Privacy Policy

1. Scope and contact

Relay2 Technologies, Inc. provides Relay2. This Privacy Policy explains how Relay2 Technologies, Inc. ("Relay2") collects, uses, shares, and keeps personal information about account holders, visitors to relay2.app, and people who open short links on the rly2.link domain (together, the "Service"). Contact support@relay2.app for privacy questions, access, correction, export, deletion, or complaints. You may also write to Relay2 Technologies, Inc., 600 1st Ave #3026, Seattle, WA 98104. Relay2's chief executive officer is responsible for this policy and for privacy requests unless Relay2 names a different person here. Reading this policy does not mean you consent to optional tracking. Relay2 asks for consent separately where the law requires it.

2. Account and eligibility information

When you create an account, Relay2 collects your display name, email address or sign-in provider identity, date of birth, country, and state, province, or territory. Relay2 uses your date of birth and residence only to check that you meet the age requirement for your location and to keep a record of that check. Relay2 does not show your date of birth on your profile or use it for marketing, advertising, or sign-in. Relay2 stores your date of birth separately from your profile and limits staff access to it. If you do not meet the age requirement, Relay2 does not activate an account and keeps only the minimum record needed to prevent repeat attempts.

3. Sign-in providers

Google or Apple may supply an account identifier, name, email, or permitted profile fields. A provider may supply a private relay email address. If a provider does not supply your name, Relay2 asks you to enter it. If you edit your display name, Relay2 keeps your edited name and does not replace it with provider data. Relay2 does not receive your Google or Apple password.

4. Social profiles

Adding a handle is distinct from authorizing a social connection. Profiles are private by default. Brands can see your profile only if you turn on brand discovery, and you can turn it off at any time. Supported connections may import approved profile fields and aggregate follower statistics, not unrestricted account information or follower contact lists. Relay2 shows the source and last sync time of imported data. When you disconnect an account, Relay2 stops syncing and revokes and deletes its access token.

5. Links and visitor information

When you create a link, Relay2 collects the destination URL, labels, campaign parameters, and referral terms you enter, and uses them to create the link, route visitors, show reports, and screen for abuse. When someone opens a short link, the browser sends Relay2 a request that includes the IP address, the short link requested, the time, the referring page if the browser sends one, and browser and device information. Relay2 uses this information to deliver the redirect, protect the Service against abuse and bots, and count clicks. Relay2 treats this information as personal information even when no cookie is used. For click reports, Relay2 records the link, the time, and the approximate region, device type, and traffic source derived from the request. Relay2 derives approximate region from the IP address and does not record precise location. Click records do not include full referring URLs or query strings. Relay2's hosting and network providers keep request logs, including IP addresses, for security and operations for the periods described under Retention and deletion. Relay2 does not set a cookie or other identifier on a visitor's device during a basic redirect, does not use a destination to infer health or other sensitive information about a visitor, and does not identify individual visitors in reports.

Payments. Stripe processes payments for paid plans. Relay2 receives and keeps Stripe customer, subscription, and invoice references, your plan and billing status, and payment results. Relay2 does not receive or store full card numbers.

Support and messages. When you contact support, Relay2 keeps your messages and contact details. Relay2 sends account, security, and billing emails as part of the Service. Relay2 sends marketing emails only if you agree, and you can unsubscribe through the link in each message.

Marketing website. When you visit relay2.app, Relay2 collects information about how you use the website, such as pages viewed, browser and device type, and referring site. Relay2 does not place advertising tools on short-link redirects. Before Relay2 adds advertising or additional analytics tools to its website, it will list them in the Cookies and Link Tracking Notice and ask for consent or offer an opt-out where the law requires.

Service providers. Relay2 uses service providers for hosting, network delivery, and email delivery (Amazon Web Services), payments (Stripe), sign-in (Google and Apple, when you choose them), customer communications (HubSpot); PostHog website analytics is disabled in this build.

6. Purposes and disclosure

Relay2 uses information to provide requested services, operate and protect links, administer accounts and subscriptions, send account and billing messages, send marketing messages if you agree, respond to support, improve the Service using aggregated information, and meet legal obligations. Relay2's service providers process information on Relay2's behalf under contracts that limit their use of it to providing services to Relay2. Relay2 also discloses information when you direct it to, to comply with law or valid legal process, to protect the Service, users, or visitors from fraud or harm, and to a buyer or successor in a merger, acquisition, or sale of assets, subject to this policy. Relay2 does not sell personal information for money and does not share link-visitor information with advertising networks. If Relay2 uses advertising tools on its website, some U.S. state laws may treat that use as a sale or sharing of personal information, and Relay2 will honor opt-out requests and Global Privacy Control signals for those tools. Relay2 operates from the United States, and its providers may process information in the United States and other countries.

7. Creators, brands, and visitors

A creator cannot consent to visitor tracking on a visitor's behalf. Opening a link is not acceptance of account Terms or optional tracking. Private profiles do not make public short links private. Brand discovery is off unless you turn it on. Creator and brand reports show aggregated click counts and do not identify individual visitors. Relay2 decides how it processes account and redirect information and is responsible for that processing.

8. Retention and deletion

Relay2 keeps personal information only as long as needed for the purposes in this policy, using these periods. Account data and date of birth: deleted from active systems within 30 days after Relay2 verifies a deletion request. Raw redirect logs: 30 days. Event-level click records: 30 days. Security logs: 90 days. Social follower snapshots: 12 months. Support records: 24 months. Backups: overwritten within 90 days. Relay2 keeps billing records as long as tax and accounting law requires. Relay2 keeps records of your acceptance of the Terms and of subscription consent for at least three years or one year after your account ends, whichever is longer. Aggregated click counts stay with a link while the link exists and are then deleted or deidentified so they no longer relate to any person. The reporting window for your plan controls which reports you can view. Storage periods follow this section.

9. Your choices and rights

Contact support@relay2.app to request access, correction, deletion, or a copy of personal information, or to raise a privacy concern. You may also withdraw a consent you gave, opt out of marketing, or opt out of advertising tools on Relay2's website. Browsers send Do Not Track signals in different ways and no common standard exists, so Relay2 does not respond to them. Relay2 honors Global Privacy Control signals as described in this policy. Rights and exceptions vary by location. Relay2 may ask for information needed to verify your identity, in proportion to the request. An authorized agent may submit a request for you where the law allows. People who opened a short link but have no account may also make requests. Because Relay2 does not link clicks to names, Relay2 may ask for details such as the approximate time and the link you opened to locate records. Relay2 responds within the time the law where you live requires. If Relay2 denies your request, you may appeal by replying to the decision, and Relay2 will tell you the outcome and how to contact the privacy regulator where you live if you disagree. Relay2 will not discriminate against you for using these rights. You may also complain to a privacy regulator, such as the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.

10. Children and geography

Accounts are available only to adults in the United States and Canada who meet the eligibility rule in the Terms of Service. Children may open public links. Relay2 does not knowingly collect personal information from children under 13 beyond the request information any browser sends when following a link, and Relay2 does not use that information to identify, profile, or advertise to anyone. If Relay2 learns that it collected a child's personal information in another way, it will delete it. People in Canada, the European Union, the United Kingdom, and some U.S. states have additional rights under local law, including rights to access, correct, delete, and receive a copy of information and to withdraw consent. Relay2 honors these rights as the applicable law requires.

Legal bases in the EU and UK. Where EU or UK data protection law applies, Relay2 relies on performance of a contract for account and subscription processing, on legitimate interests for delivering redirects, security, fraud prevention, and aggregated click counts, on legal obligation for tax and legal records, and on consent for optional cookies, advertising tools, and marketing where the law requires it.

11. Security and updates

Relay2 restricts access to dates of birth and sign-in credentials, encrypts information in transit, and protects stored information with access controls and encryption. No system is completely secure. If a security incident affects your personal information, Relay2 will notify you and regulators as the law requires. When Relay2 transfers personal information from the European Union, the United Kingdom, or Quebec, it uses the transfer safeguards the law requires. Relay2 will post any change to this policy with a new effective date and will notify account holders by email or in the Service before a material change takes effect.