Is Relic safe? The facts about the Relic clipboard manager

Relic at a glance

Is Relic open source?

Yes. The Relic apps, the sync server, the on-device AI and the command-line tool are open source under AGPL-3.0 in one public repository, github.com/RelicSync/relic. The encryption package, relic_crypto, is under Apache-2.0 so other projects can reuse it freely.

Every part of Relic builds from that repository with no secret of ours. Official releases are built from tagged commits, and a public workflow builds the same version from the same tag, so anyone can confirm that a release builds from public code.

Two exceptions. On Android, the QR scanner used to pair a new device relies on Google ML Kit, which is not free software. The scanner only runs on the pairing screen, and replacing it is planned. And the screens of the web vault at relic.space/vault are part of the website, which is not in the public repository. The web vault’s encryption code is public.

Is Relic safe to use?

Relic was built for the sensitive things people copy, like passwords, recovery codes and private messages. Here is what Relic’s encryption protects, taken from the threat model in Relic’s SECURITY.md.

• A hacked or hostile server. The Relic server, or your own server if you self-host, stores only encrypted items. Someone who takes over the server gets encrypted data and no content.
• A stolen backup or a legal demand. Relic has no way to decrypt your data, so it has nothing readable to hand over. That also means Relic cannot reset your data if you lose your passphrase.
• Swapped or replayed data.Each encrypted item is tied to its place in your vault, so a server cannot pass one item off as another. Relic’s tests check this.

And here is what the encryption does not protect.

• Malware on your own device. Relic decrypts your items on your device so search is instant and works offline. Malware running as you can read that local copy. Password managers have the same limit.
• A weak passphrase. Relic makes passphrase guessing slow and expensive. A short or common passphrase can still be guessed.
• A lost passphrase and a lost recovery kit. If you lose both, nobody can recover your data, including Relic. Keep the recovery kit Relic gives you at setup.
• Whatever is on your screen or clipboard right now. Once you paste an item, other apps can read the clipboard. Relic marks pasted items as sensitive where the system allows it and clears them on a timer.

For readers who want the details: Relic encrypts with XChaCha20-Poly1305 and turns your passphrase into a key with Argon2id (64 MiB of memory, 3 passes). The full design is in docs/crypto.md, and the technology page walks through how the pieces fit.

Can Relic read what I copy?

No. Relic encrypts each item on your device with a key only you hold, before anything leaves your device. The Relic server stores the encrypted copy. Nothing you copy leaves your device until you turn on sync.

The server does see a few plain details it needs to sync and enforce plan limits: item ids, timestamps, sizes, which items you pinned, each device’s name, platform and app version, your plan, and your account email. On a computer, the device name is the computer’s name unless you rename it in Relic’s settings. The item fields are listed one by one in docs/wire-format.md.

Has Relic had an independent security audit?

Not yet. No outside firm has audited Relic. Here is what you can check today instead.

• Relic’s app and server code is public, including the code that encrypts your data.
• The encryption package ships test vectors. Running dart test in Relic’s crypto folder checks them in a few seconds, with no app build needed.
• The web vault’s encryption is a second, separate implementation in TypeScript, also public, and it is checked byte for byte against the first one.

If you find a security problem, email security@relic.space. Relic has no bug bounty.

Does Relic collect analytics or telemetry?

The Relic apps include no analytics or crash-reporting libraries, because either one could carry what you copied off your device. The apps make two kinds of requests on their own. Relic checks relic.space for updates, and Relic downloads its on-device AI models the first time it runs. Neither request includes anything you copied.

The relic.space website counts visits with Cloudflare Web Analytics, which sets no cookies. The privacy policy lists everything Relic collects.

Is Relic free?

Relic has a free plan. The free plan syncs across 3 devices with up to 250 MB, keeps your last 100 copies and up to 100 pinned items. Pro is $7 a month or $60 a year and keeps everything. Max is $12 a month or $96 a year and adds more storage. Running your own Relic sync server is free, and you can move between your own server and Relic Cloud whenever you like. The pricing section has the details.

Who makes Relic?

Relic is made by Ember Technologies, LLC in Kalispell, Montana. Jordan Gibbs is the founder and builds Relic. Subscriptions are Relic’s only income. Relic shows no ads and sells no data. More on the about page.

Where can I read reviews of Relic?

Relic is young, so there are only a few independent reviews so far. Relic is listed on Product Hunt, AlternativeTo and SaaSHub, where anyone can leave a review. Bug reports and feature requests are public on GitHub.

How does Relic compare with other clipboard managers?

Ditto, Maccy and CopyQ are free, open-source clipboard managers that keep your history on one computer. They are a good fit if you never need sync. Relic is for people who want the same history on every device, encrypted before it syncs. The side-by-side pages go into the details.

Frequently asked questions