Skip to main content
This page describes what the current deployment actually does. It is not a contract or a privacy policy; see the privacy policy for the legal terms.

​
Requests

OmniRelay records metadata about each call, not its content. API source IP is retained for 90 days, then cleared from request records and no longer shown in request lists or CSV exports. Other metadata follows its own retention rules. These records power the Usage page, billing and reconciliation. They are kept for as long as your account exists, and the financial records beyond that (see Deleting an account).
Tags are stored with every request record. Use stable labels such as a customer, project or environment name, and never put personal data, emails or secrets in them.
Playground. The conversation you build on the Playground page lives only in that browser tab. It is sent to the gateway with each request, like any API call, and is gone when you start a new chat or leave the page. Console assistant. Your latest question and up to three recent messages from that conversation are sent to the assistant provider configured by OmniRelay, together with selected public product guidance. The assistant has no account-data lookup path; balances, keys, usage records, customer records and permissions are not added to its context. The assistant conversation is held in browser memory, not stored in OmniRelay’s request database, and clears on reload, account switch or a new chat. The configured provider receives the messages, so its own retention terms apply. Do not include passwords, API keys, payment details or private customer information. See Console assistant. Live providers. When a model is served live, your request is forwarded to that model’s provider to generate the reply. What the provider keeps is governed by the provider’s own terms. OmniRelay forwards only the fields the model supports; your tags are removed before forwarding.

​
Credentials

  • API keys are checked against a SHA-256 hash. So that you can view a key again, OmniRelay also keeps a copy encrypted with AES-256-GCM under a server-held key. It is decrypted only for the key’s owner, in their own signed-in session, within five minutes of confirming it’s them with a passkey or an emailed code, and every view is recorded in the audit log. Support staff acting on your account cannot view it.
  • Management keys are shown once. OmniRelay stores only their SHA-256 hash, which is enough to check a key but not to recover it. A lost management key is revoked and replaced, never looked up.
  • Sign-in is handled by Supabase Auth; OmniRelay does not store passwords. It keeps your email, display name and the Supabase account ID that links them. Sign-in forms are protected by Cloudflare Turnstile.
  • Payments go through the payment provider’s own checkout. Card details are entered into fields the provider serves and never reach OmniRelay’s servers; OmniRelay stores the order, amount and status.

​
Where it lives

The service runs on AWS in Singapore (ap-southeast-1) behind Cloudflare. The database is backed up daily to Amazon S3 in the same region, encrypted at rest (AES-256). Backups expire after 30 days.

​
Analytics

  • Cloudflare Web Analytics measures page views without cookies or fingerprinting.
  • Google Analytics loads only after you accept it in the cookie banner. Withdrawing consent removes its identifiers from your browser.
  • Neither runs on the API: calls to api.omnirelay.ai are never sent to an analytics service.

​
Deleting an account

Deleting your account in Settings:
  1. Signs you out everywhere, and revokes every API key and management key you hold, immediately.
  2. Keeps the account for 30 days so an accidental deletion can be undone and open charges can be reconciled.
  3. After that, removes your profile, email, keys and sessions. An account with a remaining balance or a live call still being reconciled is kept until those are resolved.
Request and ledger records are kept after that, because a workspace’s financial history has to stay intact. Deleting the account profile does not immediately erase all request metadata. API source IP follows the 90-day retention rule above, and any labels you supplied remain part of the request records.

​
Account switching and login records

The avatar menu supports Add account and switching between saved accounts in the same browser. The browser stores each account’s refresh session and basic profile locally, not its password. Each account retains its own workspace, balance, keys and permissions. Signing out of the selected account removes that account from the switcher; other saved accounts remain signed in. On a shared device, sign out of each account you added. Settings → Login history shows your browser/User-Agent, IP address, sign-in method, first observed sign-in, last activity, end time, session status and observed duration. Authorised administrators can view login records in Admin → Login history. The application records hashed session references rather than raw access or refresh tokens. It does not show a device hostname. Records begin when this feature observes a verified session; earlier sign-ins are not reconstructed. Without activity for 30 minutes a session appears inactive. Duration estimates observed activity, not continuous screen time, and an inactive label is not proof that a token has expired.