Effective date: October 5, 2026
ZTRelay is owned and operated by MOR-TECH LLC.
This Privacy Policy explains what MOR-TECH LLC ("MOR-TECH," "we," "us," or "our") collects when you use ZTRelay (the "Service"), why we collect it, and what we do — and, just as importantly, what we deliberately do not do — with it. It is incorporated into, and should be read together with, our Terms of Service.
When you register, we collect your username, email address, and a
password (stored only as a salted bcrypt hash, never in plain text).
We generate a public identifier and a
secret_key for API/CLI authentication; only a hash of
the secret_key is ever stored — the plaintext value is
shown to you exactly once and is not recoverable by us.
We do not ask for, and do not collect, your legal name, date
of birth, government-issued ID, physical address, phone number, or
any payment card or banking information — billing runs
exclusively through the cryptocurrency wallet described below, so
none of that ever enters the Service.
Each account has a persistent deposit address on each supported network (Solana, Bitcoin, and Ethereum), generated on our servers; the Bitcoin and Ethereum addresses are created the first time you select that network on the Billing panel. We record your account balance and a full transaction ledger of deposits, plan purchases, and renewal charges (amount, currency, on-chain transaction identifier, and resulting balance) so that billing is auditable. Deposits themselves occur on public blockchains, which are permanent ledgers outside our control — the existence and amount of a transaction to your deposit address is visible to anyone, independent of anything we do. To detect incoming payments we look up our deposit addresses with third-party blockchain data providers, which can see which addresses we are watching but receive none of your account details.
We store the routes you configure (hop count, chosen Exit node and
country, status) and any ._ztr address aliases you create,
including the IPv4 address you mapped, so the Service can resolve
them for you. We also store any public key you submit for
encrypting traffic over the relay, along with proof that you control
the matching private key (a signed challenge, not the private key
itself, which we never see).
To enforce plan data quotas and show you usage in the dashboard, node agents report periodic byte counters (bytes up/down) per route, which we aggregate into hourly and daily totals. This is a traffic volume metric only — it is not, and cannot be reconstructed into, a record of what was transmitted, to where, or in what protocol.
Like virtually any web service, our application servers keep short-lived operational logs of requests made to our website and API — timestamp, requested endpoint, response status, and the requesting IP address — for debugging, rate-limiting, and abuse prevention. This is standard web server logging of requests to our control-plane (registration, login, dashboard, billing endpoints) and is separate from, and unrelated to, the relay traffic described in Section 2 below.
When you log in through the browser, we set a single essential, httpOnly session cookie to keep you signed in; the corresponding session record lives server-side and expires automatically. We do not use third-party advertising or analytics cookies or trackers on this site.
The relay network itself is protocol-blind: every hop forwards encrypted bytes and has no ability to inspect, cache, or log the application-layer content riding on top of your connection, even if it wanted to. Specifically:
._ztr aliases and only know the hop immediately before and after them.This is an architectural property of the Service, not merely a policy choice — but no privacy technology is absolute. See our Terms of Service and the note on the Address Aliases panel regarding services that reveal their own IP by other means (for example, an SSH banner or a command run inside a shared session), which we cannot control or prevent.
We maintain an internal ledger of client and destination IP addresses associated with credible indicators of terrorism, child sexual abuse material, or known malicious/hacking infrastructure, and traffic to or from a listed address may be rejected at the network level. This is an address-based technical control, not an investigation: as described in Section 2, we do not have information capable of identifying who was behind a given connection attempt, so a block cannot and does not get tied to your identity. No record linking an identity to a block event is created, and we do not report blocked attempts to any third party. See our Terms of Service for the full policy.
Exit node IP addresses are shared across users, and their standing with third-party networks and abuse- or spam-block lists affects everyone currently routed through that same exit, not just the user who caused it. Because we deliberately do not log or inspect traffic content (Section 2), our ability to protect an exit's reputation in real time is limited compared to a service with full visibility into what crosses it — that's a trade-off of the privacy design described throughout this Policy. Our Terms of Service accordingly makes users responsible for not damaging a shared exit's reputation, independent of whether the underlying conduct is separately prohibited.
We use the information described in Section 1 to:
We do not sell your personal information, and we do not use it for third-party advertising.
We do not share the information described above except:
._ztr alias you create and hand out yourself.We retain account, billing, and configuration data for as long as your account is active, and for a reasonable period afterward as needed for legal, tax, dispute-resolution, and fraud-prevention purposes. Web/API access logs are retained on a short rolling basis for operational purposes and are not kept indefinitely. Because we do not log relay traffic content or metadata in the first place, there is nothing of that kind to retain or later delete.
You can review and manage your routes, keys, address aliases, and billing
information directly from your dashboard at any time, and you can
regenerate your secret_key or delete individual address
aliases yourself. You can also close your own account at any time from
the Account panel of your dashboard, which immediately deletes your
routes and keys and scrubs your username and email; billing records
tied to the account are kept, with your identity anonymized on them,
for as long as we are legally required or permitted to retain them
(for example, for tax or fraud purposes). If you would rather we
handle this for you, or have any other request about your account
information, contact us at
system@ztrelay.net
or via the Support page.
If you are located in a jurisdiction that grants
you specific statutory privacy rights (such as the EU/UK GDPR or the
California CCPA/CPRA), those rights apply to the extent required by
law, and you may exercise them using the same contact channel.
We use industry-standard measures to protect the information we do
hold, including salted password hashing, hashed (never plaintext)
storage of your secret_key, encrypted transport (TLS)
for traffic to our website and API, and access controls on our
infrastructure. No method of transmission or storage is perfectly
secure, and we cannot guarantee absolute security; you play a role
too — keep your password and secret_key confidential,
and use a unique password for your account.
The Service is not directed to, and we do not knowingly collect personal information from, anyone under 18 years of age. If we learn that we have collected information from a child under 18, we will delete it.
We may process and store information in the United States or other countries in which we or our service providers operate. By using the Service, you consent to the transfer of information to countries that may have different data protection rules than your own.
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Effective date" above and, where practical, provide additional notice. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.
Questions about this Privacy Policy, or requests regarding your information, can be sent to system@ztrelay.net or via the Support page. MOR-TECH LLC is the data controller for the information described in this policy.