Security & privacy

AppRelay is built to be private by default. This article lays out what stays on your machine, how your credentials are protected, and the trust boundaries the app is designed around. For the formal policy, see the Privacy Policy.

Everything runs locally

• No account, no sign-up — in the app. There's no AppRelay login, and you never sign in to use the console. (Buying a license optionally gets you a website account for managing it — see below.)
• Anonymous usage counts only. The app reports anonymous, aggregate tallies of the actions it runs (builds, runs, deploys, tests, rollbacks) — plain integer counts, no crash pings or diagnostics — and it never transmits your code, repositories, project config, commands, output, or secrets.
• No cloud sync. Project configuration and history live in your operating system's app-data directory and in the .relay files you create. We don't host or sync them.
• Your code never leaves your computer. Builds, tests, and releases run through tools already installed locally.

The one time the app talks to us is licensing. If you unlock AppRelay Studio, it contacts our licensing service to activate and periodically re-verify your seat — covered next. The free tier needs no license and makes no such call.

What the licensing check-in sends

Studio is a single-seat license, so the app confirms the seat with our server when you activate it, periodically while you're online, and when you release it to move to another computer. That exchange is deliberately narrow. It carries:

That's the whole payload — nothing about your projects, code, or secrets travels with it. It's stored in our database, visible only to our admins and to you (on your account's Devices page, or via the Manage license lookup), and never sold. See the Privacy Policy for the formal statement.

Push notifications to your phone

If you've paired the mobile companion and allowed notifications, your computer can alert your phone when a build, run, or test finishes. That message takes one short hop through us: at the moment a run ends, your computer sends the alert to a push relay on apprelay.io, which forwards it to Apple (APNs) or Google (FCM) to reach your device — the only way a notification can arrive when the app is closed.

The optional website account

Buying a license gets you the option — never the obligation — of an account at studio.apprelay.io, for managing keys, seats, and receipts from a browser. It's a website login, entirely separate from the app: AppRelay itself never asks you to sign in, and a license works identically whether or not you ever register.

If you do register, we store your email, a hash of your password (never the password), an optional display name, sign-in timestamps, and which licenses are yours. That's it — an account holds nothing about your projects, code, or secrets, because we never receive those in the first place. Account pages are kept out of search engines. See Your AppRelay account for what it does, and the Privacy Policy for the formal statement.

When you use Dispatch or the AI actions

Dispatch and the optional AI actions run through the claude command-line tool you have installed, under your Anthropic account — exactly as if you ran claude in that repo yourself. AppRelay has no AI service of its own and never sees your Anthropic credentials. When you ask Dispatch a question, it sends your question plus a summary of the selected project's configuration (lane labels, toolchain ids, recipe references, server host/port/username), and it can read files in that repo to answer — the same access the CLI would have. The focused actions send less: commit subjects, a capped tail of a failed step's output, or recipe metadata. Your secrets and signing credentials are never included — server passwords stay in the OS credential store and are referenced, not sent. Dispatch runs with read-only tools, so it cannot edit files or run commands; anything it proposes is applied only when you accept it. Conversations and their token counts are stored locally on your machine, never on ours. If you never use these features, nothing is sent.

Locking the app itself

Everything above is about what leaves your computer. For the person who walks up to it while you're away, AppRelay Studio can put a password in front of the app: every window, the menu-bar or tray panel, and any paired phone are covered until you unlock, and it can engage on idle, at launch, on hide-to-tray, or when the machine sleeps. The password is stored only as a salted PBKDF2 hash on that computer, never in an exported archive and never on our servers — so support can't unlock it for you, and a recovery code or your license key is the way back in. See The App Lock.

How secrets are protected

Full detail is in Secrets & encryption.

What travels in a .relay archive

• Relative paths only. Nothing about your machine — username, absolute paths — is written into the archive.
• Encrypted secrets. Values are unreadable without the passphrase.
• Config and recipes. Projects, lanes, brand, and pipelines, so the project is fully reconstructable elsewhere.

Your responsibilities

AppRelay orchestrates commands you define against your own systems. You're responsible for the commands and recipes you author, the credentials and endpoints you supply, safeguarding your passphrases, and complying with the terms of every service you distribute to. See the Terms of Service.

Working with support safely

If you contact support, share the failing command's output and your stack details — but never secrets, signing keys, or passphrases. We don't need them and you shouldn't send them. Tickets are stored only to help you and are never sold or used for advertising.

Next steps

• Secrets & encryption
• The .relay archive
• Privacy Policy