Privacy Policy

1. Introduction

Bluejay Relay ("we," "our," or "us") operates the Bluejay Relay webhook routing platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. Please read it carefully. By using Bluejay Relay, you agree to the practices described here.

2. Information We Collect

Account Information

When you register, we collect your email address, name, and a hashed password. If you authenticate via OAuth, we receive your name and email from the identity provider.

Webhook Payload Data

As a core part of our service, we receive, store, and forward webhook payloads on your behalf. These payloads may contain data from third-party systems you connect. You are responsible for ensuring you have the right to transmit that data through our platform. We treat payload contents as confidential and do not use them for any purpose other than delivering them to your configured destinations.

Log Data

We retain webhook and delivery logs for a period determined by your subscription tier:

• Hatchling: 7 days
• Fledgling: 30 days
• Scout: 90 days
• Skybound: 365 days

After the retention period, logs are automatically and permanently deleted.

Usage and Technical Data

We collect standard server logs including IP addresses, request timestamps, HTTP status codes, and browser/client identifiers to operate and secure the service.

Billing Information

Payment processing is handled by Stripe. We store only non-sensitive billing metadata (subscription status, last 4 digits of card, expiration). We never store full card numbers.

3. How We Use Your Information

• Providing, operating, and improving the Bluejay Relay platform
• Routing webhook payloads to your configured destinations
• Authenticating your account and enforcing access controls
• Processing billing and managing subscriptions
• Sending transactional emails (account activity, billing receipts, dunning notices)
• Detecting and preventing fraud, abuse, and security incidents
• Complying with legal obligations

We do not sell your data or payload contents to third parties. We do not use payload data for advertising.

4. Data Sharing and Disclosure

We share your information only in the following circumstances:

• Service Providers: We use Stripe (payments), transactional email providers, and cloud infrastructure providers who are contractually bound to protect your data.
• Your Destinations: Payload data is forwarded to the URLs you configure. You control where your data goes.
• Legal Requirements: We may disclose information if required by law, subpoena, or to protect our legal rights.
• Business Transfers: In a merger or acquisition, your data may be transferred as a business asset. We will notify you via email.

5. Data Retention

Account data is retained for as long as your account is active. If you delete your account, we will delete your personal information within 30 days, except where we are required by law to retain it. Webhook and delivery logs are purged on the schedule described in Section 2 above.

6. Security

We use industry-standard security practices including TLS encryption in transit, hashed passwords, JWT-based authentication, and role-based access controls. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Export your data in a portable format
• Opt out of non-essential communications

To exercise these rights, contact us at our contact page.

8. Cookies

We use essential cookies necessary for authentication and session management. We also use Google Analytics to understand how visitors use our site and improve the product; these analytics cookies are only set after you accept our cookie banner. We do not use advertising cookies.

9. Website Analytics

We run our own first-party analytics on our marketing pages to understand how people find Bluejay and where the site confuses them. This data stays with us — it is never sold, and never shared with advertising networks or data brokers.

On our public pages we record:

• How you arrived — campaign tags in the link (utm_*), ad click identifiers, and the referring site.
• Which pages you viewed, in what order, and roughly how long each was open.
• A small set of named actions, such as clicking a call-to-action or beginning a signup form.
• Your device type, browser, and operating system, and a country code where our network provides one.
• A random identifier stored in your browser so repeat visits are recognised as the same visitor. It contains nothing about you and is not shared across sites we do not operate.
• A one-way cryptographic hash of your IP address. We never store the address itself — the hash is used only to recognise a returning visitor whose browser storage was cleared, and it cannot be turned back into an IP address.

We do not record what you do inside your account with this system. Analytics stops at signup; your webhooks, payloads, and configuration are never part of it.

Page-level and action-level records are deleted after 180 days. Summary totals, which identify no one, are kept for long-term trends.

To opt out, visit any Bluejay site with ?bjinternal=1 added to the address — that browser will stop being recorded entirely, on that site, until you clear its storage. You can also email us at support@bluejayrelay.com to request deletion of anything already collected.

10. Children's Privacy

Bluejay Relay is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this policy periodically. We will notify you of material changes via email or a prominent notice on the platform. Continued use after the effective date constitutes acceptance of the updated policy.

12. Contact

Questions about this policy? Reach us via our contact page.