Privacy Policy
Last updated 9 November 2026
Relay is a personal task and reference app. This policy explains what data Relay stores, where your data is stored, who else processes your data, and what you can do about it. The policy is written to be specific rather than reassuring: every service named below actually receives data, and none are listed that do not.
Who is responsible
The data controller is Michael Fraser Buffini, Route de Lausanne 20D, 1180 Rolle, Switzerland. You can reach us at support@relaygtd.com.
Relay is offered from Switzerland and is subject to the Swiss Federal Act on Data Protection (FADP). If you are in the EU or UK, the GDPR and UK GDPR also apply to your data, and this policy is written to meet them.
What Relay stores
| Category | What it is | Why |
|---|---|---|
| Account | Your email address, display name and profile photo URL, taken from your Google account or from a photo you upload, plus an internal user id. Sign in with Apple gives us less: if you chose Hide My Email, we receive an Apple private relay address rather than your own email address, and a name only if you choose to share it. Sign in with Microsoft gives us your name, an internal user id calculated from your Microsoft account, and the address you sign in to Microsoft with. That address is kept apart from your account and used only to write to you, never to sign you in. Your content is stored and processed the same way whichever sign-in you use. | To identify your account and sign you in. When you make an account, Michael, who makes Relay, may write to you from ops@relaygtd.com to say hello and offer help. Reply that you would rather not hear from Relay and there will be no more. |
| Your content | Everything you write: tasks, projects, reference items, notes, comments, project outcomes and scratchpads, checklists, dates, horizons, and the workspaces, contexts and contacts you define. Relay stores whatever names you type into your contacts. | Your content is the product. Without your content, Relay has nothing to show you. |
| Shared workspaces | If you create or join a shared workspace: its name, who is in it and who runs it, the items and files shared into it, and the name and profile photo its other members see for you. Your own contexts, dates and other personal details on a shared item stay private to you. A comment on a shared item, with your name and when you wrote it, is seen by everyone in the workspace who can see that item. For an invitation, Relay stores a one-time code and, if the invitation was sent by email, the address it was sent to. | So everyone in the workspace sees the same lists and knows who holds what. |
| Files | Files you upload, drop onto the app, share to it, or send as email attachments. | So attachments and reference material stay with their item. |
| Settings | Your time zone, active hours, reminder times, whether list descriptions are shown, the language you chose in Relay (if you chose one), and the dates you last ran a daily or weekly review. Theme, colour and most list choices stay on the device where you set them. | So the app behaves consistently across your devices. Relay needs your time zone in particular to know what "today" means for you. |
| Notification tokens | A device identifier issued by Firebase Cloud Messaging, registered by the Android, iPhone, iPad and Mac apps. | To refresh your home-screen widgets while Relay is closed, and to tell you when someone in a shared workspace delegates an item to you or invites you. Reminders are scheduled on your device and do not use a notification token. |
| Device restore key (Android) | The public half of a key stored on your Android phone. The private half never leaves the phone. | So Relay can sign you in again when you move to a new Android phone. |
| Widget codes (iPhone, iPad, Mac) | A random code, stored only as a hash, that Relay's widgets use to complete items. | So you can complete an item from a widget without opening the app. |
| Sync records | Which items from a connected service you deleted in Relay. | So Relay does not restore them at the next sync. |
| Subscription status | Your plan, its status and renewal dates. Payment card details are never sent to or stored by Relay. | So Relay knows whether your subscription is active. |
| Connection tokens | The long-term tokens for services you choose to connect. Relay stores them on the server only, and the app cannot read them. For Google and Microsoft, the server also sends the app a short-lived access token, so the app can reach your calendar directly from your device. | To sync with a service after you have connected it. |
| Your capture address |
A private, randomly generated @in.relaygtd.com address,
and a count of how many messages it has accepted recently.
|
So forwarded email reaches your Inbox, and so the address cannot be flooded. |
Relay has no analytics tools and no advertising. There is no tracking of how you use the app, no third-party analytics SDK, no advertising identifier, and no profiling. Relay's server keeps daily totals of how many items are captured and completed and how many Weekly Reviews are finished, with no account, name or device attached. Nothing about you is sold or shared for marketing, by us or by anyone else. In the web app, Google reCAPTCHA checks that requests come from the real Relay site. Google receives what reCAPTCHA collects, such as your IP address and browser details, under Google's own privacy policy.
The website keeps a request log. When you open a page on relaygtd.com, Firebase Hosting records the request: the page, the site that linked to it, your browser and its language, your IP address, and the country and city Google works out from that address. Relay uses the log to count visits and the sites they come from, and to find broken pages. Relay does not use the country or the city. The log is kept in Zurich for 30 days, then deleted, and is never linked to a Relay account. Only the website relaygtd.com is logged this way, not the web app at app.relaygtd.com.
Where your data is stored
Relay runs on Google Cloud and Firebase. Your database records and your
uploaded files are stored in Zurich, Switzerland
(Google's europe-west6 region).
Relay's server-side code runs in Zurich too, in the same
europe-west6 region, so your data is not routed through the
United States in normal use.
A few services are exceptions, and we would rather name them than omit them. The following are global and may process a request outside Europe: Google's Gemini API, used for the optional AI prompts; Google's own authentication service; the messaging service that refreshes Android widgets; and the checks that requests come from a genuine Relay app (Apple DeviceCheck, Google Play Integrity and, in the web app, Google reCAPTCHA). RevenueCat, which manages subscriptions, is based in the United States and processes your internal user id and subscription state there. Google Cloud is certified under the EU-US and Swiss-US Data Privacy Frameworks, and Google's standard contractual clauses apply.
Who else processes your data
Most of the services below are our processors, acting on our instructions and only to provide part of Relay. When Stripe, Apple or Google sell you a subscription, they are the seller and process your payment under their own terms.
| Processor | What it receives | When |
|---|---|---|
| Google Cloud / Firebase | Everything listed above. Authentication, database, file storage, server-side processing, Android widget refresh messages and crash reports. The Android, iPhone, iPad and Mac apps send crash reports unless you disable Crash reports in Settings. The switch is per device, so disable Crash reports on each device you use. On Android, Google Play Integrity checks that the app is genuine. In the web app, Google reCAPTCHA checks that requests come from the real Relay site. | Always. Relay cannot run without it. |
| Google Gemini | The text of the one item you are asking about: usually a title or an outcome, with its latest comments. For a project audit, the project's title, outcome, notes, scratchpad, open checklist items and latest comments, plus the titles, states and scheduled dates of the items inside it. When you ask for a trigger list draft, the description you type. | Only when you press the prompt button. Relay never sends your text to the AI on its own. There is no background analysis, no timer and no send-on-save. You can disable the feature in Settings. The switch is per device, so disable the feature on each device you use. A device with the feature disabled sends nothing at all. |
| Mailgun (EU region) | Any email you forward to your capture address, including its attachments, and any invitation to a shared workspace you send by email: the address, your name, the workspace's name and the link. | Only for messages you send to your capture address and invitations you send. Mailgun processes no other data. |
| Google Calendar, Google Tasks | Read access to your calendar, plus the events you ask Relay to add to it, such as your Weekly Review block. Read/write access to your tasks. | Only if you connect them, and each is connected separately: granting one does not grant the other. |
| Microsoft (Outlook Calendar, Microsoft To Do, Sign in with Microsoft) | Read access to your Outlook calendar, plus the events you ask Relay to add to it. Read/write access to your To Do lists. For Sign in with Microsoft, only the sign-in itself: no Relay content is sent to Microsoft. | Outlook Calendar and To Do only if you connect them, each with its own consent. Sign in with Microsoft only if you sign in that way. |
| Todoist, Notion, Linear | The items Relay syncs with that service, in whichever direction that integration works. | Only if you connect them. |
| Apple | Your Apple account identifier, when you use Sign in with Apple. In the iPhone, iPad and Mac apps, a check that the app is genuine (Apple DeviceCheck). No Relay content is sent to Apple. | Sign in with Apple only if you sign in that way. The device check whenever the iPhone, iPad or Mac app runs. |
| RevenueCat | Your internal user id and the state of your subscription. No payment card details, which Relay never receives. | In the Android, iPhone, iPad and Mac apps, your user id when you sign in. On the web and in the Windows app, within an hour of your account being created, so access can be added to the account. Then whenever a subscription is bought, renewed, cancelled or refunded, on any platform. |
| Stripe on the web and in the Windows app, and the App Store or Google Play in the iPhone, iPad, Mac and Android apps | Your payment details, taken by them and never by us, plus what you bought. Which one applies depends on where you subscribed. | Only if you subscribe. |
Apple Calendar and Apple Reminders are different
On an iPhone, iPad or Mac, Relay can read and update your Apple Calendar and Apple Reminders directly on the device, through Apple's EventKit. The reading and updating happen on your device, and Relay sends nothing to Apple to make them work. Reminders you sync become ordinary Relay tasks and are then stored like the rest of your content, in Zurich. Apple Calendar and Apple Reminders are both off until you grant access in the system permission prompt. macOS and iOS control the permission, not Relay.
About the AI feature specifically
Relay's AI prompts are deliberately narrow. The prompts ask you questions about what you have written, or draft a trigger list you asked for. The prompts never rewrite your words, and they never create or complete tasks for you.
Relay sends your text to Google's Gemini API, on a paid plan. The paid plan matters, which is why we mention it: under Google's terms for paid use, your prompts and the responses are not used to train or improve Google's models, and they are not read by human reviewers for that purpose. Google may retain prompts and responses briefly to detect abuse, as its terms describe. On the free tier of the same API, none of that would be true, which is why Relay does not use the free tier.
Nothing is sent unless you press the button. Disabling the feature in Settings stops it on the device you are using, so disable the feature on each device you use.
Relay uses no other AI provider, no model aggregator or gateway, and no self-hosted model. Google's Gemini API is the only model service Relay connects to.
Limited Use
Relay's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Raw or derived user data received from Google Workspace APIs is used only to provide the features you can see in the app. It is never used, transferred, or sold to create, train, or improve any foundational or generalized artificial intelligence or machine learning model.
Why we are allowed to hold your data
- To perform our contract with you (GDPR Art. 6(1)(b)): storing your content, running your account, taking payment.
- Your consent (Art. 6(1)(a)): connecting a third-party service, and using the AI prompts. You can withdraw either consent at any time, without losing anything else, by disconnecting the service or by disabling AI prompts on each device you use.
- Our legitimate interests (Art. 6(1)(f)): keeping the service secure and working, including crash reports and abuse limits, keeping the daily totals described above, and one note from Michael after you make an account, which you can stop with a reply. You can object to crash reports by disabling Crash reports in Settings on each device you use.
How long your data is kept
Until you delete it. Your data stays for as long as your account exists, including after a subscription lapses, so that all of your data is still in your account if you return.
When you delete your account, Relay deletes everything: your content, your files, your settings, your capture address, and the tokens for any connected service, along with your customer record at RevenueCat. Google's access is also revoked at Google's end. The stores and Stripe keep their own records of any payment, under their own terms. Deletion is immediate and cannot be undone. There is no trash to recover from.
A shared workspace is shared. Items you put into a shared workspace belong to the workspace. When you leave the workspace or delete your account, the items you put into it stay in the workspace for its other members. Your name and photo are removed from the workspace's member list, and your private details on its items are deleted. When you leave, the comments you wrote stay in the workspace under your name. When you delete your account, the comments you wrote are deleted. When the last member leaves, the workspace closes. When the last member deletes their account, the workspace's items and files are deleted with the workspace. The address on an emailed invitation is cleared when the invitation is used, and deleted when the invitation expires, after 7 days.
If you delete your account, links in a previous export stop working. An export lists your files as links, and deleting the account deletes the files those links point at. Download anything you want to keep before you delete your account.
Your rights
You can, at any time:
- Get a copy of your data. Choose Account → Export my data to download a machine-readable JSON file, including links to your uploaded files. The export works whether or not you have an active subscription.
- Correct anything. You can edit your content in the app.
- Delete everything. Choose Account → Delete account, or use the deletion request page.
- Object, restrict, or withdraw consent: disconnect a service, or disable AI prompts or Crash reports on each device you use.
A lapsed subscription never blocks you from accessing, exporting or deleting your own data. Whatever else a paywall blocks, it does not block accessing, exporting or deleting your own data.
If you think we have handled your data badly, please tell us first at support@relaygtd.com. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), or, if you are in the EU or UK, to your national data protection authority.
Security
Data is encrypted in transit and at rest. Access is enforced by server-side rules that limit every record and every file to the account that owns it. One account cannot read another account's data, even if the app requested the data. Sensitive credentials (the long-term tokens for your connected services, and your capture address) are readable only by Relay's server code and are denied to the app entirely. The app only ever holds a short-lived Google or Microsoft access token that expires on its own. One limit worth knowing: anyone who has a file's download link, including a link in an export, can open the file, so share download links with care.
No system is perfect. If we discover a breach affecting your data, we will tell you and the relevant authority as required by law.
Children
Relay is not intended for children under 16, and we do not knowingly collect their data.
Changes
If this policy changes materially, we will tell you in the app or by email before the change takes effect. The date at the top always reflects the current version.