Relay — Privacy Policy
Last updated: August 2026
Relay is a two-player word game made by an independent developer, Salah (“we”, “us” — one person, in practice). This policy describes exactly what the app collects, where it goes, and how to make it go away. It is written to be read, not skimmed past.
The short version
- No ads, no trackers, no analytics, no data sold or shared for marketing. Ever.
- Practice games are judged on your device and never leave it.
- Online games store three things on our server: a random anonymous ID, the display name you choose, and the words you play.
- Words played in online games are checked by an AI judging service, server-side.
- Email us and we delete everything.
What we collect
When you first open Relay, the app signs you in automatically and anonymously. No account creation, no email address, no phone number, no password. What exists after that:
- An anonymous user ID. A random identifier (a UUID) created by our authentication service. It is not derived from your device, your name, or anything about you. It exists so your games can find you again.
- A display name. Whatever you choose to be called. It can be your name, or it can be “Lighthouse Enthusiast”. It is shown to your opponents and on sentences you choose to share.
- Gameplay content. For online games only: the words you play, the sentences that result, game outcomes, move timestamps, and your rating. This is the game itself — an async game cannot work without a server remembering whose turn it is.
What we do not collect
No email address (unless you email us). No contacts, no location, no photos, no advertising identifiers, no device fingerprinting, no push notification tokens (this version of Relay sends no notifications), no analytics events, no crash-reporting SDKs from third parties. If it is not in the list above, we do not have it.
Practice games stay on your phone
Games against the Keeper (the tutorial) and the House (the practice opponent) are judged entirely on your device. The words you play in practice are never transmitted anywhere, are not stored by us, and are not seen by any AI service. You can play these modes in airplane mode.
Online games and where the data lives
Online games are stored in our backend, which runs on Supabase with data
hosted in Amazon Web Services’ Asia Pacific (Mumbai) region
(ap-south-1). Access controls are enforced at the database
level: your opponent can see your display name and the words you have played
into your shared sentence, and nothing else — your secret target word
is unreadable to them by construction until the game reveals it.
Sentences appear on a public web page only if a player chooses to share that game; sharing is always a deliberate action, never a default.
The Judge (AI processing)
Every word played in an online game is evaluated for coherence by a large language model — the game’s “Judge”. This happens server-side: our backend sends the sentence in progress and the words being judged to an AI provider (Anthropic, or a provider reached via OpenRouter), which returns a ruling.
These providers act as our data processors. They receive game text only — never your user ID, your display name, or anything that identifies you. We use them solely to produce rulings, and we configure and choose these services so that game text is not used to train their models and is not retained beyond what processing requires.
What we never do
We do not sell your data. We do not share it with anyone for advertising or marketing. We do not profile you, track you across other apps or websites, or let anyone else do so through Relay. There is nothing in the app that phones home about your behaviour — the only network traffic is the game itself.
How long we keep things
Game data is kept so that finished sentences remain in your Museum and your opponents’ archives. If you delete your account (in Settings, or by email — see below), we delete your account record, your display name, and your assignment to your games. Finished sentences are co-authored — your opponent keeps their copy of any finished game, with your words attributed to an anonymous former player rather than to you.
Deleting your data
Two ways, both free:
- In the app: Settings → Account → Delete account.
- By email: write to nh.salah@gmail.com from any address and tell us your display name or the code of a game you played. We will delete your data and confirm within 30 days, usually much sooner.
Children
Relay is not directed at children under 13, and we do not knowingly collect personal information from them. The app collects no age data, no real names, and no contact details from anyone, which keeps the stakes low by design — but if you believe a child has used Relay and want their data removed, email nh.salah@gmail.com and we will delete it.
Pointing the app at a different server
Relay’s settings include an advanced option to connect the app to a different, self-hosted backend instead of ours. If you use it, your online game data goes to that server and its operator, not to us, and this policy no longer describes where that data lives. The option is blank by default; if you never touch it, everything above applies as written.
Security
Data travels over TLS. Secrets and API keys live on the server, never in the app. Database rules — not application goodwill — prevent players from reading each other’s hidden words. No system is perfect, but the best protection here is structural: we hold almost nothing about you, so there is almost nothing to lose.
Changes to this policy
If the policy changes in any meaningful way — new data collected, a new processor, a new purpose — we will update this page, change the date at the top, and note the change in the app’s release notes before it takes effect. We will not quietly widen what we collect.
Contact
Questions, deletion requests, complaints, compliments about sentences: nh.salah@gmail.com
You always have the right to ask what we hold about you, to have it corrected, or to have it deleted. Given what you have just read, the answer to the first question will be short.