# Privacy This is the privacy note for the sync relay. It is embedded into the service binary at build time and served verbatim at the service root, so what you are reading is what the running code was built from. ## What this service holds Encrypted bytes, filed under a random group id. Every record is encrypted on your device before it is sent. The relay holds no key that decrypts anything, and it never decodes a record — it checks that a record is base64url-shaped and within the size cap, and stores the string. The group id is 26 random characters, generated on your device and derived from nothing: not from a username, not from an account, not from anything the site you use it alongside knows. Authentication is a token your device derives from the pairing secret. The relay stores only `SHA-256(token)`, which lets it recognise the token again and lets it do nothing else. It cannot compute the token, replay it anywhere, or use it to read a record. ## What is deleted, and when Everything, 30 days after it is written, by item expiry. No one has to ask, and nothing has to run. A device offline longer than that re-syncs from scratch when it returns. You can also delete a group outright at any time with `DELETE /v1/g/`, which removes its records and its metadata. That route answers `204` whatever happens — including for a group id that was never real — so no one can use it to find out which group ids exist. Your client is what knows whether the delete was yours. ## What is logged No request bodies. No group ids. No IP addresses. Nothing that would identify a group appears in this service's application logs. The platform beneath it logs more than the service does, and that is stated here rather than glossed over. Log retention is set in days — 14 by default — rather than the platform default of forever, and API access logging, which would record source addresses, stays off. ## What is measured Two counters a day, and nothing else: - **Total requests**, dimensioned only by route and response status. - **Distinct groups seen**, a single number. Neither carries a group id, an IP address, or a user agent. There is no per-group counter anywhere in this service, because a per-group counter is a usage profile with the labels filed off. The two numbers exist to answer one question — requests per group per day — which is what the running cost is computed from. ## What the relay can still see This note claims no more than it can keep. Encryption hides content, not the shape of use. Operating this service means unavoidably observing, per group: roughly how many devices are active, when requests arrive, how large the ciphertext is, and — at the network edge, before this code runs — the source addresses those requests came from. That is enough to infer activity patterns and rough co-location. It is not enough to name an account, which is why the group id is random rather than derived from anything about you. If timing correlation is inside your threat model, the honest advice is to leave sync off. ## Self-hosting The whole service is in one public repository and deploys into your own AWS account. Running your own removes the operator — this one — from everything above, and the client works against it identically.