Privacy Policy
This policy describes data handled when you connect ChatGPT to a paired device through Farah Relay.
Data we handle
- Account identity: immutable GitHub numeric user ID and, when supplied, login, display name, and email metadata.
- OAuth records: client/scopes and token lifecycle metadata. Relay access and refresh tokens are stored server-side as hashes, not plaintext.
- Devices: device ID, label, credential hash, last-seen time, and revocation state. The plaintext device credential remains on the paired device.
- Relay request content: queued actions can contain relative workspace paths, patch old/new text, allowlisted command lines, and agent prompts. Read results can contain requested file content.
- Safe results: bounded status/result data. Public relay results deliberately withhold raw command stdout/stderr.
- Security events: timestamp, event/outcome, internal IDs when applicable, and a bounded reason category. Raw request bodies, OAuth codes, device credentials, PKCE values, token values, and raw error strings are not audit fields.
Network addresses
Request IP addresses are used transiently in memory as rate-limit keys. Raw IP addresses are not written into Farah Relay security audit events by the current implementation.
Authentication
GitHub is used for identity. A GitHub access token obtained during sign-in is used to retrieve identity and is not persisted by Farah Relay after that lookup. ChatGPT/OpenAI separately processes data under OpenAI's own terms and privacy policies.
Current lifetimes and cleanup
| Record | Protocol lifetime |
|---|---|
| OAuth access token | 15 minutes |
| OAuth refresh family | Up to 30 days |
| OAuth authorization code | 5 minutes |
| OAuth transaction | 10 minutes |
| Device pairing session | 5 minutes |
| Relay call envelope | 4 minutes |
Expiration stops validity or dispatch; it is not a promise of immediate physical deletion. Expired and terminal records are eligible for bounded cleanup and may remain until maintenance cleanup runs. Account/device metadata can persist while the account/device exists or until deletion is requested.
Use and sharing
Data is used to authenticate, pair and route devices, execute requested workflows, recover durable results, prevent abuse, troubleshoot, and secure the service. Farah Relay does not sell personal data or use relay content for advertising. Service infrastructure providers may process data as necessary to operate the service.
Your controls
- Revoke a paired device to invalidate its credential.
- Remove the local device identity when no longer needed.
- Request account/data deletion through Support. Minimal records may be retained when required for security, legal compliance, or disputes.
Security
The service uses HTTPS, hashed server-side credentials/tokens, scoped OAuth, tenant ownership checks, bounded request sizes, rate limits, and device-side policy enforcement. Do not submit secrets in support requests.
Contact
For privacy questions or deletion requests, use the Farah Relay support process.