What relay stores — and what it never sees
relay stores each event — sender and recipient relay IDs, kind, a short note, timestamp, hash — in an append-only log. It never receives file contents. Email addresses and display names live only in a separate mapping table linking a relay ID to a verified identity. Other users see the ID, never the email. Delete the mapping and your personal data is gone without breaking the hash chain.
Can other users see my email?
No. relay addresses people by an opaque, relay-issued ID:
you -> send to mbr_9f2c... <- what other users see
|
v
relay's mapping table <- email lives only here
|
v
delivered to the real personSend to an email address and you get HTTP 400. Your own project’s members see the mapping (ID → display name) so they know who’s who. People in other projects don’t — your ID is different there.
Does relay see my code?
No. The hook sends the file path and a note of at most 400 characters. It never sends file contents, diffs, or repository history. relay is a notification service, not a code host.
What exactly is stored?
| Table | Holds | Personal data? |
|---|---|---|
events | relay IDs, kind, note (≤400 chars), task, timestamps, prev_hash, hash | No — IDs only |
handles | relay ID ↔ verified identity, email, display name, per project | Yes — the only place |
identities | provider issuer + subject, email, display name | Yes |
receipts | which relay ID received which event, when | No |
user_tokens | device tokens, issued and revoked times | No |
audit | administrative actions with hashed targets, separate chain | No |
Text fields are stripped of control characters and length-capped on the way in, and HTML-escaped on the way out. They’re treated as statements of fact — never as markup, never as instructions.
How do I delete my data?
Delete your mapping (handles) for a project and relay nulls the email and display name, revokes your live tokens for that project, and — if you’re in no other projects — nulls your identity record too.
The event log is untouched. Your relay ID stays in past events, but nothing links it to a person anymore. The hash chain still verifies. We test this against the stored rows, not just the API response.
How do you catch tampering?
Every event stores hash = sha256(prev_hash | canonical(event)). Change any past event and every hash after it breaks; GET /api/verify points at the first broken link.
Admin actions — invites, revocations, member changes, deletions — go to a separate audit chain with no personal data in it. That chain is not removed when a project is deleted, so the deletion itself leaves a record.
The chain catches modification. It does not catch deletion of the entire log. That’s the audit log’s job, plus operator backups.
How long do you keep data?
We haven’t decided, and we’d rather say so than make something up. Retention is an open item in the specification. Until it’s set, events are retained and mappings are deleted on request. When we set a policy, it goes here with a date.
See also How relay works and Pricing.
Frequently asked questions
- Can other users see my email?
- No. Recipients are addressed by relay ID (mbr_…). Sending to an email address returns HTTP 400. The ID-to-email mapping is visible only inside your own project's allow list.
- Does relay ever see my code?
- No. The hook sends a file path and a note of at most 400 characters. File contents are never transmitted.
- Is my relay ID the same across projects?
- No. relay issues a different ID per project, so activity in one project can't be correlated with another.
- How long do you keep data?
- Not decided yet — it's an open item in the spec. Until then events are retained and the mapping table is deleted on request, any time.
- Do you train on my data?
- No. relay stores file paths and short notes for delivery and audit. Nothing is used for training, and nothing is sold.