Device lifecycle and recovery

One Relay account supports up to five active devices. Each device has its own registration, prekeys, sessions, mailbox generation, and push registration.

Link and revoke devices

The existing device authorizes a short-lived encrypted linking session. The new device receives account identity material, not existing sessions or message history. Relay allocates the device slot and binds it to the verified account. Clients cannot select another account's slot.

Relay does not let you remove one device by itself. An account recovery revokes all of the account's earlier devices. A revoked device cannot register again or renew its access.

Total-loss recovery

Total-loss recovery creates a new recovery generation after the configured recovery proof succeeds. Old credentials, capabilities, mailbox tokens, certificates, and restored pre-recovery state fail closed. Recovery does not recreate missing message plaintext or device-local sessions.

Deletion

When you delete an account, Relay first records a permanent deletion block for it. Then it removes the push registrations, presence, identity, mailboxes, prekeys, and encrypted objects of the account. A sent envelope in another recipient's mailbox is not recalled.

When you delete a project, Relay first records a permanent deletion block and refuses new traffic for the project. Then it removes every account in the project, its group data, its push provider credentials, and its configuration. This removal includes work that Relay accepted before the deletion. Until the removal completes, the project shows as deleting. Then Relay removes the project from your project list and releases its Free plan slot.

Relay keeps the billing record of a deleted project and keeps the current-period usage meter until the normal monthly close. Some security, billing, and legal records stay after deletion for their stated retention periods.

Read limits, billing, and operations before production activation.