Who runs the service
HashRelay is operated by Avlon Technologies Inc. Questions about this policy go to privacy@avlon.ca.
What we store
| Account | Email address, display name and a password hash. Used to sign in to the dashboard and to identify who owns a workspace. |
|---|---|
| Workspace | Workspace name, members and their roles, API keys and service accounts. Keys are stored as SHA-256 hashes with a short hint for display; the full secret is shown once and never stored. |
| Devices | For each registered device: the endpoint id the client generates, the device name you choose, the platform (Windows, Android or iOS), the client version, when it was registered and last seen, and for phones a push token from Firebase Cloud Messaging. The push token lets the service hand a notification to Google or Apple for delivery while the app is closed. |
| Subscriptions | The hashtags each device subscribes to. |
| Notifications | The title, body, tags, link, optional image or diagram and priority of each notification published to the workspace, plus a delivery record per device (queued, delivered, pushed, acknowledged) so the dashboard and the inbox can show what reached where. |
| Audit log | Workspace actions such as publishing, key creation and device approval, with the acting account, the source (dashboard, API or MCP) and the IP address the request came from. |
How it is used
Only to run the service: routing notifications to the devices subscribed to their hashtags, showing activity in the dashboard, and securing the workspace. We do not sell data, show advertising, or use the content of notifications for anything other than delivering it.
Who it is shared with
- Firebase Cloud Messaging (Google) receives the push token and the notification title and body for phones that have background push enabled. For iPhones Firebase relays the message to Apple Push Notification service.
- Microsoft Azure hosts the service and its database.
No other third parties receive data. Nothing crosses workspace boundaries.
The mobile app
The app stores its endpoint id, device name and workspace credential in the phone's secure storage. It asks for the notification permission to show notifications and, when the build includes Firebase, registers a push token so notifications arrive while the app is closed. It does not access contacts, location, photos or other apps. Revoking the device in the dashboard invalidates the credential.
Retention and deletion
Notifications and delivery records are kept for the life of the workspace so the inbox and activity views stay complete. Revoking a device removes its push token and subscriptions. Deleting a workspace removes everything in it. To delete your account and the workspaces you own, email privacy@avlon.ca; deletion completes within 30 days.
Security
All traffic uses HTTPS. Passwords are hashed, API keys and device credentials are stored only as hashes, and publishers never receive device credentials. Service accounts can be restricted to specific hashtags and link hosts.
Changes
Updates to this policy are published on this page with a new date above.