Privacy Policy

Last updated 4 October 2026.

This policy explains what Ahnaf Tiar Valexi ("we") collects when you use Relnotely, why we collect it, and who else sees it. It applies to the application, the public changelog pages it serves, the feedback boards and roadmaps beside them, and the embeddable widget.

Who is responsible for what

We are in two different positions depending on whose data it is, and this policy keeps them apart.

Your account. For the details you give us as a customer — your account, your billing, how you use the dashboard — we decide what is collected and why. We are the controller of that data, and the rest of this policy describes what we do with it.
Your readers. For the people who read, subscribe to or post on a customer's changelog, feedback board and roadmap — their email addresses, their votes, their ideas — the customer is the controller and we are the processor. We hold and use that data only to run the customer's changelog, board and emails for them, on their instructions, and for nothing of our own.

That is why every email a subscriber receives is sent under the customer's name, names the customer, and links to the customer's privacy policy rather than this one, and why a customer's changelog does not mention us. The address those emails are sent from is ours, on updates.relnotely.com, because we deliver them; it is the one place in them our name appears. A reader's first point of contact is the customer whose updates they asked for. If you are a reader, the parts of this policy written for you are further down.

What we collect

Account information. Your name, email address and a hashed password. We never store your password in a form we can read.

Content you write. The workspaces, changelog entries, drafts, tags and publication dates you create. Entries you publish are public by design; drafts are not. If you switch on a feedback board, the same goes for what you write there: the ideas you add as the team, your replies, the statuses you set and your board's settings.

Voters on your feedback board. If someone signs in to your board to post an idea or vote, we store their email address, the name they chose, their ideas and their votes on your behalf. As with subscribers, you are the controller of that data and we process it only to run the board for you. What a voter can expect is set out further down this page.

Subscriber email addresses. If someone subscribes to one of your changelogs, we store that email address on your behalf, with the record of their confirmation. You are the controller of that list; we process it only to operate the service for you. For you, we also keep a record of each email sent to a subscriber and what became of it (delivered, bounced, marked as spam), and, for each changelog, a list of addresses that bounced or complained so that they are not mailed again.

Your email settings. The name your emails are sent under, the reply-to address, and the postal address and privacy policy link shown in their footer. These are shown to your subscribers in every email, because the email is yours. A reply-to address is used only after whoever reads that inbox has confirmed it: we send that address one email with a link, and nothing more if it is ignored.

Billing information. We store a customer identifier, your subscription status and the last four digits and brand of your card. Full card numbers are never sent to or stored on our servers.

Technical information. Server logs recording IP address, browser user agent, requested URL and timestamp. These are used to operate and secure the service and to enforce rate limits.

How we use it

To provide the service: authenticating you, storing your entries and serving your public changelog, feedback board, roadmap and widget.
To take payment and manage your subscription.
To send service messages such as password resets and billing notices.
To keep the service secure, including rate limiting and abuse investigation.

We do not sell your personal information, and we do not sell or rent the subscriber lists or voter lists belonging to your workspace.

Payment processing

Payments are processed by Stripe, Inc. When you subscribe you are taken to Stripe's own hosted checkout and your card details are submitted directly to Stripe. We receive a customer reference, your subscription status and the card's brand and last four digits — never the full number, and never the security code. Stripe processes this data as an independent controller under its own privacy policy at stripe.com/privacy.

Cookies and analytics

We set a session cookie to keep you signed in and a CSRF cookie to protect forms from cross-site submission. Both are strictly necessary for the application to function and are not used for tracking or advertising.

The embeddable widget stores the date of the newest entry you have seen in your browser's local storage, on the website hosting the widget. It is used only to show an unread indicator, is never sent to us, and identifies nobody.

We count visits to our own marketing pages ourselves. Each count is a daily total for a page, together with the website that linked to it and any campaign tags in the address. The totals contain nothing about who visited: no IP address, no identifier and no cookie of their own, and no script is loaded to make them. Pages belonging to our customers, including every changelog we host, are not counted at all.

If you create an account, we record on it the website or campaign your visit began from, so that we can tell which of our efforts people find us through. It is kept with your account and deleted with it. A browser that sends a Global Privacy Control or Do Not Track signal is not given a source to record.

We do not run third-party analytics, advertising or tracking scripts on the application or on the changelog pages we serve.

Sub-processors

These are the companies that process personal data for us, including data about our customers' readers that we process on our customers' behalf. We share data only with the providers needed to run the service. This list was last updated on 4 October 2026.

Resend, Inc. — email delivery. Delivers the emails our customers send their readers — from our own sending address, under each customer's name — and the emails we send account holders. Processes the recipient's address, the message, and what became of it (delivered, bounced, marked as spam). United States.
DigitalOcean, LLC — hosting. Its servers host the application and its database, and so everything described on this page. We manage those servers through Laravel Forge. United States.
Cloudflare, Inc. — content delivery and custom hostnames. Its network sits in front of the application and issues the certificates for customers' own domains; it processes visitors' IP addresses and requests in order to deliver and protect the pages. Global network.
Stripe, Inc. — payments. Processes account holders' billing details for subscriptions, and nothing about their readers. United States.
Cloudflare R2, which stores encrypted backups of the database and of uploaded images so the service can be restored after a failure.

We keep this list current. Before a new sub-processor begins processing personal data on our customers' behalf we add it here, change the date above, and tell every account holder by email, so that a customer who objects can tell us, or leave, before it starts. A provider that only stops being used is simply removed.

We may also disclose information where we are legally required to, or to establish or defend legal claims.

How long we keep it

Account and content data are kept while your account exists. If you delete your account, your workspaces, entries, subscriber lists and feedback boards, with their ideas, votes and voters, are deleted with it. Billing records are retained as long as required for tax and accounting purposes. Server logs are retained for 30 days.

A sign-in link sent from a feedback board works for 30 minutes and once only; used and expired links are cleared out daily. A voter who deletes their data from a board's account page has their address, name and votes removed straight away.

If you subscribed to a changelog

This part is for readers rather than account holders. If you gave your email address on a changelog page, that page is run by one of our customers — the company or person whose product it describes. The list is theirs and so is the decision to email you: they are the controller of your address, and their privacy policy, linked in the footer of every email they send you, is the one that applies. We are their processor: we hold the list and send the emails on their behalf, under their name, from an address of ours.

What we hold about you is your email address, the time you asked to subscribe and the time you confirmed, and the tokens in your confirmation and unsubscribe links. Entering an address only sends it one confirmation email; it joins the list when the link in that email is followed and confirmed, and an address that is never confirmed is deleted after 72 hours. The form collects nothing else. Your IP address appears in our server logs like any other visit, as described above. We use your address only to send that changelog's updates, never for anything of our own, and we do not share it with anyone but the providers listed on this page.

The customer decides what is published and when an email goes out. They can see their subscriber list and remove any address from it, so you can ask them directly, or use the unsubscribe link in any email, which takes effect as soon as you confirm it on the page it opens.

The quickest way to ask about your data is to ask the customer: their contact details are in their privacy policy and at the foot of every email. If you cannot reach them, write to [email protected] and say which changelog you subscribed to; you do not need an account with us, or with them. We will pass your request to the customer, and help them answer it.

If you posted or voted on a feedback board

A changelog may have a Feedback tab and a Roadmap beside it, run by the same customer. Reading them needs nothing from you. To post an idea or vote, you give your email address and we send it a sign-in link; following the link proves the address is yours and signs you in on that site, and on that site only, for 90 days.

What we hold about you is your email address, the display name you chose if any, the time the address was verified, the ideas you posted and the ideas you voted for. Only a display name, shortened to a first name and an initial, is ever shown on the page; your address is not. We keep no record of your visits and the pages load nothing from anyone else.

The customer moderates the board: they can see, edit, merge, close and delete ideas, and can export the list of voters' addresses for their own records, as they can their subscriber list. The board sends you no email but the sign-in link: when an idea you posted or voted for changes, you see it on the board the next time you visit. You can change your name, or delete your data, from the board's account page at any time: your votes are removed and your ideas stay on the board without your name. You can also write to [email protected] and say which board it was.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to complain to a supervisory authority. To exercise any of these, write to [email protected].

International transfers

Our providers may process data in countries other than your own, including the United States. Where required, transfers are made under appropriate safeguards such as the European Commission's standard contractual clauses.

Children

The service is not directed at children under 16 and we do not knowingly collect their personal information.

Changes

If this policy changes materially we will update the date at the top of this page and, where the change affects you meaningfully, tell you by email.

Contact

Ahnaf Tiar Valexi
[email protected]