Privacy policy

Who we are

RelayKey is operated by Phil Trinh. Questions about this policy or about your data: [email protected] or trinh.uk/contact.

The short version

Your computers talk directly to each other, end-to-end encrypted. There is no RelayKey server in the middle of your sessions, and we cannot read them.
Your account is a key pair that lives on your devices. We never hold it, and we cannot reset or recover it for you.
Our own servers see two things: the hourly licence check (which plan your account is on) and, if you buy a plan, the payment, handled by Stripe.
The web client reports errors and anonymous usage counts to servers we run. No account or machine identifiers are included.
The Android app is the same client in an app, plus an optional setting that lets your own other devices reach the phone. That setting is off until you turn it on, on the phone itself.

Your account

A RelayKey account is a cryptographic key pair generated on your device. The private half never leaves it unencrypted: it is stored in your browser or app, optionally protected by a passkey or passphrase, and it travels only inside backup files you create yourself. We do not receive it, cannot recover it, and cannot sign in as you. The public half (your account id) is what the licence check and the relays see.

Your sessions

When you open a machine — a terminal, a remote desktop, the built-in browser, a port forward — your client and that machine connect to each other directly over WebRTC. Everything in the session is encrypted between those two ends. Nothing about what you type, see or transfer is sent to us or stored anywhere by us.

When a direct connection is impossible (for example, both sides sit behind strict firewalls), the encrypted traffic is carried by a TURN relay server. By default that is Cloudflare's or Twilio's; you can point RelayKey at your own instead (see Your own relay). A TURN relay carries bytes it cannot decrypt. It can see the two IP addresses it is relaying between and how much data passes.

Relays

To find each other and set up a session, your devices exchange small encrypted messages through public relays — third-party servers not run by RelayKey. A relay can see that a message was posted by a given public account id and how large it is. It cannot read the contents.

If Recover my machine list with my key is on (it is on by default; Settings turns it off), your list of paired machines is also stored on those relays, encrypted so that only your key can read it. A relay can tell that such a list exists and roughly how many machines it names. Turning the setting off publishes an empty list so the previous one stops being retrievable.

What our servers receive

Licence check. About once an hour, and at sign-in, the client sends your public account id to our licence endpoint and receives back how many machines your plan allows. We keep that lookup only as long as needed to answer it.
Payments. If you buy a plan, checkout is handled by Stripe under Stripe's privacy policy. We receive what is needed to activate your plan — the account id you gave at checkout and the plan bought — not your card details.
TURN credentials. When a session needs a TURN relay, the client asks our endpoint for short-lived credentials. That request carries no account information.
Browser engine download. The built-in browser's engine is fetched through a proxy on our domain so it can be cached and verified. That request carries no account information.

Errors and usage

The web client at app.relaykey.net sends two kinds of report to servers we run ourselves, not to a third-party analytics company:

Errors — the error message, a stack trace and the app version, when something in the client breaks.
Usage events — coarse events such as "app started", with the app version and a random per-page-load session id.

Neither includes your account id, your machine ids, the addresses you visit, or anything you type. The session id is generated fresh each time the page loads and is not stored on your device.

Hosting

This site and the web client are served by Cloudflare. Like any host, Cloudflare processes the requests it serves (IP address, requested URL, browser type) and may produce aggregate traffic statistics for us. See Cloudflare's privacy policy. Software downloads and update checks come from GitHub, under GitHub's privacy statement.

What stays on your device

Your key, your list of machines, your settings, the built-in browser's profile (history, cookies, logins), and any SSH keys you add are stored locally — in the browser's storage for the web client, in the app's own storage on macOS, Windows and Android (see the Android app). Clearing that storage removes them; export a backup file first if you want to keep them.

The Android app

The Android app contains the same client described above, so everything on this page about your account, your sessions and the relays applies to it unchanged. The error and usage reports under Errors and usage are the same two reports, sent by the same client code, and carry no more on a phone than they do in a browser tab.

The app adds one thing a browser tab cannot do: it can let your own other devices reach the phone, the way RelayKey already lets you reach a laptop. This is the setting called Share this device.

A fresh install shares nothing. There is no remote way to switch it on: no link, no message, no notification action and nothing another paired device can send will do it. It is turned on by hand, on the phone, in a screen you have to open yourself. If the app cannot read whether it was turned on, it treats the answer as off.

While it is on, the phone holds a second key pair, kept separately from your account key, and publishes its public half to the same third-party relays described under Relays so that a device you have paired can address a message to it. A relay sees that the phone exists and that messages are addressed to it. It cannot read them. Nothing about this reaches a RelayKey server, because a session has no RelayKey server in it.

You decide what a paired device may do, per device, and the phone starts with the cautious answer rather than the convenient one. Running commands and viewing the screen require a privileged setup that an ordinary install does not have, and are refused outright until it does.

While the setting is on, Android shows a notification that cannot be dismissed. That is deliberate and required: a device that can be reached remotely should never be able to look like one that cannot.

What the app asks Android for, and why

Internet. To reach relays and to carry sessions.
Notifications. To show the notification above. Refusing it does not switch the sharing role off, so the app tells you plainly that the role can then be running without a visible sign of it.
Run a foreground service, and keep the device awake. So that a phone you are sharing stays reachable instead of dropping the moment the screen turns off.
Start after the phone reboots. Only to put the sharing role back the way you left it. With the role off, the app does nothing at boot.
Exemption from battery optimisation. Optional, asked for only inside the opt-in screen and only with the reason on the screen. Refusing it is fine; the phone is then reachable less reliably.

The app asks for no location, no contacts, no messages, no photos, no microphone and no access to storage outside its own sandbox. None of those permissions is declared, which is a stronger statement than a promise: an app cannot use what it has not declared, and the declaration list is visible on the app's Play listing.

What the phone keeps, and how to remove it

Your account key, the sharing role's key, the list of devices you have paired and what each may do all stay on the phone. Each key is sealed with a key inside Android's keystore that the app cannot export, and the two roles use different keystore keys, so neither role's data can be opened with the other's. Said honestly: the secret is sealed by the phone's hardware, not held in it.

The app does not back any of this up to the cloud. Android's automatic backup is switched off for it, deliberately: a sealed key restored onto a different phone could not be opened there anyway, and copying it off the device would only widen what leaves it.

To delete it: Forget this device in the sharing screen removes the sharing key, every paired device and every permission immediately. Uninstalling the app removes everything it stored, including your account key. Neither is a request you send to us and wait on, because there is nothing of yours on our servers to delete. Keep a backup file first if you want your machine list again afterwards.

Children

RelayKey is not directed at children under 13 and we do not knowingly collect information from them.

Changes

When this policy changes, the date at the top changes with it. The history is in the public repository.