Privacy Policy

Farah Relay is published and developed by Abdelhamid Farah.

Data handled

We handle GitHub identity metadata, hashed OAuth/device credentials, bounded relay request content, safe results, and value-free security events. Raw IP addresses, credentials, OAuth codes, PKCE values, raw request bodies, and raw command stdout/stderr are not stored in audit events.

Retention and deletion

OAuth access tokens last 15 minutes, refresh families up to 30 days, authorization codes 5 minutes, transactions 10 minutes, pairing sessions 5 minutes, and relay call envelopes 4 minutes. A daily maintenance job deletes expired, consumed, revoked, and terminal records older than 7 days in batches of up to 500. Host audit journals are bounded to at most 7 days and 500 MB. Account/device metadata remains while the account/device exists or until a deletion request is processed. Revocation immediately stops future use.

Request IP addresses are used transiently in memory for rate limits. Farah Relay does not sell personal data or use relay content for advertising.

For deletion requests, use Support.