# Product event catalog (https://docs.open-e2ee.dev/relay/event-catalog.md)



Catalog version: `relay-funnel-v1`\
Reviewed: 2026-10-11

This catalog is non-authoritative. An event can explain onboarding and product behavior. It cannot authorize a request, calculate exact quota, create a message graph, or produce an invoice value.

## Privacy classes [#privacy-classes]

| Class               | Identity boundary                                                                                                                                       | Retention and deletion                                                                                                                           |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| Anonymous aggregate | No account, organization, project, device, visitor, session, cookie, or IP-address field.                                                               | The [privacy policy](https://open-e2ee.dev/legal/privacy#retention) sets the retention. No person identifier exists for a person-level deletion. |
| Project operational | Opaque project or organization handles only. No raw account, device, provider subject, message, attachment, group, certificate, or protocol identifier. | Planned. Relay does not record these events yet. Authoritative billing, security, and deletion records follow their own policies.                |

OpenE2EE never joins an anonymous website event to a person, organization, or project.

OpenE2EE already keeps other analytics records about Relay usage, delivery, and presence, and about Console accounts and billing. OpenE2EE keeps each raw record for 380 days. A weekly job then deletes the older records. Summary tables do not expire. Deleting a project does not delete its analytics records.

## Website events active before Relay launch [#website-events-active-before-relay-launch]

| Event                | Source                  | Bounded fields                                  |
| -------------------- | ----------------------- | ----------------------------------------------- |
| `demo_run`           | Home-page demo          | event, path, count                              |
| `quickstart_open`    | Website link            | event, path, count                              |
| `runtime_select`     | Runtime link            | event, path, `expo` / `browser` / `node`, count |
| `install_copy`       | Install-copy action     | event, path, count                              |
| `guide_finish`       | Article closing link    | event, path, count                              |
| `github_open`        | Repository link         | event, path, count                              |
| `security_view`      | Security page           | event, path, count                              |
| `pricing_view`       | Pricing page            | event, path, count                              |
| `signup_start`       | Console link            | event, path, count                              |
| `enterprise_contact` | Enterprise contact link | event, path, count                              |

These events have no identifier and no cross-event deduplication. They are aggregate popularity signals. The demo records at most one `demo_run` for one page load and sends nothing about the typed text.

## Planned Signal Protocol Relay events [#planned-signal-protocol-relay-events]

Status: planned. Relay does not record these events yet.

Every project-operational event uses one stable event identifier from its authoritative transition. An exact retry cannot add another event. Common fields include the event name, stable event ID, UTC time, and optional opaque project or organization handles. An event can also contain one bounded plan, runtime, provider, guide, or outcome code.

| Journey             | Events                                                                                                                                                                   | Authoritative source                                                              |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------- |
| Learn and select    | `quickstart_viewed`, `local_roundtrip_completed`, `provider_selected`, `runtime_selected`, `guide_selected`                                                              | Docs or Console selection boundary                                                |
| Initialize          | `control_operation_first_observed`, `project_files_initialized`, `account_created`, `organization_created`, `sandbox_environment_provisioned`, `device_registered_first` | A successful project setup or account change                                      |
| Deliver             | `managed_delivery_first_accepted`, `managed_delivery_first_acknowledged`                                                                                                 | Relay's record that it accepted the message or that the recipient acknowledged it |
| Activate production | `production_activation_started`, `production_deploy_planned`, `production_deploy_confirmed`, `production_deploy_failed`, `production_deploy_completed`                   | Project policy and protected deploy result                                        |
| Set up payment      | `card_setup_started`, `card_setup_completed`, `card_setup_failed`, `card_setup_abandoned`                                                                                | Console and the card setup result                                                 |
| Reach a limit       | `limit_warning`, `hard_cap_event`                                                                                                                                        | Exact quota authority                                                             |
| Change plan         | `upgrade_viewed`, `upgrade_previewed`, `upgrade_confirmed`, `upgrade_failed`, `upgrade_completed`                                                                        | Console and the plan change result                                                |

The bounded plan IDs are `relay_free_v1`, `relay_starter_v1`, `relay_growth_v1`, `relay_business_v1`, and `relay_enterprise_v1`. Runtime, provider, guide, and outcome values use reviewed allowlists. Free text is not allowed.

## CLI boundary [#cli-boundary]

The CLI sends no analytics beacon and contains no telemetry client. The planned `control_operation_first_observed` event comes from the first successful authenticated request to the service. It does not show that the user installed the package. The planned initialization event comes only after the service accepts an authenticated initialization request.