Know what exists where.

Data kept on this device

• An AES-GCM encrypted EVM recovery phrase or private key, public address, KDF salt/IV, and vault metadata.
• If enabled, an origin-bound WebAuthn credential identifier, public key, authenticator transport hints, signature counter, and recovery-owner signature. RelayZero does not store the passkey private key; it remains in the platform authenticator.
• Signed transaction envelopes and public queue status needed for offline carry and reconciliation.
• Cached EVM nonce/fee state, authenticated packet identifiers, and local assistant drafts.
• An optional browser-local sync preview stores an opaque sync id, revision checkpoint, and encrypted contact snapshot only after explicit opt-in. Its separate passphrase is never intentionally persisted.
• The recovery phrase is displayed during enrollment and is not intentionally stored after that flow.

Data a relay would receive

• Public payer/recipient, exact amount, signed EIP-1559 transaction bytes, envelope/hash identifiers, transport, timestamps, status, and a public Robinhood Chain transaction hash when a transfer is submitted.
• Signed bytes are cleared in implemented terminal states. Payment-request and carrier records retain the minimum identifiers and delivery state needed for reconciliation, but no approved retention schedule exists.
• The relay does not require a recovery phrase, plaintext key, PIN, contact list, biometric, or full assistant conversation.

Data handled by configured providers

• OpenRouter receives only the command typed into the AI assistant and the minimum system instructions needed to return a structured draft. It receives no wallet secret, PIN, phone number, signed transaction, or authority to sign or broadcast.
• Twilio receives a destination phone number and hosted payment-request link when the user explicitly sends carrier SMS. RelayZero stores a keyed destination digest and delivery metadata, not the plaintext phone number.
• Account enrollment uses Twilio Verify. The private account directory stores a keyed phone digest plus an AES-GCM encrypted phone value for recovery; it has no public phone lookup route. Recovery-owner-signed lookups are rate-limited, return only a masked phone and active smart wallet, and retain only a keyed target digest in the lookup audit. Authenticated inbound command receipts retain provider message ID, keyed sender digest, body digest, command category, and timestamps, not the message text.
• Vercel, the configured Robinhood Chain RPC, OpenRouter, and Twilio may process ordinary technical metadata such as IP addresses and request timestamps under their own terms.

No analytics or advertising

The repository contains no advertising SDK, user account system, marketing tracker, or third-party analytics SDK. The encrypted contact-sync UI is a same-browser preview only. Hosting, RPC, AI, and carrier providers can still process the technical data described above.

Your local controls

• Safety & privacy can export redacted counts and clear optional contacts, assistant policy/audit, and the browser-local encrypted sync preview.
• Delete local wallet removes the vault, passkey binding, queue, contacts, AI policy/audit, encrypted sync preview, and local replay data from this browser after confirmation.
• Blockchain records and data already received by third-party infrastructure cannot be erased through browser storage controls.

Governance still required

Before expanding beyond the restricted pilot, identify the controller and processors, document purposes and lawful bases, complete data-protection and international-transfer assessments where required, approve retention/deletion workflows, provide a verified rights-request channel, and obtain specialist EU/Poland review.