Privacy notice

Updated 6 November 2026

Relay Canvas is an independently operated workflow application by Stepan Kukharskiy. For privacy questions or a request to remove account data, use the contact information at stepankukharskiy.com.

Account and workflow data

Supabase handles email/password and Google sign-in. Relay uses your account ID and verified email to keep your workflows and runs separate. Google sign-in requests basic identity, email and profile information; Relay does not request access to Gmail or Google Drive. Session cookies keep you signed in.

Relay stores saved workflow definitions, authoring requests, revisions, run assignments, outputs and recovery records. These records support editing, execution, ownership checks and recovery from interrupted work. Infrastructure services may also retain operational and security logs.

Sharing

Workflows start private. Publishing an open workflow makes its selected definition, code and input values available to anyone with its link. Registered users can create independent copies. Revoking a link stops future access through that link; it cannot remove copies others have already made.

AI connections

Optional provider API keys are encrypted in server storage and scoped to your account. They are not included in shared workflows or exports. When you authorize an AI run, the selected provider receives the prompts, files and other inputs required by that run, under its own terms and privacy policy. The provider bills your API account. Importing a workflow does not call an AI provider.

Service providers and retention

Relay uses Supabase for account and workflow storage, Railway for hosting and run files, and the configured email sender for confirmation and password-reset messages. Email delivery receives the recipient address and authentication message. Google participates when you choose Google sign-in; AI providers participate when you authorize their use.

Deleting a workflow removes it from normal account access and revokes its share link. Revision, execution and recovery records may remain for troubleshooting and audit; workflow deletion does not automatically erase every retained record. Contact the operator for account-data removal. Server storage limits may prevent new runs without deleting existing evidence automatically.