Privacy

Last updated October 30, 2026.

The Cordatus relay is optional. Cordatus watches your server on your server, with or without it. Turn it on and it adds four things only an outside service can do: push to the Cordatus app, email from Cordatus, an outside watcher, and Google sign-in. Each is its own switch.

What the relay receives

• Your server's profile: the name you gave this server for its alerts, your time zone, and the web address you turned the relay on from.
• Push: a sealed message only your phone can open, your phone's push token, and how urgent it is. The relay can't read the alert. Apple or Google deliver it, and they can't read it either.
• Email: the alert's words and the address it goes to. Email can't be sealed, so the relay and Resend, the service that sends it, can read it.
• Outside watcher: a check-in every 5 minutes with your Cordatus version, your phones' push tokens, and a sealed "gone quiet" message for each phone.
• Google sign-in: your Google name and email address, for the moment between Google and your server. The relay keeps nothing once your server picks them up.
• Every request: your server's internet address, as any website sees it.

What it never receives: your containers, logs, metrics, incidents, keys or passwords, or anything about your household.

What it keeps: this install's ID and public key, this server's name, time zone and web address, your email recipients and whether each confirmed or unsubscribed, the watcher's schedule and last check-in, the watcher's push tokens and sealed messages, a hash of each push token used, daily counts for the limits, and a 7-day log of requests (time, install ID, result, internet address) for abuse handling.

Turning it off deletes this install's record from the relay at once.

Who runs it

The Cordatus relay is run by the Cordatus project. Questions about this policy or your data go to privacy@cordatus.app.

Why it uses this data

Only to run the services you turned on and to stop them being abused. Cordatus doesn't sell data, show ads, build profiles, make automated decisions about anyone, or train AI models with it.

For readers in the EU and UK, the legal bases are: providing a service you asked for (push, email, the watcher and sign-in), consent (an email address its owner confirmed), and legitimate interests (the limits and the abuse log).

Who else handles it

• Cloudflare runs the relay and stores its data.
• Resend sends the email.
• Apple delivers push to Apple devices.
• Google handles Google sign-in, when someone chooses it.

Each receives only what its job needs, under terms that require it to protect that data. Nobody else receives it unless the law requires it. Data may be handled outside your country, including in the United States.

How long it's kept

• This install's record: until you turn the relay off. A server that goes silent is deleted after 90 days, or after a year if the watcher is on.
• Email recipients: until they're removed or the relay is turned off. An address that unsubscribed stays until the relay is turned off, so it can't be written to again.
• The watcher's push tokens and sealed messages: until the watcher is turned off or sends new ones.
• Hashes of push tokens: until 30 days after the last push.
• Google sign-in details: until your server picks them up, and about 2 minutes at most.
• Daily counts: 3 days. Internet addresses and email addresses in them are hashed.
• The request log: 7 days.
• Error logs at Cloudflare: up to 7 days. They hold an install ID at most.

Resend, Apple and Google keep what they handle under their own policies.

Google sign-in data

When someone chooses Continue with Google, Cordatus asks Google for their name, email address and account ID, using the openid, email and profile scopes. It uses them only to tell that person's Cordatus server who is signing in. They go to that server and nowhere else, and they aren't stored after it picks them up. The relay asks for nothing else from a Google account.

Your choices and rights

• Turn any service off in Settings → Cordatus relay, or turn the relay off to delete this install's record.
• Every alert email has an Unsubscribe link. Unsubscribing works whoever added the address.
• Remove a linked Google account in Cordatus, or revoke its access in your Google account.
• Write to privacy@cordatus.app to see, correct, export or delete what the relay holds about you, or to object to how it's used. Where you gave consent, you can withdraw it at any time.
• If you're in the EU or UK, you can complain to your data protection authority.

How it's protected

Everything travels over TLS. Alerts to the app are sealed so only your phone can open them. Your server signs its requests with a key that never leaves it, and the relay stores only the public half. Access to the relay's data is limited to the people who run it.

Children

The relay isn't directed at children under 13.

Changes

If this policy changes, the date at the top changes too. A change to what the relay collects or how it's used is announced in Settings → Cordatus relay before it takes effect.