Privacy policy

The short version

• Relim asks you for no phone number, no email address and no name. There is no account on any server.
• There is no analytics, no telemetry, no crash reporting, no advertising and no tracking of any kind in the app.
• Message content, files and call audio are end-to-end encrypted. Our relays hold ciphertext they cannot read, addressed to a rotating opaque tag.
• If you leave notifications on, a push address issued by Apple, Google or a delivery app you chose is involved, and so is a Relim wake service. Those parties learn that something arrived for you and when — never who wrote it, or what it said. Details below.
• If you use the built-in Zcash wallet, it talks to a public Zcash node over the internet, and Zcash transactions are recorded on a public blockchain forever. Details below.

Who is responsible for this

The Relim app will be published as free software. The default relays, wake service and network manifest are operated by:

ALVORADO DIGITAL - SOLUÇÕES DE IA, UNIP LDA (ZONA FRANCA DA MADEIRA)
Registered office: Rua Dos Murças Nr. 15, 2º Andar, Sala G
9000-058 Funchal, Portugal
Contact: k@alvorado.co

These servers are designed so that anyone can run their own, and then no operator is involved at all. Every server component is in the same repository as the app. That repository will be published as open source; it is not public yet (Source code).

What Relim asks you for

Creating an account asks for exactly one thing: a passphrase to protect this device. Relim then generates a 24-word recovery phrase on the device. That phrase is your identity. It never leaves the device and it is never sent to any server.

Relim does not ask for and does not have: your phone number, your email address, your real name, your date of birth, a username, a profile photo, your contacts list, your location, an advertising identifier, or a device fingerprint.

Relim does not read your device address book. The app requests no contacts permission on either platform. You add people by scanning a QR code or opening an invite link.

Relim also does not exchange display names. The card two devices swap when they pair carries protocol identities and how to reach them — and nothing else. The name you see beside a contact is a name you typed on your own phone, and it stays there.

What is stored on your device

Everything you would call "your data" lives only on your phone:

• Your messages, and the files and photos you sent or received
• Your contacts, the names you gave them, and their verification state
• Your group memberships and the cryptographic state of each conversation
• Your keys, and — if you use it — your wallet's transaction history

All of it is held in an encrypted SQLCipher database. The key that opens that database is itself kept in an encrypted vault, and the vault is protected by the operating system's hardware-backed key store — the Android Keystore, or the iOS Keychain.

Two small things are stored outside the encrypted database because they are display preferences and not data: your chosen theme (dark/light) and your chosen language.

What Relim's relays see, and for how long

A relay is a mailbox for people who are offline. When you send a message, your device encrypts it, then deposits it at a relay for the recipient to collect.

A stored message on a relay is exactly four fields:

A deposit on the wire carries two things: that tag, and the encrypted blob. There is no sender field and no recipient field, so the relay is not told who deposited anything — it does, unavoidably, see the IP address of the device that connected to it.

Alongside those rows a relay keeps a small counter per queue — the last sequence number, the total bytes and message count held, and when the queue was last touched — so it can enforce its own storage limits. That is a per-queue quantity, still attached to an opaque tag and to no identity.

Retention: 30 days. An undelivered message is deleted after 30 days. A collected message is not deleted on collection — it also expires on the same 30-day clock. This value is fixed in the protocol.

What a relay operator can still infer, honestly stated

We would rather write this down than let it be discovered:

• A relay sees the IP address of every device that connects to it, live, while it is connected. Access logs record only {method, verb name, status code, duration, remote IP} — never a routing tag, never anything from the request body — and they are truncated daily and rotated out after about 48 hours. That bounds what a seized server can show; it does not make the live view disappear.
• The stored queue is a record of traffic timing and volume. A rotating tag stops one address being permanent. It does not create an anonymity set — Relim has no cover traffic and no batching yet, so an operator watching one relay over time can, in principle, link a conversation's old queue to its new one by the shape of its traffic. This is a known, accepted limitation, not a solved problem.
• A relay must order the cryptographic commits of a group conversation, so it sees the ordering metadata that requires.

Relim's relays never see message content, file content, call audio, your keys, your recovery phrase, your contacts, or a display name.

Which servers your device talks to

• relay-22.relim.io — the default relay and the signed network manifest it publishes. Your device fetches the manifest so it can learn which relays, call relays and wake service to use; the operator therefore sees your IP address at that moment.
• Additional relays and call relays listed in that signed manifest.
• The wake service, if notifications are on (below).
• A public Zcash node, if you use the wallet (below).
• The NEAR Intents swap service, only if you make a swap (below).

You can point the app at your own servers instead.

Notifications, push, and the third parties in that path

This is the part of a private messenger that people most often do not realise involves anyone else. It does.

For your phone to alert you while Relim is closed, the operating system's push service has to wake it. On iOS that is Apple (APNs). On Android with Google Play services that is Google (Firebase Cloud Messaging). On a de-Googled Android device — or on a Play device where you choose it — it is a UnifiedPush delivery app that you installed and chose, which can be self-hosted.

What each party learns

Apple, Google, or your chosen delivery app

That a notification was addressed to your device, and when. The payload is content-free. On the Google and UnifiedPush paths it is literally one byte — a version number — whose only job is to start Relim so the app can fetch and compose anything you see. On Apple's path it is a small JSON object naming two localization keys and no sentence, so iOS draws a generic alert from strings already inside the installed app. None of these paths carries a message, a sender, a conversation identifier, or anything derived from one.

The Relim wake service

Your device seals its push address to the wake service's public key before that address leaves the phone, and the sealed value is padded to a single fixed size so its length reveals nothing. The wake service holds that seal and the key to open it, so it can see: the opaque handle, the push address it maps to, your device's IP address when it registers, and the timing of every wake it fires. The handle is derived per conversation and per time window, so it is not a permanent identifier — and it tells the wake service nothing about which conversation it belongs to. It cannot see the message or the sender's identity.

The push address is held only while Relim's notifications are on (the switch in Relim's Settings → Notifications). That is how Apple's system works — and Google's: a phone can only be sent a notification at the address its push service issued, so a service that alerts you has to hold that address. (Apple's App Store privacy label calls it a device ID.) A registration lasts at most seven days, and while notifications are on your device renews it before then. A conversation you have muted is not registered at all.

When you turn notifications off, Relim tells iOS or Android to drop the push address, deletes its own copy on the phone, and stops renewing. The copy the wake service holds is not recalled: no message is sent to the wake service when you switch off, because one would show it, at a single moment, every registration that belongs to your phone. Instead each registration lapses on its own clock and is deleted, within seven days at the most. Until then the wake service still holds it, as described above.

The sender's device — an exposure worth naming

In Relim the sender triggers the wake, not the relay. That means the wake service sees the sending device's network address and the timing of every wake it fires — an activity timeline. This is exactly what turning notifications off declines, in both directions: with notifications off your device sends no wake triggers for anyone, and registers no address of its own.

Notifications are on by default, and you are told

Notifications start on. After you add your first contact, Relim shows a card that says so, names the third party that would carry the alerts if one has been chosen, and offers a one-tap decline. It is shown once — there is no second card, no banner and no nag; after that the Notifications settings screen is the permanent home for the switch.

Voice calls

Call audio is end-to-end encrypted with keys derived from the same conversation secret as your messages. Calls take one of two paths:

• Through a call relay (the default, and the only path for people you have not explicitly opted in with). The call relay forwards encrypted audio. It is reached with a random one-time token, so it sees no identities, no conversation and no call identifier. It does see the IP addresses of the participants, the timing of the call and how many people are on it. The design requires it not to share infrastructure with a message relay, so that no single operator holds both views.
• Directly, device to device. This reveals your IP address to the other person and theirs to you. It is only used for a contact you have verified and explicitly opted in with — being in a group with someone is not consent to it.

The Zcash wallet

Relim includes an optional, non-custodial Zcash (ZEC) wallet. Its spending key is derived from the same recovery phrase as your Relim identity and is re-derived per transaction; it is never stored on disk and never enters the user interface layer. Nobody but you can spend from it, and nobody but you can recover it. If you lose your recovery phrase, the funds are gone.

What leaves your device

• Blockchain sync. To show a balance the wallet talks to a public Zcash light-client node over HTTPS. The default is zec.rocks, a third-party public node that is deliberately not operated by, and not co-located with, whoever runs Relim's message relays. You can change it in the wallet's settings. That node sees your IP address and how often you sync.
• Sending. Broadcasting a transaction shows that node your IP address at the moment a particular transaction enters the network. A random delay of up to 10 seconds is applied before each broadcast so a send does not line up neatly with your other traffic.
• For shielded funds the node does not see amounts or addresses — those are encrypted.

Wallet sync starts on the first time you open the Wallet tab. It can be turned off in the app's Network screen, and off means the traffic stops, not that an indicator changes.

Swapping other coins into ZEC

The wallet can convert another coin into ZEC, or ZEC out. That is carried by a third-party swap service — NEAR Intents, reached at 1click.chaindefuser.com. A swap cannot be private the way a shielded send is. The provider necessarily sees the two assets, the amounts on both sides, your source and destination addresses, the fact that the two are one swap, and your IP address unless you route it over Tor; its own leg is public on its own network. A swap out of shielded ZEC de-shields those funds permanently — the deposit is a public, transparent Zcash transaction. Swapping in is the privacy-positive direction.

The app lists all of that on screen under "What the swap provider will see" and will not proceed until you tick "I understand the provider will see the information above." Nothing swaps on its own; every swap is an act you take.

Analytics, telemetry, advertising: none

Relim contains no analytics SDK, no crash reporter, no advertising library, no attribution library and no A/B testing framework. There is no opt-in for these because there is nothing to opt into.

Once the source is published you will be able to verify this rather than take our word for it — the entire dependency list is short:

• The app's Dart dependencies are listed in app/relim-flutter/pubspec.yaml.
• The Android build declares three native libraries and no others: firebase-bom, firebase-messaging and play-services-base — all three exclusively for the push path described above.
• The iOS build declares no third-party pods beyond Flutter's own.
• The Rust workspace's dependencies are listed in the top-level Cargo.toml.

One concrete example of the rule being applied: Relim's QR scanner uses flutter_zxing, which decodes entirely on-device, rather than Google's ML Kit scanner, which contacts Google with no opt-out.

This website has no cookies, no analytics, no fonts, images or scripts loaded from anywhere else, and no JavaScript at all. The server that delivers it keeps no access log: no record of your IP address or of which pages you read.

Permissions the app requests

This is the complete list, from the app's own manifests.

Relim requests no location permission, no contacts permission, no phone or SMS permission and no advertising identifier.

Deleting your data

Settings contains Delete everything. It destroys the keys that protect your account: the sealed recovery phrase, both database keys and the device wrapping key, then removes the database files and closes the live connection so the key is not left in memory. Once the keys are gone the remaining bytes are inert. This cannot be undone, and it is also the only way past a forgotten passphrase.

Two honest limits:

• It is local. Encrypted mail already queued for you at a relay is not deleted by it — that ciphertext expires on the relay's own 30-day clock, and without your keys nobody can read it.
• Messages you already sent are on other people's devices. Relim cannot reach into them. Disappearing messages, set per conversation, are the tool for that, and they work by agreement between the apps — not by force.

Because there is no account on any server, there is nothing for us to delete for you and no request you need to file.

Your rights, and what they can actually reach

Depending on where you live you may have rights to access, correct, export, delete or restrict the processing of personal data held about you, and to complain to a data protection authority.

The honest position is that the operator holds almost nothing that could be tied to you. A relay holds ciphertext addressed to a rotating opaque tag with no identity attached, plus access logs bounded to roughly 48 hours. A wake service, if you use notifications, holds a sealed push address against an opaque handle until it expires within seven days. There is no user record, no profile and no email address to search on. In practice we cannot identify which rows, if any, are yours — which is a design goal, and also means we cannot produce a personalised export.

You can still contact us: k@alvorado.co

When data may be disclosed

The operator may be compelled by lawful process to hand over what it holds. What it holds is described above and is deliberately close to nothing: encrypted blobs it cannot read, opaque tags, and short-lived logs. There is no message content, no contact list, no key and no account record to hand over, because none exists.

Children

Relim is not directed at children and is not designed for them. You must be at least 16 years old to use it. The app does not check your age and has no age verification, because that would require collecting the identifying information the rest of this policy exists to avoid.

Changes to this policy

If this policy changes materially, the date at the top changes. Every previous version is kept in the project's source history, which becomes public when the source is published. We will not quietly broaden it.

Contact

Privacy questions: k@alvorado.co
Security vulnerabilities: see Security.