Your requests.
Your device.

1. What stays on your device

Your request drafts, saved requests, environments, credentials, configuration and saved diagnostics are stored locally. Persistent workspace and response files are encrypted. Workspace keys and imported client-identity secrets use the device Keychain. Relay does not upload your workspace to a developer server.

The app does not include analytics SDKs, advertising, tracking or a developer-operated crash-reporting service. Apple may process diagnostics or store information according to your device settings and its own policies.

Files you choose to import are read locally. Importing a cURL command or Postman collection prepares requests for review; Relay does not execute imported scripts or send the imported requests automatically.

2. Network connections you make

When you send a request, connect a WebSocket or run an inspection, Relay contacts the chosen servers, resolvers and any configured proxy. These services can receive your IP address and the information needed for the connection, including hostnames, query values, headers, credentials and request content you include.

DNS lookups go to the selected system or custom resolver. Authoritative lookups also contact discovered name servers. TLS validation can use Apple’s trust services and related network checks. The operators of these services handle received information under their own practices.

Relay does not operate a relay server. It does not provide anonymity, and unencrypted HTTP, WebSocket or DNS traffic is not made private simply by using Relay.

3. Sharing, copying and exports

You choose when to share a report, copy content or export a body. Known credentials and URL query values are removed from shared reports and saved history. Reports omit request and response bodies and assertion values. Redaction cannot identify every sensitive server-defined value: hostnames, paths, custom headers, DNS records and certificate details may remain.

Fresh response headers, copied live values and exported bodies can contain complete sensitive information. Review content before sending it to another person or app. The receiving app or service handles it under its own privacy practices.

Requests shared into Relay are encrypted in a local import inbox and remain there until processed or cleared. Open Relay once to initialize that inbox. They are not sent to the developer.

4. Private sessions

Private sessions keep changes out of your normal saved workspace. Leaving a private session restores the previous workspace. Large private responses can use encrypted temporary files; private mode does not mean that no disk or network activity occurs.

Private sessions do not hide traffic from the destination, resolver or proxy. Content you copy or export is no longer controlled by Relay’s private-session lifecycle.

5. Purchases and subscriptions

Apple handles Relay Pro subscriptions and payment information. Relay uses StoreKit on your device to verify subscription access. It does not receive your payment-card details or send purchase history to a developer server. Apple provides developers with sales, financial and App Store reporting under its own policies.

Read Apple’s App Store privacy information. You can manage or cancel subscriptions through Apple. Removing Relay from your device does not cancel a subscription.

6. Retention, deletion and recovery

Saved requests, environments and profiles remain on the device until you remove them. Relay keeps up to 100 saved diagnostics, removing the oldest when that limit is exceeded. Request history keeps redacted metadata for up to 100 runs and omits bodies by default. If you explicitly keep a response body, it remains associated with that history item until deletion or history trimming. Temporary response files are disposable and can be cleared in Settings.

You can delete saved items in Library, clear history and temporary files in Settings, clear pending shared imports, and remove imported client identities through TLS profile controls. Workspace and response files are excluded from backup; Relay does not offer cloud sync or a workspace-recovery service.

Deleting the app removes its local app data, but iOS can retain Keychain entries. To remove an imported identity explicitly, use Relay’s identity controls before deleting the app. We cannot remotely retrieve, restore or erase your local workspace.

7. Support messages and this website

If you contact Daniel McCorley, your email address, message and anything you attach are forwarded through Cloudflare Email Routing to the developer’s support mailbox. Cloudflare and the mailbox provider process that correspondence to deliver and store it. This information is used to respond, investigate issues and handle follow-up requests. Do not include passwords, tokens, private keys or sensitive customer data.

Support correspondence is kept as needed to handle the issue and necessary follow-up, or to meet applicable legal obligations. You may ask for access, correction or deletion of correspondence by contacting the support address below.

This website is hosted by Cloudflare. The pages contain no analytics scripts, advertising, embedded third-party media, cookies or browser-storage features. Cloudflare may process technical and security information, such as IP addresses, requested pages, timestamps and browser details, to deliver and protect the website. See Cloudflare’s privacy policy. Opening an external link or sending an email is subject to that service’s practices.

8. Questions and policy changes

For questions about this policy or a request relating to support correspondence, contact Daniel McCorley:

This policy may change as Relay changes. The latest version will be published here with an updated date.