4.12 The website and the waitlist

The website sets no cookies, loads no analytics, advertising or third-party scripts, and keeps only your language choice in your browser's storage (see our Cookie Notice). If you join a waitlist, we store your email address, which platform you are waiting for, when you joined, your country (from Cloudflare) and a salted hash of your IP address for rate limits, and use them only to tell you when Relay is available there. Basis: consent (you can withdraw it by writing to us).

4.13 Security and operational logs

Our hosting providers, Cloudflare and Fly.io, process technical data about requests (such as IP address, time, path and status) to deliver and protect the service, and keep short-lived logs that we can see for troubleshooting. Relay's server on Cloudflare has Cloudflare's Workers Logs turned on: a log entry for each request it handles, kept by Cloudflare for up to 7 days. Relay's own code never writes mailbox passwords, tokens or mail content to logs. Our team's actions in Relay's admin tools are recorded in an audit log. Basis: legitimate interests in security, reliability and preventing abuse.

5. Who we share data with #

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share it only:

• with the service providers that run Relay for us, under contracts that require them to protect it and use it only to provide their service: they are listed, with what they receive and where, on our subprocessors page;
• with Stripe and Link, as merchant of record, for purchases;
• with the services you connect or direct Relay to use, such as your mail provider, and with the people you send mail and file links to;
• when the law requires it, or to protect the rights, safety or property of our users, the public or us, after checking that a request is lawful and limiting what we disclose;
• with a buyer or successor if diferent LLC or Relay is sold, merged or reorganised, under this policy, and after telling you.

6. Automated processing #

The assistant sorts mail into tabs, decides which emails may need you and drafts replies. It does not make decisions with legal or similarly significant effects on you or anyone else: it only suggests, and you decide. Read status classifies each open as a person or an automated fetch, to show you an honest picture; it does not profile recipients.

7. International transfers #

We are based in the United States, and Relay's server data is stored in the United States (Cloudflare), with Relay on the web in the Netherlands (Fly.io); our providers may process data in other countries, as listed on the subprocessors page. When we transfer personal data from the EU, EEA, UK or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum or the Swiss amendments where needed) in our agreements with our providers, together with additional safeguards such as encryption in transit and at rest. Some of our providers are certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, which may also apply to transfers to them. diferent LLC itself is not certified under the Data Privacy Framework. You can ask us for a copy of the relevant safeguards.

8. How long we keep data #

8.1 Deleting your account

You can delete your Relay account yourself, at any time, in the app: on the Mac and on Relay on the web in Settings, Accounts, in the Relay section ("Delete account"); on the iPhone in Settings, in the Relay section ("Delete account"). You confirm by typing your email address. You can also write to us from an address on your account, and we delete it in the same way once we have confirmed the request comes from you.

It takes effect immediately for the data on Relay's server. These are deleted at once:

• your account, its list of mailboxes, your devices and sessions;
• your synced settings and data (notes, voice, edits, snoozes and reminders), and the photos you set for people;
• your read-status history: tracked messages, opens, reading time and clicks;
• the assistant's cards and what became of them, and your AI usage records;
• your large-file links and their files (stored on Cloudflare R2);
• your subscription record. An active Pro subscription is cancelled at Stripe at once, as part of the deletion. There is no automatic refund; refunds follow our Refund and Cancellation Policy;
• on Relay on the web, your folder on our server at Fly.io, with the cached mail, database and encrypted credentials in it.

As a result, links in mail you sent with link tracking stop redirecting, and your large-file links stop working.

What is not deleted: the mail in your mailboxes, which stays with your mail provider; what the app stored on your device, unless you choose "Remove local data too" (removing Relay from a device also removes it); a record in our audit log that an account was deleted, by its random ID, without your email address or any other content; and the records Stripe and Link keep of your purchases as merchant of record, under their own privacy policy and to meet tax and legal obligations.

Backups and logs. Deleted data can remain in our providers' rolling backups and logs until they age out: up to 30 days in the point-in-time history of Relay's database, up to 7 days in Cloudflare's request logs, and a few days in Fly.io's snapshots of Relay on the web's disk. We do not use these copies, and we restore from a backup only to recover from a failure; if we ever do, we apply your deletion again.

9. Security #

We protect data with encryption in transit (HTTPS and TLS), encryption at rest (on our providers' storage, and in addition AES-256-GCM for the secrets and personal content Relay's server keeps), salted hashes instead of IP addresses and tokens, per-person isolation on Relay on the web, strict content security policies, rate limits, and least-privilege access for our small team. Our security overview has the details. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.

10. Your rights and how to use them #

Depending on where you live, you may have the right to: access your personal data and get a copy; correct it; delete it; restrict or object to its processing (including processing based on legitimate interests); receive it in a portable, machine-readable format; withdraw consent at any time, without affecting earlier processing; and not be subject to decisions based solely on automated processing with significant effects.

To delete your account and its data, you can use "Delete account" in the app's Settings (section 8.1), which takes effect at once.

To use your rights, email marek@diferentlabs.com, preferably from an address on your Relay account, so we can confirm it is you. We may ask for more information to verify a request. We answer within one month (or 45 days where US state law allows it), and tell you if we need more time. There is no charge, unless a request is clearly unfounded or excessive. Where we act as a processor for a business customer, we pass your request to that customer and help them answer it.

Complaints: if you are in the EU, EEA, UK or Switzerland, you can complain to your data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to resolve your concern first.

11. Google user data #

When you connect a Gmail or Google Workspace mailbox with Google, Relay asks Google for access to https://mail.google.com/ (to read, send, organise and delete mail in that mailbox over IMAP and SMTP, only as you instruct) and to your basic profile (openid, email, profile: your address, name and profile photo). When you sign in to Relay or Relay on the web with Google, it asks only for the basic profile.

• How we use it: to show your mail, send what you send, sync drafts, organise and archive mail when you ask, prove to Relay's server that you own the address, and provide the features you use, such as the assistant, search and read status. On a Mac or iPhone your Gmail data and tokens stay on the device; with Relay on the web they are kept, encrypted, on our server. Relay's server helps renew Google tokens without storing them.
• Who it is shared with: only with the providers needed for features you use (Anthropic for the AI features, Wispr Flow for dictation), as described above, and as required by law. We do not sell it, use it for advertising, or transfer it to data brokers or information resellers.
• No AI training: we do not use Google user data to develop, improve or train generalised or non-personalised AI or machine-learning models.
• No human reading: no person at Relay reads your Gmail data, unless you give us permission for specific messages (for example, for support), it is needed for security or to investigate abuse, it is required by law, or the data is aggregated and anonymised for internal operations.
• Revoking access: you can remove Relay's access at any time at myaccount.google.com/permissions, and delete the data as described in section 8.

Relay's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

12. United States: California and other states #

This section applies to residents of California and of other US states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others), in addition to the rest of this policy.

Categories we collect (in the last 12 months, and now), from you, your devices, your mail providers and Stripe, for the purposes in section 4: identifiers (name, email addresses, account and device IDs, hashed IP addresses); customer records (account and billing status); commercial information (plan and purchase history); internet or electronic activity (usage of Relay, read-status events); approximate geolocation (city and country of opens of tracked mail); audio (dictation, streamed to Wispr Flow, not kept by us); the content of your mail and messages when the features you use process it; and inferences limited to the features themselves (such as the writing voice the assistant learned, or which tab a sender belongs in). Account login credentials (mailbox passwords and tokens) are sensitive personal information; we use them only to provide Relay to you, and never to infer characteristics about you.

Disclosure: we disclose these categories for business purposes to the service providers on our subprocessors page and to Stripe. We do not sell or share personal information (as those terms are defined in the CCPA, as amended by the CPRA), have not done so in the last 12 months, and do not knowingly sell or share data of anyone under 16. We do not use or disclose sensitive personal information for purposes that would give a right to limit it. Because we do not sell or share, there is no "Do Not Sell or Share My Personal Information" choice to make; we honour Global Privacy Control signals as a request not to sell or share anyway.

Your rights: to know what we collect, use and disclose; to access and get a portable copy; to delete; to correct; to opt out of sale, sharing, targeted advertising and profiling (which we do not do); and not to be discriminated against for using these rights. You or an authorised agent can make a request by emailing us; we will verify it by confirming control of an address on your account. If we decline a request, you can appeal by replying with the subject "Appeal"; we will answer within the time the law sets, and if you disagree, you can contact your state's attorney general.

Retention for each category is in section 8.

13. Other regions #

• Brazil (LGPD): you have the rights in Art. 18 of the LGPD, including confirmation, access, correction, anonymisation, portability, deletion, information about sharing and revocation of consent. Our legal bases are those in section 4 (contract, legitimate interest, consent, legal obligation). Write to us to use your rights; you can also contact the ANPD.
• Canada (PIPEDA and provincial laws): we collect, use and disclose personal information only for the purposes described here, with your consent where required. You can access and correct your information and withdraw consent. Your information may be processed in the United States and other countries, where it may be accessible to their authorities. You can contact the Office of the Privacy Commissioner of Canada.
• Australia (Privacy Act 1988): we handle personal information under the Australian Privacy Principles. Data is held in the United States and the Netherlands by the providers listed. You can access and correct your information, and complain to us, then to the Office of the Australian Information Commissioner.
• Japan (APPI): we use personal information for the purposes stated here, and provide it to third parties in other countries (mainly the United States) as listed on our subprocessors page, under contracts that require protection equivalent to the APPI. You can request disclosure, correction, suspension of use and deletion.
• Switzerland (revFADP): the rights and safeguards described for the EU apply equally.

14. Children #

Relay is not for children. You must be at least 16, or the age of digital consent where you live if higher. We do not knowingly collect personal data from children under that age. If you believe a child has given us personal data, contact us and we will delete it.

15. Changes to this policy #

We will update this policy when Relay or the law changes, and post the new version here with a new date. If a change is material, we will tell you by email or in the app before it applies, and ask for your consent where the law requires it.

16. Contact #

For anything about privacy, write to marek@diferentlabs.com, or to diferent LLC, 8 The Green, STE A, Dover, DE 19901, USA.