Relay uses the browser bookmark permission to read and apply changes locally.
The security boundary
The password saved in your Recovery Kit works across supported clients. Compatible Chromium browsers can use a passkey whose WebAuthn PRF output never leaves the client.
The backend moves encrypted payloads, checks ownership, and enforces plan limits.
Pro Time Machine points are full encrypted vault snapshots, not readable bookmark copies.