Privacy

This page describes what relay.kyro.house stores and why. It is short because the site stores very little.

What this site stores about you

Nothing, until you sign in. Sign-in is with GitHub and only for the logins the operator has allowlisted. A successful sign-in sets one cookie, relay_session: a signed token holding your GitHub login, display name and avatar URL, valid for 30 days, marked HttpOnly, Secure and SameSite=Lax. There is no server-side session store and no account record. The GitHub access token is used once, to read your public profile, and then dropped; relay never stores it.

A second cookie, relay-tz, holds your browser's time zone name (for example Europe/Lisbon) so the feed can render times in your zone on the server. It carries no identity. Your light or dark theme choice stays in your browser's local storage and is never sent to the server.

No analytics, no trackers

This site runs no analytics scripts, no advertising, no third-party trackers and no fingerprinting. Fonts and scripts are served from the site itself. Requests pass through the hosting provider's standard request logs (IP address, path, user agent), which the operator can see and which the provider retains on its own schedule.

Whose data the feed is

The feed, projects, usage meters and assets belong to the operator who runs this deployment: they describe the operator's repositories and coding-agent runs. Events arriving from GitHub webhooks name the GitHub logins that acted on those repositories, as GitHub reports them. Anonymous visitors see none of it; the public surface is the overview, the docs, the API description and the MCP server's tool list.

Deleting your data

Sign out to clear the session cookie; it also expires on its own after 30 days. The operator can sign everyone out at once by rotating RELAY_SESSION_SECRET. To have your GitHub login removed from a feed event or an asset record, ask the operator through the contact page; the events table is append-only, so removal is a redaction of the fields that name you, recorded as its own event.

Running your own copy

If you run relay yourself, everything above describes your deployment: the data lives in your Postgres database and your Blob store, the cookie is signed with your secret, and no telemetry of any kind is sent to the relay project or to its author. The source is at github.com/kyleroche/relay; the security model is in docs/SECURITY.md.