RELAY
Privacy
RELAY minimizes data: anonymous device id, optional first name, approximate city only with opt-in, push token if you allow notifications, and the content you choose to share.
Use
Receiving, revealing, passing and watching a spark. No data resale, no ad tracking. Sponsored sparks are adults-only and always labelled; advertisers only receive aggregated numbers.
Location
Approximate city, opt-in only. Never precise GPS, never background tracking.
Traces
Your photos and notes stay on your phone by default. When you explicitly share one, it is stored on our servers; a shared note is visible to the person who passed you the spark and to whoever comes next, and you can erase it anytime. Reported content is kept for moderation.
Browser notifications
If you live a spark in the browser, without the app, RELAY may offer, after your gesture (a spark passed on or an echo left), to tell you when someone leaves you an echo. « Later » hides it for 14 days, and a refusal is never asked again. If you accept, your browser creates a notification address: we keep that address and its keys encrypted, the page language and dates, tied to this browser's anonymous id. Never a first name, an IP address or a browser name. They are used only to tell you about an echo: never a reminder, an ad or any other message, and the notification carries neither the echo's reaction nor its sentence; it may show the first name of the person who left the echo, if they gave one. The message goes through your browser's push service (Google, Apple, Mozilla or Microsoft), which receives encrypted content it cannot read. Stop anytime with « Stop notifying me » on your page, or in the browser settings. The subscription is deleted then, when the push service tells us it no longer exists, when you move to the app, with your account, or after 180 days without use.
Security and maps
Your IP address is used as a rate-limit key and is deleted by the daily clean-up, in general within 48 hours. The journey map loads its tiles from OpenFreeMap, which receives your IP address like any website. The daily reminder, if enabled, is scheduled locally on your phone.
Origin codes and journey links
A short code in some public links (for example ?src=a01) tells us which object brought you here: a poster, a shared line, a kit. It is kept neither in your browser nor in a cookie, and counts visits in aggregate. If you start a spark or the Wave from such a link, the code is recorded with that event, under your device's anonymous id, and kept at most 13 months, like other measures. If you share your spark's journey, the link opens a page and a preview image. They appear in two ways, depending on the state of RELAY. With the animated display, once it is switched on, they show only shapes and bands: dots per generation (1, 2 or “3 or more”, never an exact size), a band of people (“3 to 5”, “6 to 10” or “more than 10”) and, only if at least three cities were each carried by at least three people, the names of those cities. Never a first name, a note, a day, an exact number or a precise place, and no figure below three people who did the gesture (the preview image then carries no number either). As long as the animated display is not switched on, and for links made before it was switched on until they expire after 30 days, it is the older card: exact numbers of people, cities and days, whatever the number of people; once the animated display is on, such a link keeps the older page from three people (a page without figures below that) and its preview image carries no number. For this the server keeps with the link: the anonymous id of the author's device (for removal and account deletion), the language, numbers computed when it is created (people who did the gesture, cities, days; the animated page does not show them), the city names the rule above allows, and a snapshot of the journey's shape: at most eight numbers worth 1, 2 or 3, one per generation, without a day. Creating the link is counted with the anonymous id of the author's device; page views are counted in aggregate, with no token, IP address or browser; these measures are kept at most 13 months, like the others. The link is not indexed, expires after 30 days, and you can remove it at any time from the app or from the web page where you shared it: it is then deleted with its snapshot. The preview image can stay cached for up to 10 minutes after a removal, and longer in the app that already displayed it. The link is also deleted with your account, at the end of the 30-day reflection period, and an expired link is deleted in the daily clean-up.
Group links (La Bande)
One of the two passes of a spark can be a group link, for adults only (18 or older, declared age): up to 8 people can join it and it closes 24 hours after it is dropped. Each person who joins creates, as with a personal invitation, their own gesture attached to the person who dropped the link; their first name, if they give one, follows the same rules as in the lineage. For each place RELAY keeps the group link, that gesture, the order of arrival and the date of arrival. If you delete your account, what is written above applies: during the 30 days, if you dropped the link, you no longer count in its recap (and you are back if you cancel); at their end, the group events tied to your device, your gestures or your invitations (link dropped, arrival, group full, gesture done, gesture passed) are deleted, your place stays as an anonymous marker so that the link never admits more people than planned (that row holds no name or first name and is deleted 13 months later, once the link is closed), and your gesture stays in the lineage, without a city, under a random device id whose profile is emptied. Other members' events stay at most 13 months in the measures. The recap shown to the group is two numbers (“2 of 5 lived it”) and an open or closed state, which depend on no block: never who did it or not, no time and no order. The feature adds no member list and no messaging.
Processors and third-party services
RELAY runs on Cloudflare (website and API hosting, database, private storage of shared photos, automatic AI moderation of notes and photos), Expo (sending notifications, then delivered to your phone by Apple or Google), your browser's push service if you turn on browser notifications (Google, Apple, Mozilla or Microsoft, which only receive encrypted content) and OpenFreeMap (journey map tiles; it receives your IP address). None of them receives your data for advertising, and advertisers never have access to it.
Your rights
Export and deletion in Settings. Deletion: 30-day grace, then purge; downstream lineage is anonymized. Aggregated events kept 13 months. The daily clean-up runs at the first app launch of each (UTC) day; with no launch that day, it is postponed. The detail is below.
Deleting your account
When you ask for deletion, your account is marked and you have 30 days to cancel. During those 30 days nothing is erased, but you already disappear for others: your echoes, thanks, shared notes and the gestures you passed no longer appear in their activity, their circle or their received echoes; nobody can send you an echo or a thank-you; saving a profile change is refused; and if you dropped a group link, you no longer count in its recap. The lineage itself is not changed before the end. If you cancel, everything comes back. At the end of the 30 days the deletion becomes final (it runs at the next deletion request or in the daily clean-up). Then deleted: the measurement events tied to your device, your gestures or your invitations (group included), your notes, echoes and thanks sent or received, your shared photos, your notification subscriptions and tokens, your preferences and feedback, your blocks, your journey links, your request receipts and your rate limits; your first name, avatar, city, country, platform, last activity and declared age bracket are erased, the device is revoked, and the reports you made no longer carry your identity. What stays, without a name or city, under your random device id: your gestures in the lineage (so its counters stay right), your anonymous place in a group link (deleted 13 months later, once the link is closed) and a few structural rows (transmission locks, day, moment and starting roots, the count of gestures done for campaigns, sponsored-spark views and dismissals, counted in aggregate for advertisers).