Privacy policy

What ORelay Studios LLC collects when you use ORelay or visit our websites, and why.

What we collect

• Your account: username, email address and settings, your password (stored only as a secure hash), and the IP address and browser or app you sign in from. If you add a passkey, we keep its public key; the private key never leaves your device. If you add Google, Apple, Microsoft or GitHub sign-in, we keep only that provider’s number for you, and for a Microsoft work account, which directory it belongs to. We ask those providers for nothing else, such as your name or address. If you link Google Drive or OneDrive for the cloud vault, we keep that Google or Microsoft account’s address, to show you which one is linked, and its access token, encrypted. In Google Drive it reaches only the files ORelay makes there (Google’s drive.file permission); in OneDrive, only ORelay’s own folder, Apps/ORelay (Microsoft’s Files.ReadWrite.AppFolder permission, asked of each person when they connect, never granted for a whole company).
• Machines you connect (reported by the ORelay agent): name, operating system, signed-in users, network addresses, performance figures and installed software.
• What you do through ORelay: commands, file transfers, power actions and the start and end of remote sessions are logged. We store transferred files and the output of scheduled tasks and quick actions. Screen and terminal sessions pass through our servers live and are not recorded.
• Paid plans: which plan your organization is on, and the customer and subscription numbers Stripe gives it. Card and bank details go straight to Stripe and never reach our servers.
• Apps: a push-notification token from your phone, and crash reports from the apps and web viewer with personal details removed.
• Server logs: for each request, the IP address, the address asked for and the request’s headers, such as which browser or app sent it, but never passwords, tokens or cookies. We look up the approximate location and network of each IP address.

How we use it

We use it to run ORelay, keep it secure and fix problems. We don't use it for advertising, we never sell it, and we don't track you across other apps.

Who we share it with

We share data with the providers that make ORelay work: Vultr (the servers we rent), Google (Sign in with Google, optional encrypted Drive backup, push notifications, and the reCAPTCHA and Play Integrity checks below), Apple (Sign in with Apple, push notifications, and the App Attest check below), Microsoft (signing in with it, if you add it, and optional encrypted OneDrive backup), GitHub (signing in with it, if you add it), Sentry (crash reports), Grafana Labs (server logs and monitoring), CrowdSec (the IP address of a connection our server detects attacking it, such as by scanning for weaknesses or by failing to sign in again and again, with what it tried and when), Cloudflare (our backups, encrypted so that it cannot read them), Stripe (payments for paid plans: the name, email and billing address given at checkout, with the payment details) and Proton Mail (email). Each must protect it at least as well as this policy does. If your organization sends alerts to ntfy or a webhook, those receive the alert details. Your organization's admins can see its members and activity log.

Checks that keep out automated sign-ups

Where our server asks for them, these checks make sure a person, or the real ORelay app, is on the other end:

• Google reCAPTCHA is the “I’m not a robot” box in the web viewer when you sign up, ask for a link to reset or add a password, or ask for your confirmation link again. While it is on the page, Google collects information about your device and browser and how you use the page, and may use its own cookies. To check your answer, our server sends Google the answer and your IP address.
• Google Play Integrity is used when you sign up in the Android app. Google Play on your phone sends Google information about the phone and the app, and gets back a token that says whether the app is the one Google Play distributes and whether the phone passes Google’s integrity checks. Our server sends that token to Google, and Google tells us what it says.
• Apple App Attest is used when you sign up in the iPhone app. Your iPhone makes a key for that one sign-up and asks Apple to confirm that it belongs to the real ORelay app on a genuine iPhone. Our server checks Apple’s answer itself and sends Apple nothing.

We keep whether a check passed. When one fails, our server logs record why, which can include part of Google’s answer. For reCAPTCHA they also record your IP address. We never keep the reCAPTCHA answer, the Play Integrity token or the App Attest attestation. What reCAPTCHA collects in your browser, and what Google Play and Apple collect on your phone, is covered by Google’s privacy policy and Apple’s privacy policy.

Computers managed by an organization

If an organization installs the ORelay agent on a computer you use, that organization decides what is monitored and is responsible for telling you.

Keeping and deleting data

Our servers are in the United States, on machines we rent from Vultr and run ourselves, and the apps and web viewer reach them only over encrypted connections. We keep your data while your account is active.

You can delete your account yourself: on the Account page of the web viewer, in Settings in the Android app, or on the Account screen of the iPhone app. Deletion is immediate. Organizations only you are in are deleted with it, along with their computers' records, activity log and stored files. You leave every other organization, which keeps its own records, including its activity log of what you did there. Backups you made to your own Google Drive or OneDrive stay there. Copies in our encrypted backups are removed as those backups expire, within about 13 months.

To get a copy of your data, or to have your account deleted if you can't sign in, send us a privacy request. The link fills in the subject for you.

Our websites

This website, orelay.io, is a set of static pages. They set no cookies, run no analytics and load nothing from other sites. Cloudflare delivers them, so it sees the IP address of each visitor and the pages they ask for. It delivers the installers on our Download page too, from downloads.orelay.io, and sees the same for each download. Our company website, orelaystudios.com, is hosted by a provider that records visits on its own servers, and the form on its Support page emails us the name, email address and message you type into it, so that we can answer you.

Children and changes

ORelay is for people 16 and over, as our terms say, and we don't knowingly collect data from anyone younger. If this policy changes, we'll post the new version here and update the date above.

Contact

For any privacy question or request, email us a privacy request. The link fills in the subject for you.

By post: ORelay Studios LLC, 4539 N 22nd St, Ste N, Phoenix, AZ 85016, United States.

See also the terms of service.