How we protect your account and your data

Last updated 30 October 2026

These are the questions people ask us most about safety, with short, plain answers. We only write what we have checked. If something is not covered here, we do not claim it.

Is my password safe?

Your password is stored scrambled, in a way that cannot be turned back into the original. Even we cannot read it. A password must be at least 10 characters long, and new passwords are checked against public lists of passwords that have leaked from other websites. The sign-in page also has a Cloudflare check that helps tell people from robots. Please use a password you do not use anywhere else.

Can someone post for me without my say?

Posts only go out when you, a team member you invited, or a tool you connected schedules them. A tool means an API key you made or an AI assistant you linked. LazyRelay can only post to accounts you connected yourself.

An API key works like a password: whoever holds it can act as your account. Keep it private, and revoke it under More, API Keys if it leaks.

If you turn on two-factor sign-in, a stolen password alone is not enough to get into your account.

What if my account is hacked?

Do these things, in this order:

1. Change your LazyRelay password. On the sign-in page, choose "Forgot password?".
2. Turn on two-factor sign-in (More, Settings, Security).
3. Disconnect your social accounts in LazyRelay (Connections, then Manage connections). Then remove LazyRelay in each platform's own settings too.
4. Revoke any API key you do not recognise (More, API Keys).
5. Change the passwords of your social accounts if you think they were reached.
6. Email [email protected] and tell us which accounts are affected.

Who can see my posts and pictures?

You can, and so can the team members you invite. Other customers cannot: each customer's data is kept apart, and only our own servers can change it.

Two things are public on purpose. Once a post is published, it is as public as that platform makes it. And a picture or video you upload has to be reachable by the platform so it can publish it, so it sits at a random web address that is hard to guess, and anyone who has that exact address can open it. The file is deleted once the post using it has gone out. It is kept longer only while another post still needs it.

If you make a Bio Page, a proof link or a client review link, anyone with that link can see what it shows.

Do you store my card?

No. Card payments are handled by Paddle, who sells to you as the merchant of record. You type your card details on Paddle's payment screen, not on ours, and LazyRelay's database has no fields for card numbers. Paddle sends you the receipt.

What happens when I disconnect an account?

We stop using that account straight away. Posts waiting for it will not go out, and the login we held for it is wiped. Posts that already went out stay on the platform.

For most platforms you sign in on the platform's own screen when you connect, so we never see your password for it. We receive a login key instead and keep it in a separate locked store, not in ordinary tables. Only our own servers can open that store.

A few platforms work differently. On Bluesky or Lemmy you type a password into LazyRelay once, we swap it for a login key, and we do not keep the password. On others, such as Telegram or WordPress, you paste a key or app password from that platform.

Disconnecting here removes our copy of the login. It does not tell the platform to cancel it, so also remove LazyRelay in that platform's own settings (its connected apps or security page) to be sure.

Can I get my data deleted?

Yes. You can disconnect any platform yourself at any time. To delete your whole account and its data, email [email protected] from the address on your account with the subject "Delete my account". There is no delete button yet. We check that the request really comes from you, then remove your data. Records the law makes us keep, such as sales records for tax, stay.

Pictures and videos are deleted once the post using them has gone out. The full details are on our Data Deletion page.

Is there two-factor sign-in?

Yes, and it is optional. Turn it on under More, Settings, Security. Scan the QR code with an authenticator app (such as Google Authenticator or Authy) and enter the 6 digit code. LazyRelay then shows you 10 recovery codes, once. Keep them safe: each one lets you back in if you lose your phone.

With two-factor sign-in on, a stolen password alone is not enough, even for someone who talks to our servers directly instead of using the website. It is not switched on for you, so you need to turn it on yourself. If you lose both your phone and your recovery codes, email [email protected].

Do you sell my data?

No. We do not sell your data. We share it only with:

• the platforms you connect, to publish your posts;
• companies that run our service for us, such as hosting, email, payments and the AI features you choose to use;
• our analytics provider, only if you accept analytics cookies;
• the authorities, when the law requires it.

Our Privacy Policy has the full wording.

Who at LazyRelay can look at my account?

Our team and our own admin tools can reach customer accounts. The admin tools need a private admin key, every use is written to a log, and the key switches itself off if it is used outside the approved routine.

Ray, the chat helper, can see only your plan, your connected platforms and your recent failed posts, and only while you are signed in. He cannot see anyone else's data. Nobody can read your password, because it is stored scrambled.

Is the connection to LazyRelay private?

Yes. Our website and our servers use HTTPS, which means the connection is encrypted. If someone types an address that starts with http, they are sent on to the https one.

I have a technical security question

Some questions need an exact answer from a person who knows the field: how encryption is set up, test results, diagrams, security forms, lists of the companies we use, or where data is stored. A person on our team answers those personally. Email [email protected].

No online service can promise that nothing will ever go wrong. If something on your account looks wrong, email [email protected] and tell us what you see. See also our Privacy Policy and Data Processing Agreement.