The moment you hear "a relayer pays the gas for you", a fair question shows up: if some server is submitting the transaction, what stops that server from pointing the money at itself? It is the right thing to worry about. A gasless system that quietly asks you to trust an operator is not much of an upgrade. So let me walk through why the Damla relayer can be completely untrusted and the money is still safe.
When you create a money link, Damla generates a fresh keypair just for that link. The public address goes on-chain as the owner of the escrowed funds. The private key lives in the part of the URL after the #, which browsers never send to any server. That private key is the whole secret. Whoever holds the link holds the key, and the key is the only thing the contract listens to.
Here is the part that closes the door on theft. To claim, the recipient's browser spins up its own throwaway wallet and produces a signature using the link key. That signature does not just say "release the funds." It says "release the funds to this exact address." The destination is baked into the signed message. The contract checks the signature against the link's public address and confirms the payout target matches what was signed.
The relayer sits in the middle of this and carries the signed message to the chain, paying the gas along the way. But it cannot edit the message. If it swaps in its own address, the signature no longer matches and the contract rejects the whole thing. The relayer's only real power is when to submit, never where the money lands.
You trust math you can verify: an ephemeral key, a signature that binds the payout address, and a contract that refuses to pay anyone else. You do not trust me, and you do not trust the relayer's good behavior. Worst case, a broken relayer means a claim is delayed, and since every link has a 24-hour expiry, the sender can always reclaim from my links. Funds never get stuck and never get stolen. That is the bar gasless should clear, and it is the bar Damla is built to.