XATHERYN RELAY

Privacy Policy

Last updated: September 1, 2026

This Privacy Policy explains how Xatheryn Relay (“Relay,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards information when you use our short-form video publishing service (the “Service”). By creating an account or otherwise using the Service, you acknowledge that you have read and understood this Policy.

1. Information We Collect

Account information. When you register, we collect your email address and, if you choose to provide one, a display name. We do not collect or store passwords. Relay uses passkey (WebAuthn) authentication exclusively, meaning your device or password manager holds your private credential and it never reaches our servers. We store only the public key, a credential identifier, and non-secret metadata (such as device type) needed to verify your sign-ins.

Content you upload. Video files, captions, and any other content you submit for publishing. We process this content solely to validate it, store it temporarily, and transmit it to the destination platforms you select.

Connected platform information. If you connect a third-party social media account (such as Instagram, Facebook, TikTok, YouTube, X, or Threads), we receive and store an authorization token issued by that platform, encrypted at rest, solely to publish content to that account on your behalf and at your direction. We do not receive or store your password for any connected platform.

Technical and usage information. We collect the IP address associated with your registration and certain authentication events, for the purpose of rate-limiting, fraud prevention, and abuse detection (for example, detecting attempts to create an unreasonable number of accounts from a single network to circumvent free-tier limits). We also maintain logs of account activity (such as sign-ins, publishing attempts, and subscription changes) for security, auditing, and support purposes.

Payment information. Paid subscriptions are processed by Square, Inc. We do not collect or store your payment card details; those are handled directly by Square in accordance with Square’s own privacy policy and applicable payment card industry standards.

Cookies and similar technologies. We use cookies necessary to keep you signed in and to protect your account (see Section 6). If you are on our free tier, third-party advertising cookies may also be set, as described in Section 5.

2. How We Use Information

We use the information described above to: (a) provide, operate, and maintain the Service; (b) authenticate you and secure your account; (c) publish content to the destinations you select, using the authorizations you grant; (d) process subscription payments; (e) detect, investigate, and prevent fraud, abuse, and security incidents; (f) communicate with you about your account, including transactional and account-confirmation emails; and (g) comply with legal obligations.

3. Legal Bases for Processing

Where applicable data protection law requires a legal basis for processing, we rely on: performance of a contract (providing the Service you signed up for), legitimate interests (security, fraud prevention, and service improvement), consent (where you have affirmatively provided it, such as for advertising cookies), and compliance with legal obligations.

4. How We Share Information

We do not sell your personal information. We share information only in the following circumstances:

• Destination platforms you authorize. When you connect and select a platform to publish to, we transmit your content and act on your behalf using the authorization you granted, subject to that platform’s own terms and privacy policy.
• Service providers. We use Square for payment processing, an email provider for transactional messages, and, for free-tier accounts only, Google AdSense for advertising (see Section 5). Each operates under its own privacy practices.
• Legal requirements. We may disclose information if required by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers. If Relay is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy or a successor policy of which you will be notified.

5. Advertising

Free-tier accounts are supported in part by advertising served through Google AdSense. Google, as a third-party vendor, uses cookies to serve ads based on your prior visits to this and other websites. You may opt out of personalized advertising by visiting Google’s Ads Settings. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to our Service or other websites on the internet.

Ad-free access is granted per product. Each Xatheryn product is sold separately and has its own subscription. A paid subscription that includes ad-free access removes advertising within the product it was purchased for. It does not remove advertising in a different Xatheryn product — for example, a paid Relay subscription removes advertising in Relay, but has no effect in Xatheryn Connect, and a paid Connect subscription has no effect in Relay.

If we cannot confirm your subscription status, we do not display advertising.

6. Cookies

We use a strictly necessary session cookie (HttpOnly, and marked Secure when served over HTTPS) to keep you signed in, and a separate cookie to protect against cross-site request forgery. These are required for the Service to function and are not used for tracking or advertising. See Section 5 for advertising-related cookies on free-tier accounts.

7. Data Retention

Uploaded video files are stored only temporarily and are automatically deleted from our servers once every destination you selected has reached a final status (published, failed, or cancelled), or after a bounded retention period, whichever comes first. Account information is retained for as long as your account remains active. You may request deletion of your account and associated data at any time by contacting us using the information in Section 12.

8. Data Security

We use industry-standard safeguards, including: passwordless authentication via WebAuthn passkeys; hashed, single-use session tokens; encrypted-at-rest storage (AES-256-GCM) for third-party platform authorization tokens; and rate limiting on authentication endpoints. No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

9. Your Rights and Choices

Depending on your location, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. You may exercise these rights by contacting us at the email address in Section 12. We will respond within a reasonable timeframe and in accordance with applicable law.

10. Children’s Privacy

The Service is not directed to children under the age of 13 (or the minimum age required by your jurisdiction), and we do not knowingly collect personal information from children below that age. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

11. International Data Transfers

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated “Last updated” date, and where required, we will seek your renewed acceptance before you can continue using the Service.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at [email protected].