Security and privacy
What stays on your device, what goes through the relay and what never leaves Resend.
Data flow
| Where | What’s there | What’s never there |
|---|---|---|
| Your device | OAuth tokens (Keychain/Keystore), cached lists and metrics, app preferences, Pro trial start date. | API keys. re: never asks for one. |
Relay (relay.tryre.dev) | Push token, language, team and webhook IDs, signing secret, alert preferences and counters. Events only until the push goes out. | Your Resend token and email content. |
| Resend | Your account, as always: emails, domains, inboxes and the webhook re: creates. | Nothing from re: beyond what the API receives. |
| Analytics (PostHog and Firebase Analytics) | Usage events (screen opened, filter changed, alert enabled) with a random device ID and a hashed team code. | Email content, addresses, subjects, domains, tokens and advertising identifiers. |
| fdbk.online | What you write in the feedback and bug widget, and your email if you provide it. | Any data from your Resend account. |
The full version is in the Privacy Policy.
API calls
The app talks straight to api.resend.com with the device’s token. No server of ours sits in between, so emails, threads and contacts never pass through us.
Relay
The relay only accepts events with a valid svix-* signature for that webhook’s signing secret. It runs on Railway, doesn’t proxy the API and keeps only what it needs to send the push. Details in Alerts.
App lock
In Settings › Security:
- Open with Face ID (or Touch ID and fingerprint) requires biometrics to open the app.
- Ask for Face ID on destructive actions confirms before deleting, revoking or suppressing.
Analytics
To turn it off: Settings › Privacy › Share usage data. re: has no advertising SDKs, does no cross-app tracking and doesn’t use location.
Delete your data
- Relay data: More › Alerts › Erase my relay data. Removes re:’s webhooks from the team and deletes everything the relay has for the device, immediately.
- Resend access: Settings › Sign out revokes the token on Resend and deletes it from the device.
- Local cache: signing out or uninstalling the app deletes it.
- LGPD and GDPR requests: write to [EMAIL DE CONTATO]. We answer within 15 days.
Missing something on this page? Tell us on the feedback board