Privacy policy
Version of 23 October 2026. If this translation and the French version differ, the French version prevails.
Your health data is encrypted on your iPhone with a key that never leaves it. The relay stores it without being able to read it, and so does the developer.
There is no named account, no email, no advertising, no analytics and no cookies.
You delete everything the relay keeps from the app: Settings, "Delete my account".
1. Who is responsible
The data controller is Julien Renaud, independent developer and publisher of Relay.
- Address: [À COMPLÉTER : adresse postale]
- SIRET: [À COMPLÉTER : SIRET, s'il existe]
- Contact: support@relay-agent.app
2. What this policy covers
It covers the Relay iPhone app, the relay hosted by the developer at relay.relay-agent.app, and this website. It does not cover your AI agent or the machine running relay-agent: you run those yourself (see section 9).
If you use a relay you host yourself, the developer receives none of your data. Only a possible in-app purchase and this policy for the app still apply.
3. Your health data
With the permission you grant in iOS, the app reads from Apple Health:
- steps, active and resting energy, exercise minutes;
- dietary energy, protein, carbohydrates, fat and water;
- weight and height;
- sleep stages, resting heart rate, heart rate variability;
- workouts, with heart rate during the workout and, for runs, walks, hikes and rides, the GPS route.
This is data concerning health, a special category under Article 9 of the GDPR. GPS routes also reveal places.
The app encrypts it on your iPhone with AES-256-GCM before sending anything. The 256-bit key is generated on the iPhone, kept in its keychain, never synced to iCloud and never sent to the relay. Only the app and the agents you have linked know it.
4. Exactly what the relay stores
| Data | Readable by the developer? |
|---|---|
| Account ID: 26 characters picked at random by the app | Yes |
| SHA-256 hash of the access token (the token itself is not kept) | Yes, the hash only |
| Account creation date and date of the last request | Yes |
| Content of the data batches (health, workouts, sync status, workouts planned by your agent) | No, end-to-end encrypted |
Name of each batch (data type and month, for example metriques/step_count/2026-10.json; for a workout, its date and ID), size and upload time | Yes |
| The iPhone's Apple notification token (APNs) and its environment | Yes |
| Subscription: end date and original App Store transaction ID | Yes |
| Times of the iPhone wake-ups requested by your agent | Yes |
| Pairing sessions: ephemeral public keys of the agent and the app, encrypted pairing phrase | Public keys yes, the phrase no |
The encrypted "sync status" batch holds the sync time, the latest sample time per type, the iPhone's name and the last lines of the app's log. Only your agent can read it.
The server also processes:
- a technical log: for each request, the method, the path (which contains the batch name), the response code, the account ID and the duration. It holds no request body, no IP address and no health data;
- your IP address, in memory only, to cap account creations and pairing sessions at ten per hour from one address. It is never written to disk;
- daily counters: number of active accounts and syncs, with no identifier.
5. What the developer cannot read
The content of the batches, the key and the pairing phrase. Each batch is also bound to its name and to your account: moved or renamed, it no longer decrypts. If an authority demanded your data, the developer could only hand over what is marked "Yes" in the table above.
6. Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Pass your encrypted data to your agent, and its workouts to your Watch | Performance of the service you request (Art. 6(1)(b) GDPR); for health data, your explicit consent (Art. 9(2)(a)), given by allowing Health access in iOS and linking an agent |
| Wake your iPhone when your agent asks for fresh data | Performance of the service (Art. 6(1)(b)) |
| Check your subscription | Performance of the subscription contract (Art. 6(1)(b)) |
| Protect the service: rate limits, quotas, technical log | The developer's legitimate interest in a safe and available service (Art. 6(1)(f)) |
| Back up the database to restore it after an incident | Legitimate interest (Art. 6(1)(f)) |
You can withdraw consent at any time: delete your account from the app, or remove Relay's access in iOS Settings, Health.
No data is used for advertising, profiling or training an AI model. Nothing is sold.
7. How long
| Data | Retention |
|---|---|
| Health and workout batches | 13 rolling months: at each sync, the app removes from the relay the batches older than the current month minus twelve months |
| Sync status and planned workouts | Replaced at each upload |
| The account and everything attached to it | Until you delete it, or erased automatically after 365 days without any request from the app or your agent |
| Pairing sessions | Unusable after 10 minutes, erased when pairing ends or within the hour after expiry |
| Wake-up times | A rolling hour; older ones are erased at the next wake-up, and all of them with the account |
| IP address | One hour at most, in memory |
| Technical log | 30 days |
| Database backups | One per night, encrypted; the last 7 daily and 4 weekly backups are kept. Erased data leaves the backups within about five weeks |
| OVHcloud's automatic server backup | 7 days (the last seven daily backups) |
If the app stops syncing but your agent keeps querying the relay, the account stays active and its batches stay in place, still encrypted. Delete the account from the app to erase everything.
8. Who receives data
- OVHcloud (OVH SAS, Roubaix, France) hosts the relay on a server in France and its backups in object storage in Paris. It is a processor under Article 28 of the GDPR. It only receives what the relay stores: health batches stay encrypted.
- Apple delivers the silent notifications: the relay sends it your iPhone's token and an empty notification, with no data. Apple also handles the subscription purchase and payment, as controller of its own processing, under its own privacy policy. The relay only receives the transaction signed by Apple, which it verifies locally.
The relay transfers no data outside the European Union. Apple may process the data it handles itself outside the Union, under its own commitments.
9. On your agent's side
The relay-agent client decrypts your data on the machine you choose, with the pairing phrase. From then on, the data is your responsibility: the developer has no access to it. If your agent sends it to its model provider (OpenAI, Anthropic, Google or another), that provider processes it under its own terms.
The pairing phrase gives access to all your data. Keep it in a file only you can read: relay-agent refuses to start if other users on the machine can read it. Never give it to support.
10. Security
- AES-256-GCM end-to-end encryption; transport also goes over HTTPS.
- Access token kept as a SHA-256 hash; quotas and rate limits per account.
- Server reachable over SSH by key only, automatic security updates, service isolated from the rest of the system.
- Public relay code, so anyone can check the above.
11. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and you can set instructions for what happens to your data after your death.
- Erasure: in the app, Settings, "Delete my account". The relay immediately erases the account, all its batches, wake-up times, notification token and subscription status. Backups follow within the periods in section 7. Your data stays in Health, on your iPhone.
- Regenerating the phrase erases the old account from the relay and creates a new one, with a new key.
- Access and portability: your health data is in Health on your iPhone, and
relay-agent syncwrites it in clear on your machine. For the technical data in section 4, email support. We will ask you to prove the account is yours, never for your phrase. - Subscription: you manage and cancel it in your Apple account settings. Deleting your Relay account does not cancel it.
Email support@relay-agent.app. Reply within one month at most. If you think your rights are not respected, you can complain to the CNIL, the French data protection authority: www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or to the authority of your country.
12. Cookies and trackers
Neither this site nor the app uses cookies, trackers, pixels or analytics. This site loads no external resources.
13. Age
Relay is not intended for people under 15.
14. Changes
If this policy changes, the new version is published here with its date.