Privacy policy

Last updated: September 2026

Protecting your data matters to us. This page explains which personal data Relay processes, why, and what rights you have.

1. Controller

Kevin Wippel, Ybbser Straße 8/2/15, 3250 Wieselburg, Austria. Email: [E-Mail-Adresse ergänzen]

2. Data we process

  • Account data: email address, display name and a user ID received from the sign-in provider.
  • Content: your lists, reminders, notes, cover images and settings.
  • Push subscriptions: the technical address of your browser for notifications, if you enable them.
  • Technical data: IP address, time and type of requests in server logs.

3. Purposes and legal bases

We process your data to provide Relay to you (Art. 6(1)(b) GDPR). Server logs, abuse prevention and limits on AI requests are based on our legitimate interest in secure operation (Art. 6(1)(f) GDPR). We only send push notifications with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the settings. If you create a calendar subscription, we publish your open items with a due date at a secret link; anyone who knows the link can read them. You can reset the link at any time in the settings.

4. Recipients and service providers

We use the following service providers, who process data on our behalf or for the respective feature:

  • Supabase Inc. (database, authentication): stores your account and content data in a data center in Ireland (EU).
  • Apple Inc. (sign-in): you are redirected to Apple to sign in. We receive your email address (possibly an anonymous Apple relay address), name and user ID.
  • OpenRouter Inc., USA (AI features): only when you use an AI feature, the relevant text is sent to OpenRouter and the language model selected there.
  • Unsplash Inc., USA (cover images): search terms are sent to Unsplash through our server. When images are displayed, your browser loads them directly from Unsplash, which transmits your IP address.
  • Your browser’s push service (e.g. Google, Apple, Mozilla): notifications are delivered through your browser’s push service and contain the reminder title.
  • Hosting provider of the web app: processing of requests and server logs.

5. Transfers to third countries

Some providers are based in the USA. Transfers are based on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses.

6. Cookies and local storage

Relay only uses technically necessary cookies for sign-in and language selection, and your browser’s local storage for display settings. There is no tracking and no advertising.

7. Retention

We store your content for as long as your account exists. Deleted items stay in the trash until you remove them permanently. Logs of AI requests are deleted after 24 hours; afterwards only anonymous totals per feature and hour remain, with no link to you. When you delete your account in the settings, all associated data is removed.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can export all your data yourself at any time in the settings. Contact the email address above for any request.

You also have the right to lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.