--- title: "Privacy – Relyo" description: "How relyo.de processes data: website, code entry and support sessions, retention and your rights." lang: en canonical: https://relyo.de/en/datenschutz --- # Privacy policy _This is a translation for convenience. The [German version](/datenschutz) is legally binding._ As of 25 October 2026 ## 1. Controller Jochen Maurer\ Evereststrasse 41\ 81825 München, Germany\ Email: [mail@jochen-maurer.com](mailto:mail@jochen-maurer.com) No data protection officer has been appointed; none is required by law. ## 2. Overview Relyo is a service for support by screen sharing. Someone who needs help (the **user**) taps “Support” on a website or in an app and receives a 6-digit code. The person helping (the **supporter**) enters the code on relyo.de and, after the user consents, sees the user's screen live. - **Consent first, then transmission.** Screen content is only transmitted after the user has chosen “Share” on their device. The supporter can only take control after a second consent. - **No recording.** Screen content is only forwarded live and not stored. - **Masking on the device.** Password fields, email and phone fields, payment data and areas marked by the operator are made unrecognisable on the user's device before any data leaves it. - **No advertising, no tracking, no analytics tools.** ## 3. Who is responsible for what - **The relyo.de website and console:** I am the controller for processing when you visit this website and when you enter a code. - **My own projects:** I am also the controller for websites and apps that I run myself and that include Relyo (for example jochen-maurer.com and my apps). - **Third-party websites and apps:** If another operator includes Relyo in their website or app, that operator is the controller for the support sessions of their users. relyo.de then processes this data on their behalf under Art. 28 GDPR, as set out in the [data processing agreement](/en/avv). Users should address questions and requests about such sessions to the operator of the website or app concerned. ## 4. Visiting relyo.de - **Connection via Cloudflare:** relyo.de runs on its own server in Germany. All requests reach it through the network of Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Cloudflare processes the IP address, time, requested address and technical details of the browser in order to deliver the page and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is a secure and reachable service. Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); a data processing agreement is in place with Cloudflare. - **No access log:** My server does not log individual page requests. - **No cookies, no external content:** The information pages set no cookies and store nothing on your device. Fonts, images and scripts are served from relyo.de itself; there are no connections to third parties. - **Pronunciation:** The pronunciation audio file is only loaded when you tap the speaker button. ## 5. Entering a code and running a session (supporters) When you enter a code as a supporter: - **IP address:** To prevent codes from being guessed, the server counts failed attempts and requests per IP address in memory (for at most 15 minutes). The IP address is stored in the session's event log (section 7) and deleted after 30 days. A salted, non-reversible hash of the IP address serves as the supporter's identifier. - **Cookie `relyo_guest`:** After a valid code, relyo.de sets a technically necessary cookie so that only you can open this one session. It expires after at most 4 hours. - **Displayed name:** The user sees “Support” as the supporter's name. The legal basis is Art. 6(1)(b) GDPR (providing the function you use) and (f) (preventing abuse). The cookie is strictly necessary under § 25(2) no. 2 TDDDG. ## 6. Support sessions (users) When you tap “Support” on a website or in an app, your device connects to relyo.de. The following is processed: - **Connection data:** IP address (only for the connection and for preventing abuse, see section 7), website address or app identifier, platform (web, iOS, Android). - **Code:** a random 6-digit code, valid for 10 minutes and usable once. - **Device identifier:** When it first connects, the SDK stores a random identifier on your device (web: `localStorage`, apps: app storage) and, for the lifetime of a browser tab, a tab identifier (`sessionStorage`). This allows an interrupted session to resume. The identifiers contain no information about you. - **Only after you share: screen content.** For websites, the page structure (text, layout, images) and changes to it, mouse movements, clicks, scrolling and the current address; for apps, screen images and touches. Masked fields (section 2) never leave your device in plain text. The content is forwarded live to the supporter and **not stored**; during the session the server keeps only the latest full page state plus changes since then, or the latest image, in memory so the view can recover after a brief interruption. It is discarded when the session ends. - **Only after a second consent: remote control.** The supporter's clicks and inputs are carried out on your device. Only the type and time are logged, not the content of inputs. Any click or tap of your own ends remote control immediately. - **Operator's user identifier:** Some operators pass an identifier and name of logged-in users so that their supporters can find the right device. Whether and which details are passed is decided by the operator. You can end sharing at any time using the bar at the edge of the screen. For my own projects the legal basis is Art. 6(1)(b) GDPR (the help you requested) and, for screen transmission, your consent under Art. 6(1)(a) GDPR. Storing the device identifier is strictly necessary for the support you requested under § 25(2) no. 2 TDDDG. ## 7. Event log and retention For accountability and abuse prevention, relyo.de stores metadata for each session: project, device and tab identifier, the operator's user identifier where applicable, platform, status, start, end and reason for ending, and an event log (for example “sharing granted”, “control ended”) with time and IP address. It contains no screen content or inputs. | Data | Retention | | ------------------------------------------- | -------------------------------------------------- | | Screen content | not stored, only forwarded | | Counters against code guessing | at most 15 minutes, in memory only | | Code | 10 minutes or until redeemed | | Cookie `relyo_guest` | at most 4 hours | | Cookie `relyo_session` (sign-in, section 8) | 24 hours | | IP addresses in the event log | 30 days | | Session metadata and event log | 12 months | | Device identifier on your device | until you clear the website data or delete the app | The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is detecting abuse and being able to answer questions about a session. ## 8. Signing in to the console Supporters with their own account (currently only accounts I set up) sign in via an email link. Email address and display name are processed; the sign-in link is valid for 15 minutes and once. After signing in, relyo.de sets the technically necessary cookie `relyo_session` (24 hours). The legal basis is Art. 6(1)(b) GDPR. ## 9. Recipients - **Supporter:** sees the shared screen content of the session they take part in. - **Cloudflare:** as a processor for the connection (section 4). This may involve a transfer to the USA, safeguarded by the EU-US Data Privacy Framework. - **Operator of the website or app:** their supporters see the sessions of their users. Data is not passed on to any other third parties. ## 10. Your rights You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) (Art. 21). You can withdraw sharing at any time with effect for the future by ending the session. To exercise your rights, write to [mail@jochen-maurer.com](mailto:mail@jochen-maurer.com). You can also lodge a complaint with a data protection supervisory authority, for example the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany. There is no automated decision-making or profiling.