Your data should have somewhere safe to land.

Scope

Relay is an email inbox and developer infrastructure service operated at www.relaymcp.net. This policy applies to the Relay website, temporary and account-linked inboxes, the REST API, MCP endpoint, official SDK and CLI clients, and the Relay browser extension.

Relay is not intended to be used as a general-purpose archive for sensitive medical, financial, legal, or other highly confidential records. Email sent to a Relay inbox is content provided by the sender or another third party.

Data we process

Account and authentication data

If you create or access an account, Relay may process your email address, provider identity, account role, sign-in records, API key metadata, scopes, revocation state, and session security data. API keys and session tokens are stored in protected form where applicable; a secret API key is shown only when it is created.

Inbox and message data

Relay processes inbox addresses, inbox ownership, access credentials or their protected representations, message headers, message bodies, sanitized HTML, attachments, timestamps, delivery metadata, and verification artifacts such as OTP candidates and authentication links. This is necessary to receive, display, search within, and provide the email functionality requested by you.

Technical and security data

Relay may process request timestamps, rate-limit identifiers, error information, browser or client information, webhook delivery status, and security logs. These records help prevent abuse, troubleshoot failures, enforce limits, and protect the service.

Browser extension data

The official browser extension stores only local interface preferences such as theme and notification preference. It does not request, store, or transmit an API key. When you choose to open Relay from the extension, the browser opens the official Relay website and uses the website's normal session and authentication flow.

How we use data

• Provide inbox creation, receiving, reading, API, MCP, webhook, and client functionality.
• Extract an OTP or authentication link only when the corresponding feature is requested.
• Authenticate accounts and authorize access to account-scoped inboxes and API resources.
• Maintain service reliability, rate limits, abuse prevention, backups, and security.
• Respond to support requests and communicate important service or security notices.

Relay does not use email content or extension data for advertising, behavioral profiling, or cross-site tracking. Relay does not sell user data.

Sharing and third parties

Relay does not sell or transfer user data to third parties for advertising. Data may be disclosed when necessary to operate the service through infrastructure providers acting on Relay's instructions, to comply with a valid legal obligation, to investigate abuse or security incidents, or to protect the rights and safety of Relay, users, and the public.

Email delivery necessarily involves communication with the sender's mail systems and the recipient infrastructure needed to receive messages. Webhooks send the event data configured by the account owner to the HTTPS endpoint they provide.

Security and retention

Relay uses HTTPS for web and API traffic, scoped authorization, ownership checks, protected credentials, request limits, input validation, sanitized HTML rendering, signed webhook deliveries, and security monitoring. No internet service can guarantee absolute security, so do not send information to Relay that you cannot risk exposing.

Switching addresses leaves received mail intact. Data lifecycle follows the service policy and applicable operational or legal retention requirements. Retention depends on the feature and account state. Security and delivery records may be retained for as long as reasonably necessary for their purpose. Contact support with questions about retained mail.

Your choices

• Keep inbox access credentials for addresses you want to revisit.
• Revoke API keys and sign out active sessions from your account.
• Remove the browser extension or clear its local storage to remove locally stored extension data.
• Disable extension notifications in the extension settings or browser settings.
• Contact Relay to ask about access, correction, deletion, or a privacy question.

Some records may need to be retained for security, fraud prevention, accounting, dispute resolution, or legal compliance.

Contact

For privacy questions or requests, contact the Relay team through the official website at www.relaymcp.net. Include enough detail to identify the relevant account or inbox, but do not send API keys, passwords, OTPs, or message contents in an ordinary support request.

If this policy changes materially, Relay will update the date at the top of this page and provide an appropriate notice where required.