What the relay sees

This page lists what a relay operator, and anyone else who runs the machine or the network of a relay, can observe. The relay is content-blind, not invisible: it cannot read what your devices send, and it still sees the connections, their IP addresses included.

The project operates one official relay, relay.easysync.me. The apps preselect it in the form for adding a relay, and you can run your own relay instead. Everything on this page applies to both, except that the section on access keys applies only to a relay that is set up to issue them.

What the relay does not get #

The relay does not have the keys of your devices and is not part of the encrypted connection between them. It does not receive the text of your clipboard or the content of your files. It does not store payload data and writes no application-level connection or payload logs.

What the relay does see #

IP addresses. The address of every device that connects to it, as the machine sees it. If a reverse proxy sits in front, the proxy sees them too.
Timing. When a device connects, how long a connection lasts, and when it ends.
Volume. About how much data goes through each connection, and how fast.
That you use a relay at all.
That a group of changing values belongs to one listening connection, which shows roughly how many paired devices that device has.
Which addresses talk to each other through it. The relay connects two devices by matching values that change over time and that it cannot link to a device by themselves. That prevents linking by those values alone. The addresses still allow someone to link sessions.
Connection attempts of strangers, if the relay is reachable from the Internet.

The relay can break connections, refuse them or shut down. It cannot read them, and it cannot change data without the receiving device noticing.

If the relay gives out access keys itself #

A relay can be set up to issue access keys to devices that ask for one, instead of its operator handing out a token. The official relay of the project does. Then a device sends one request without content over HTTPS and receives a random key. This adds the following to what the operator can see.

The request. The IP address of the device and the time, like any connection. The relay holds the address in memory for 24 hours to limit how many keys one address can request, and does not write it to disk.
A hash of the key. The relay stores a SHA-256 hash of each key it issued, the day it was created and the day it expires. It stores no address and no other identifier with them, and not the key itself.
The key at every connection. A key belongs to one device. While the key is valid, the relay can see that connections come from the same device, also when its address changes. A token that an operator hands out to everyone does not allow that.
A last day of use. A key that is not used expires after the lifetime that the operator sets, and every use moves the expiry forward. The stored expiry day therefore shows, to the day, when the key was last used.
Control. The operator can pause the issuing of new keys, end all issued keys at once and block single keys by their hash. Limits per address and in total are settings of the operator.

A key is not proof that a device runs easysync: anyone can send the request. It limits abuse; it does not identify a person. The web app asks the official relay for a key in both of its modes. In passphrase mode the key is stored in the browser together with the other keys, wrapped by the passphrase. In session mode it is held in the session storage of the tab and disappears when the tab closes, so every visit in session mode is one more request and one more stored hash. For a relay of your own you enter the token you got from its operator.

Who else sees it #

A reverse proxy, the operating system, the host and the network in front of the relay can see the same things and may write their own logs. The relay's own logs hold start-up messages, errors and numeric counters, and never payloads, tokens or pairing identifiers. Logs of the infrastructure around it are a separate matter, and the operator of a relay should tell its users what they keep.

What this means for you #

If you do not want an operator to see when your devices talk, do not use their relay. Run your own, or use direct connections on your own network.
A relay that you operate yourself is seen by your host and your network provider as much as any server.
easysync does not hide your address. It is not an anonymity tool.