Relay is how a team shares a set of markdown files without handing content to a vendor — so customers often ask exactly what data our servers can and cannot see. The answer depends on which hosting method you use.
Our policy is that we don't charge for privacy, and we think architectural privacy from vendors should be the default. That's why self-hosting is free.
This page offers further details about what data we can see in each case.
| Can our servers see it? | Self-hosting *(free on every plan)* | Relay cloud hosting |
|---|---|---|
| Data plane — your documents | No — your server only | Yes — our servers |
| Note titles | No — your server only | Yes — our servers |
| Note content | No — your server only | Yes — our servers |
| Attachments | No — storage you configure | Yes — our storage |
| Filenames and folder paths | No — requests carry IDs, not names | Yes — our servers |
| Live presence (cursors, who's in a doc) | No — your server only | Yes — our servers |
| Control plane — accounts and permissions | Yes — Relay control plane is global | Yes |
| Your account (name, email, profile picture) | Yes | Yes |
| Relay Server name, URL, configuration | Yes | Yes |
| Who has access to what (membership, roles) | Yes | Yes |
| Shared Folder display names | Yes — renameable to anything | Yes — renameable to anything |
| Shared Folder's real folder name | No — only the display name lives on control plane; folder name lives on data plane (but the display name defaults to the real name, so change it if you want) | Yes |
| Access identifiers (server, folder, doc, device IDs; attachment hash, type, size) | Yes | Yes |
| Client details (Relay and Obsidian versions; device and vault IDs) | Yes | Yes |
| Can we read your notes? | No — we have no route to your server, no copy on ours | Technically yes; by policy no; we could be compelled |
| Where that guarantee comes from | Architecture — your network, your server | Policy — our commitment not to look |
Two independent access controls sit in front of your documents, and they are controlled by different parties. Think of them like two locked doors in serial: access to one or the other is not sufficient; only a party that can get through both doors can see the content.
Both gates must pass, and we could only pass the second.
"But you run the control plane — why can't you grant yourselves access?" Nothing cryptographic stops us: our control plane could mint a valid access token for any Shared Folder, and your Relay Server would accept it. What stops us is the first gate: an access token only does anything when it's presented to your Relay Server over the network, and our servers have no route to yours. Verification also runs entirely on your server, against public keys it already holds — nothing is sent to us to check a token, and your documents never pass through our infrastructure on the way to your other machines.
The Relay plugin and the Relay Server are open source; you can read them and confirm where your notes go.
Whoever controls your network controls the first gate. If you use a VPN or mesh network with an administrator — a company tailnet, a managed VPN — that administrator can add a device to the network. Your Relay Server treats network membership as the first gate, so this is worth knowing if the network isn't yours alone. On a network you administer yourself, you hold that control.
Webhooks are off by default, and they are an exit if you turn them on. A Relay Server can be configured to POST event notifications to a URL you choose. Those notifications carry document IDs and sync metadata, though not your document content. No webhook is configured by default, so this only happens if you set one up.
If you're hosting on our cloud, your data plane is on our network: your documents live on infrastructure we operate. This is the standard arrangement for cloud software like Google Docs and Notion. Because Relay isn't end-to-end encrypted, we have the technical ability to access synced content if required. We don't look at your data as a matter of policy; but we could be compelled to by a legal process. Self-hosting removes our access and it's free on every plan.
Ready to self-host? The canonical setup instructions live with the code: Self-hosting a Relay Server.