Privacy Policy

1. Summary

This Privacy Policy describes how Wrights Creative Services, L.L.C. ("we," "us") handles information in connection with the AppRelay desktop console for macOS and Windows, the AppRelay Mobile companion apps (together, the "App"), and the website at apprelay.io and its subdomains — including studio.apprelay.io, license.apprelay.io, and support.apprelay.io (together, the "Site"). We designed AppRelay to be private by default: it does its work directly on your computer.

2. The App is local-first

AppRelay operates as a control center for software projects that already live on your computer. When you scan a folder, browse git status, run a build, execute a test suite, or cut a release, all of that happens locally through tools already installed on your machine.

• No login in the App. There is no sign-up and no login to use AppRelay itself, and using it creates no user profile on our servers. If you buy a license you may optionally create an account on our website to manage it — that is a Site account, never required by the App, and it is described in §6.
• Anonymous usage counts only. The App reports anonymous, aggregate counts of the core actions it performs — builds, runs, deploys, tests, and rollbacks — as plain integer tallies, so we can understand overall usage and show how much AppRelay ships. It sends no crash pings or diagnostics, and it never transmits your code, repositories, project configuration, file paths, commands, output, or secrets. The counts carry no project data and are tied only to the same anonymous device fingerprint used for licensing (§5) — not to you or your account.
• No cloud. Project configuration and history are stored in your operating system's app-data directory (macOS Application Support / Windows AppData) and in files you create. We do not host or sync them.

Aside from those anonymous counts, the App's only other server contact is licensing. If you unlock the paid tier, it reaches our licensing service to activate and periodically re-verify your license — a small, well-defined exchange described in §5 that likewise carries none of your project data, code, or secrets.

The App also offers Dispatch, its built-in assistant, plus optional AI actions (drafting release notes, explaining a failed build, and the like). Those run through the claude command-line tool you install and sign in to, under your own Anthropic account — not through us. We receive nothing from them; any context sent goes to Anthropic under your account and its policies, and your secrets are excluded. Your conversations with Dispatch and their token counts are stored only on your own machine.

3. What we collect

We collect personal data only in these limited situations, most of which you initiate:

• License activations — the small amount of license and device information exchanged when you activate or verify a paid license (see §5).
• Account details — if you choose to create an optional account to manage your licenses (see §6).
• Purchases — the record created when you buy through Stripe (see §7).
• Support tickets you submit on the Site (see §8).
• Release-update subscriptions — your email address, if you ask to be told about new releases (see §9).
• Emails you send us directly.
• Website analytics gathered as you browse apprelay.io (see §10).

4. .relay archives & secrets

AppRelay can export a project as a portable .relay archive. Any secrets you store — API keys, tokens, signing credentials — live only inside that archive, encrypted with AES-GCM using a key derived from a passphrase you set (PBKDF2-HMAC-SHA256, 310,000+ iterations).

• The passphrase is never stored and never transmitted. We cannot recover it, and neither can anyone else.
• Archives contain only relative paths and references — never absolute paths or machine identifiers.
• An archive goes only where you put it. We do not receive, host, or have access to your archives or their contents.

5. Licensing & device activation

AppRelay Studio (the paid tier) is a single-seat license. To enforce that fairly and to keep your updates window current, the App talks to our licensing service at apprelay.io when you activate the license, when it re-verifies periodically while you're online (roughly every fifteen minutes, and when you bring the window to the front or wake the machine), and when you release the seat to move to another computer. Each time, we receive and store:

• your license key and the email address you purchased with;
• an opaque device fingerprint — a one-way hash of a hardware identifier that lets us tell one machine from another without identifying it to anyone else;
• the device name you've given the machine (e.g. "Aaron's MacBook Pro"), and its platform (macOS, Windows, iOS, or Android) and app and OS version;
• the IP address the request comes from, and the times of activation and each check-in.

We use this only to run licensing: to hold a seat to one machine at a time, to show you which devices are activated on your license, to honor deactivations and renewals, and to protect against abuse. It is stored in our database, access is restricted to our administrators, and we never sell it or use it for advertising. It contains nothing about your projects, code, or secrets. The free tier requires no license and makes no licensing call. This check-in happens whether or not you have a website account — it is keyed to your license, not to an account.

Anonymous usage counts. The App's device check-in also carries the anonymous usage counts described in §2 — running, aggregate tallies of how many builds, runs, deploys, tests, and rollbacks it has performed. These are counts, not content: they say how much was done, never what, and they include nothing about your projects, code, commands, output, or secrets. They are keyed only to the anonymous device fingerprint — never to you or an account — and we store them in aggregate to understand overall usage and to show how much AppRelay ships. Because they identify no one, they are not personal data.

How long we keep it. We erase a device's IP address 90 days after its last check-in. If it goes 24 months without checking in we also erase the device name and the email address attached to it, leaving only the anonymous fingerprint and the license it was used with. §11 sets this out in full.

6. Your AppRelay account

Buying a license optionally lets you create an account at studio.apprelay.io to manage your licenses, move a seat between computers, and get your receipts. This is a website account and is never required — the App has no login, and a license works exactly the same whether or not you register. If you never create one, this section doesn't apply to you.

If you do create one, we store:

• your email address, and a display name if you give one;
• a hash of your password (Argon2id, or bcrypt where Argon2 isn't available) — we never store or have access to the password itself;
• whether your email has been verified, and when;
• the time and IP address of your last sign-in, and when the account was created and last changed;
• which licenses are linked to the account, and how each came to be linked.

A security log. To protect your account and investigate abuse, we record account events — registering, verifying, signing in, failed sign-in attempts, signing out, changing a password or email address, claiming a license, and switching which computer holds a seat — each with the time and the IP address it came from. Two details worth stating plainly:

• When you change your email address, the log keeps a note of the previous address, so a change can be traced if an account is compromised.
• A failed sign-in is recorded even when the email doesn't belong to an account — so if someone mistypes an address at our sign-in form, that address and their IP are logged. We use this only to detect password-guessing, and it never creates an account or any kind of profile.

Verification and password-reset links are stored only as a one-way hash, alongside the IP that requested them, and they expire (24 hours for verification, 1 hour for a reset).

What an account does not contain. Nothing about your projects, code, repositories, or secrets — we never receive those, with or without an account. Signing in sets a single session cookie holding nothing but a random session token; it is strictly necessary for the account to work and is not used for tracking or advertising. Account pages are excluded from search engines.

Our lawful basis for the account itself is performing the service you asked for; for the security log it is our legitimate interest in keeping accounts and licenses secure. You can ask us to delete your account at any time (see §12) — doing so does not revoke or affect any license you bought, and you can still manage your licenses with your key and purchase email.

7. Purchases & payment

Payments for AppRelay Studio are handled by Stripe through its hosted checkout. We never see or store your card number — Stripe processes the card directly under its own privacy policy. When a purchase completes, we receive and store your email address, Stripe transaction identifiers (so we can match refunds and renewals), and the license key we issue to you. We use this to deliver and support your license. Stripe may also collect billing and tax information as part of checkout.

The iOS and Android companion apps are free and are distributed through Apple's App Store and Google Play; any records from those stores are handled under each marketplace's own privacy policy, and we receive only the transactional information the marketplace provides.

8. Support tickets

When you open a ticket on the Site, we collect the information you provide: your name, email address, the category and subject, your AppRelay version if supplied, and the message body. We use it solely to respond to and resolve your request.

• Tickets are stored in our database and are accessible only to us.
• We do not sell this information, and we do not use it for advertising.
• Please don't paste secrets, signing keys, or passphrases into a ticket — we don't need them, and you shouldn't share them.
• We keep a ticket for 24 months after its last message or change, and then delete it and the whole conversation — see §11.

9. Release updates by email

You can ask us to email you when a new version of AppRelay ships. This is entirely optional and separate from your license — signing up is not required to buy, download, or use anything. When you sign up we store:

• your email address;
• the IP address you signed up from and the approximate country derived from it, plus which page you signed up on — kept as a record of consent and to catch abuse of the form;
• the times you subscribed and, if applicable, unsubscribed.

We use this only to tell you about AppRelay releases. We do not sell it, share it, or use it to build advertising profiles. Our lawful basis is your consent, which you can withdraw at any time.

Unsubscribing. Every release email carries a one-click unsubscribe link, and mail apps that support one-click unsubscribe can do it for you. Unsubscribing takes effect immediately and needs no account or password.

Please note that when you unsubscribe we keep a record of your address on a suppression list — that is precisely what stops us mailing you again, including if someone later re-enters your address. If you'd rather we erased it entirely instead, ask us (see §12) and we will. Unsubscribing stops marketing and release mail; it does not stop essential messages tied to something you bought, such as your license key or a receipt.

10. Website & analytics

The Site is intentionally lightweight. Standard web-server logs (such as IP address and request time) may be recorded transiently for security and reliability. The only third-party tag we load is Google Ads conversion measurement, described at the end of this section — and it stays off until you accept our cookie notice. We run no other advertising or analytics trackers.

Our own analytics. Separately from the Google Ads tag, we run our own analytics directly on our server. It uses no client-side script and sets no cookies, so it works even with JavaScript disabled. For each page view we record:

• your IP address;
• the page path and the referring site's domain (not the full referring URL);
• attributes derived from the request: approximate country (from your network, not GPS), browser family, operating system, device type (desktop/mobile/tablet), and preferred language;
• campaign tags (utm_*) when you arrive from a link that carries them;
• a daily-rotating, one-way hash used to count unique visitors within a single day.

We also count basic interactions the same way — when you tap a download button or scan one of our QR codes, we record that the click or scan happened (along with the same attributes listed above, including your IP address) so we can measure how many people download the apps. This too is server-side and cookieless.

To show approximate country, we look your IP address up against a geolocation database stored on our own server (DB-IP Country Lite, licensed CC BY 4.0). This lookup happens entirely on our server — your IP address is not sent to any third party to determine your location.

We use this data to produce traffic statistics and to protect the Site (for example, investigating abuse). An IP address can identify you, so we treat it as personal data: access is restricted to our administrators, we do not sell it, we do not use it to build advertising profiles, and it never leaves our server. We erase the IP address from these records after 90 days. Only the abuse investigation needs it — the traffic statistics are counted entirely from the other fields listed above, which don't identify you — so past that point it earns nothing and we don't keep it. Our lawful basis is our legitimate interest in understanding and securing our Site; where required, we honor your right to object. You can ask us to delete the analytics data associated with your IP address at any time (see §12), and §11 sets out how long the rest is kept.

Google Ads (conversion measurement & advertising). We advertise AppRelay through Google Ads and load Google's tag (gtag.js) on our web pages to measure which ads lead to a purchase and, with your consent, to build advertising audiences. This is a third-party script from Google that can set cookies (such as _gcl_*) linked to the ad you clicked.

We run it under Google Consent Mode, so these advertising cookies are denied by default and are set only if you choose Accept on the cookie notice shown on your first visit. If you Decline (or dismiss it), no advertising cookies are set and measurement falls back to a cookieless, aggregated mode. When you complete a purchase we report the sale to Google so it can be credited to the ad that referred you — the purchase value, an order reference, and, only if you accepted the notice, a hashed, irreversible form of your email address so Google can match the sale to your ad click (this is “enhanced conversions”). The hashing happens in your browser; we never send Google your email in readable form, your name, or anything about your projects. Google acts as an independent controller for this data under its own privacy policy. You can change or withdraw your choice at any time by clearing this site's cookies and storage in your browser, which brings the notice back.

11. Data retention

We keep license and purchase records for as long as your license is valid and as needed for support, accounting, and legal obligations. Support tickets are kept for 24 months from the last message or change on the ticket, after which the ticket and its entire conversation are deleted outright. That window is what lets us keep a reasonable history of resolved issues — long enough to see whether we've helped you with this before — without holding on to what you wrote to us indefinitely. It applies whatever state a ticket is in: a conversation nobody has added to in two years is finished, whether or not anyone got around to marking it resolved. You can ask us to delete your data at any time (see §12).

Account data is kept while your account exists. If you ask us to delete it (see §12), we remove your account, your display name, your password hash, any outstanding verification, reset, or email-change links, and the links between you and your licenses. Two things deliberately survive:

• Your licenses and their purchase records, because we need them to honor what you bought and to meet our accounting obligations. They simply stop being linked to an account — your keys keep working.
• A limited security record of account events (the event, the email address involved, the IP, and the time), which we retain to prevent fraud and abuse — for example, so a chargeback or a repeated account-takeover attempt can still be investigated after the account is gone. We keep these events for 24 months, and failed sign-in attempts for only 90 days, after which they are deleted. Failed attempts go early on purpose: as §6 explains, we log one even when the address belongs to no account, so those records can describe someone who has never had anything to do with us — and all they are good for is spotting password-guessing while it's happening. We rely on our legitimate interest in security for this, and on the corresponding exception to erasure. If you believe it should not apply to you, tell us and we'll consider your objection.

An account that was never completed is deleted after 30 days. If an address was entered at our sign-up form but the verification link was never used, nobody ever signed in, and no license was ever linked, we delete the whole thing — the address, the display name, and the password hash — a month later. This one protects people who never came here at all: anyone can type your address into a sign-up form, and when they do, that unfinished record is ours to clean up rather than yours to discover. The link itself expires within 24 hours regardless (§6), so nothing usable is lost — if it was you, and you come back, just sign up again. Verified accounts are never deleted this way, no matter how long you leave them idle.

Verification, password-reset, and email-change links are short-lived by design (§6). We delete our record of one — including the IP address that requested it — 30 days after it expires.

Devices (§5). We erase a device's IP address 90 days after that device last checked in. While a device is in normal use the question barely arises — each check-in overwrites the address rather than adding to a history, so there is only ever one, and it is minutes old. The period is what governs a device that goes quiet: once it stops calling, the address is the one thing on the record that no longer does anything, so it goes first. If a device then stays silent for 24 months, we erase the two remaining things on its record that describe you rather than the machine — the device name you gave it and the email address it was linked to. What is left is the opaque fingerprint, the license key it was used with, and the dates: enough for us to know a seat once existed, not enough to say whose it was. We keep that much because the record of which machines a license has run on is part of running the license itself (§5). If the device ever checks in again it simply re-registers, and tells us its name once more.

A record of the emails we send you — the address it went to, the subject, and when — is kept for 24 months. We use it to answer questions like "was my license key ever actually sent?", and to make sure we don't send you the same release announcement twice. A message that fails to send repeatedly is given up on, and we delete its contents 90 days after it was queued.

Release-update subscriptions are kept until you unsubscribe. After that we retain only what's needed to keep you unsubscribed (see §9), unless you ask us to erase the address entirely.

Analytics records (§10) keep your IP address for 90 days and we then erase it, as described in that section. What remains no longer identifies you, and we keep it for about 14 months so we can compare traffic year on year, after which the record is deleted outright. Security and abuse logs — what we record when a request is blocked or a license lookup is repeatedly guessed at — are kept for 12 months. All of it is deleted sooner on request (see §12).

12. Your rights

Because we hold so little, honoring your rights is simple. You may ask us to access, correct, or delete any information you've sent us or that your license and devices carry — including your account, your security log, your release-update subscription, and the analytics records tied to your IP address. Contact privacy@apprelay.io and we'll act on reasonable requests.

Some of it you can do yourself, without asking: change your email, display name, or password from your account; unsubscribe from release emails with the link in any of them; and release or move a device seat from your account or the Manage license page. Depending on where you live (e.g. the EEA, UK, or California), you may have additional statutory rights, which we honor.

13. Children

AppRelay is a developer tool intended for adults. It is not directed to children under 13, and we do not knowingly collect information from them.

14. Changes to this policy

If we make material changes, we'll update the "Last updated" date above and, where appropriate, note the change on the Site. Continued use after an update constitutes acceptance of the revised policy.

15. Contact

Questions about privacy? Email privacy@apprelay.io. For general help, visit Support.