Last updated: August 17, 2026
Relict is a personal and operational workspace for contacts, organizations, inventory, forms, and portable user-owned data. This policy covers information collected when you visit the website, create an account, or use Relict features.
Information we collect
Account data
When you create a Relict account we collect the name you provide, your email address, a hashed password, and optional profile details such as a prefix, suffix, birthday, or profile photo.
Names and contact information
Relict stores names and contact details that you enter for your own account and for records you create, including people and organizations in your workspace.
Phone numbers
You may optionally add a mobile phone number to your Relict account. Phone numbers may also appear in contacts, inventory loans, checks, and other records you create. An account phone number is stored only if you provide one. Having a phone number on file is not treated as consent to receive SMS messages.
Email addresses
Your sign-in email is used for authentication, email verification, password reset, required email multi-factor authentication, and other account messages. Email addresses may also appear in contacts and organization records you store.
Organization information
If you create or join an organization, Relict stores organization names, membership, roles, sharing choices, and related operational settings that organization administrators configure.
Forms and user-provided data
Relict stores form definitions, responses, applications, and other content that you or people you invite submit through Relict forms and related features.
Inventory and contact data
Where you use those features, Relict stores contact records, inventory items, locations, layouts, loans, checks, labels, notes, and files you upload. This information belongs to the account that created it, subject to sharing choices you make with organizations.
Authentication and security information
Relict stores password hashes, email verification status, authenticator-app settings if you enable them, SMS authentication preferences if you enable them, biometric sign-in public keys if you enable Face ID, Touch ID, or another device biometric unlock, session identifiers, device identifiers, login history, and security audit events needed to protect your account.
Cookies and session information
Relict uses session cookies to keep you signed in, enforce idle timeouts, and protect forms against cross-site request forgery. These cookies are needed for the service to function and are not used for advertising.
How we use information
We use account and workspace data to provide Relict, authenticate users, protect accounts, operate organizations and sharing, send account communications, and improve reliability. We do not use Relict account SMS consent to send advertising or promotional messages.
Service providers
Relict uses third-party processors to operate the service. Current or planned processors include website hosting, transactional email delivery, optional subscription billing, optional AI features you enable, and SMS/voice authentication providers if SMS is later activated. Providers process information only to deliver the Relict service. Relict does not currently send production SMS messages unless Twilio/A2P configuration is deliberately enabled after authorization.
Account communications
Relict sends account emails such as email verification, sign-in codes, password reset messages, and optional password-expiration reminders. These messages are part of operating the account.
SMS and Mobile Information
Relict may use a mobile phone number to provide user-requested authentication codes, account security notifications, account maintenance messages, and other transactional or service-related communications.
Mobile information, including phone numbers and SMS consent records, will not be sold, rented, or shared with third parties or affiliates for their marketing or promotional purposes.
SMS opt-in and consent information will not be shared with third parties for marketing purposes.
Message frequency varies. Message and data rates may apply. Users may reply STOP to opt out of applicable SMS messages or HELP for assistance.
SMS consent is collected separately from account creation and from acceptance of this Privacy Policy. Relict does not treat an existing phone number as SMS consent. Production SMS sending remains disabled until Relict enables an authorized SMS configuration. Recording consent does not mean a text message has been sent.
Data retention
Account and workspace records are kept while the account remains active so you can use Relict and restore your data. Some security logs, backups, and provider records may remain for a limited period after an event for security and operational purposes. Relict does not currently publish a fixed deletion interval for every record type.
Security
Relict uses hashed passwords, session controls, ownership checks on stored records, audit logging, and rate limiting for sign-in. No method of transmission or storage is completely secure. Report suspected vulnerabilities to security@relictproject.com.
User choices
- You can update profile, security, and SMS preferences in account settings.
- You can export Relict Data Files for records you own.
- You can opt out of applicable service SMS messages from account settings or by replying STOP after SMS is activated.
- Email multi-factor authentication is required to sign in and is separate from optional SMS messages.
Updates to the policy
We may update this Privacy Policy as Relict changes. The updated date appears at the top of this page. Continued use of Relict after an update means the revised policy applies to later use of the service.
Contact information
Questions about this policy or Relict privacy practices can be sent to security@relictproject.com or through relictproject.com.