Privacy Policy

Last updated: 2026-08-13

Relayium is built so that your files and ephemeral text stay yours. Local browser sessions are direct; cross-network browser sessions may carry end-to-end encrypted ciphertext through TURN; CLI text is direct-only; and stored download links hold only zero-knowledge encrypted file ciphertext.

This page explains the little data the service does handle, and the data it deliberately never sees.

Local-network content is not stored

When you transfer files or exchange text between devices on the same network, no account is needed and Relayium does not store the content. The signaling service temporarily handles connection metadata such as IP addresses, room membership, device names, presence, capabilities, and WebRTC negotiation so the devices can connect directly.

What an account stores (only if you sign in)

Same-network (LAN) sessions need no account. To create a cross-network pairing code for a browser or CLI session, the code creator must sign in; the person joining with that code does not need an account. Creating a stored download link also requires signing in. If you sign in, we store the minimum needed to run an account:

• Your email address and a display name.
• Which sign-in method you used (Sign in with Apple, Google, an email magic link, or email + password). Magic-link tokens are stored only as a hash, never in clear text; if you set a password, we store only its bcrypt hash, never the password itself. If you use Sign in with Apple with Apple's private email relay, we only ever see that relay address.
• A login session, kept in a secure, httpOnly cookie.
• Devices you register, as a random device id and a device name (e.g. your platform name).

Stored transfer (download links)

When you use the optional stored download-link mode, your browser encrypts your files with AES-256-GCM before they leave your device. The decryption key exists only in the URL fragment — it is never sent to the server. This means:

• The server stores only ciphertext. It cannot read your file contents, filenames, or keys.
• We record the ciphertext size and timestamps (upload time, expiry) for quota management and cleanup.
• Ciphertext is automatically deleted at expiry or on the first complete download (burn-after-read), whichever comes first.

Content we cannot read

Relayium servers never receive the following in plaintext and cannot decrypt them:

• The contents of your files.
• The names of your files.
• The bodies of your live text messages.
• Your encryption keys.

Cross-network relay (TURN)

Cross-network browser file and text sessions use a TURN server by design. TURN carries only end-to-end encrypted ciphertext and transport metadata. We attribute relayed-byte totals and timestamps to the code creator's account for quotas and abuse prevention, without inspecting message or file plaintext. CLI text is direct-only and does not use or count against TURN. Live text requires both participants to be online; Relayium provides no offline delivery or server-side message history, though either endpoint may copy or retain what it receives.

Usage metering and quotas

Paid plans mean the service has to count how much of it each account uses. While you are signed in, we keep a running per-account record of the bytes you upload and download through Relayium, the size of the ciphertext your stored links are holding, and the relayed-byte totals attributed to pairing codes you created. These counters outlive the transfer that produced them — we keep them as monthly per-account totals — because they are what enforces the usage, storage and relay quotas included in your plan, and what our billing and account records rest on. A paid subscription is a fixed price for a plan, not a per-byte charge.

• What is recorded: byte volumes, stored-object sizes, and the times they were measured, linked to your account.
• What is not: your file contents, file names, and message bodies stay encrypted and unreadable to us, and we do not record which screens you open or which features you use.
• This is metering, not analytics. Our apps and website carry no advertising or third-party analytics SDK, and these counters are never used to track you across other apps or websites.
• You can see your own current totals at any time on your account page, in the app or on the web.

Cookies and local storage

We use one session cookie to keep you signed in. In your browser's local storage we keep a random device id so a device you registered can be recognized. We do not use advertising or tracking cookies.

Third-party services

A few third parties are involved only when you choose to use them:

• Google, if you sign in with Google — we receive your email and basic profile to create the account.
• Apple, if you use Sign in with Apple — we receive a stable identifier and the email (or Apple's private relay address) you choose to share.
• Stripe, our payment processor for subscriptions purchased on the web — see Payments.
• Apple, for subscriptions purchased inside our iOS and macOS apps via in-app purchase — see Payments.
• An email delivery provider, to send account emails such as magic-link sign-in and verification.

Payments

You only share payment data if you buy a paid plan. We never receive or store your full card number.

• On the web, payments are handled by Stripe. Card details go to Stripe, not to us; we receive only a customer reference and the resulting subscription status.
• In our iOS and macOS apps, subscriptions are bought through Apple in-app purchase. Apple processes the payment under your Apple ID, and we never see your payment method. The app sends us Apple's signed record of the transaction, and we keep what it says about the purchase: which subscription product you bought, Apple's identifier for that subscription, and its status, billing period, and renewal or expiry dates. We also generate a random token that ties an App Store purchase to your Relayium account.
• For your account we store only your current plan, subscription status, billing cycle, period dates, and your payment provider's reference for the subscription — never card data.

The Relayium app

Our native apps handle a little device-level data that the website does not:

• Push notifications: if you enable them, we store an Apple Push Notification service (APNs) device token so we can deliver notifications to your device. You can turn notifications off at any time in your device settings.
• Camera and photos: used only on your device to scan a QR code or pick files to send. Nothing is captured or uploaded from the camera or your library except the files you deliberately choose to transfer.
• The app does not track you across other apps or websites, and contains no advertising or third-party analytics SDKs.

Data retention and deletion

Account data is kept while your account exists. You can delete your account and its data at any time from your account settings, in the app or on the web. Deletion starts a 30-day grace period during which you can undo it by signing back in; after that, your account and personal data are permanently removed. Aggregate usage counters we must keep for billing and abuse-prevention are anonymized so they are no longer linked to you.

Your rights

You can access, correct, export, or delete your account data, and object to or restrict certain processing. Most of this you can do yourself in your account settings; for anything else, email support@relayium.com. We do not sell your personal data. Where the GDPR or similar laws apply, our basis for the little data we process is performing the service you asked for and our legitimate interest in keeping it secure and preventing abuse.

Children

Relayium is not directed to children. We do not knowingly collect personal data from anyone under 13, or under the minimum age of digital consent where you live. If you believe a child has given us data, contact support@relayium.com and we will delete it.

Changes to this policy

We may update this policy as the service evolves. When we do, we will change the "Last updated" date above.

Contact

Questions about privacy? Email support@relayium.com.