Privacy, in plain language.

Information we process

We process your email address, authentication records, workspace name, uploaded documents and their extracted text, public page URLs and saved page text, original questionnaire spreadsheets and cell mappings, questions, answers, citations, approval history, usage totals, and feedback. Supabase handles passwords and optional authenticator verification; ReplyProof does not store readable passwords. Essential, HTTP-only cookies keep you signed in. We do not add advertising trackers or sell customer content.

Why we use it

We use this information to provide the service, isolate workspaces, prepare and verify drafts, enforce trial and spending limits, troubleshoot errors, respond to support requests, and prevent abuse. Operational logs store routes, status codes, timing, and sanitized error categories rather than document contents or passwords. Abuse monitoring links request counts, denied actions, and AI usage totals to your account so the owner can review unusual activity. These warnings do not include your document text or prompts and do not automatically ban accounts. The owner can receive a generic email notification directing them to the private console; the email contains no flagged customer identity or content.

Public page sources

If you preview a public link, ReplyProof contacts the website and a public DNS resolver to read that page. We do not send your account identity, cookies, or sign-in credentials to the website. Previewing does not send the text to OpenAI. When you add the source, we save a dated copy and may send its text to OpenAI for indexing and drafting, just like uploaded sources. Saved pages do not update automatically. Only use public pages you are authorized to use; do not submit private sharing links.

Feedback and support

Feedback reports contain the message you submit, your verified account email when signed in (or an optional unverified reply address), and the page and workflow step if you choose to include them. We do not automatically attach documents, answers, screenshots, full URLs, or browser logs. The owner can assign priorities and add internal notes. Feedback does not trigger AI actions or automatic email replies. One-way, date-scoped IP hashes help rate-limit signed-out reports; raw IP addresses are not stored by this feedback feature.

Service providers

Cloudflare hosts the application and stores workspace data in D1 and R2. Supabase manages authentication in a US East project. OpenAI processes source passages for search embeddings and relevant passages with questions for drafting. Authentication emails are delivered through the configured email provider. These services may process information in the United States and other locations under their own infrastructure arrangements.

OpenAI API data is not used for model training by default. ReplyProof requests store: false for generated responses. That does not eliminate OpenAI’s separate abuse-monitoring retention, typically up to 30 days. Do not upload material requiring zero retention.

Optional analytics

If you choose “Allow analytics,” ReplyProof also records fixed page names, action types, a broad referral category (such as LinkedIn or Reddit), and heartbeat times while a tab is visible. A daily hash of a random tab identifier estimates visits and active sessions; it is not linked to your account. Raw traffic events expire after approximately 30 days and recent-session records after approximately one day, with bounded cleanup during traffic ingestion and owner report requests. Rate limiting uses date-scoped IP hashes, not stored raw IP addresses. Separately, authenticated activity timestamps and new-workspace counts are essential operational records. We use Google Analytics to measure page visits and product actions using pseudonymous browser identifiers. Google receives browser and device information and processes connection data when its tag loads. Our events use fixed page names and action labels, not your email address, workspace identity, document names or contents, questions, answers, or form values. Advertising personalization and Google signals are disabled in our tag. Analytics is optional and is not needed to use ReplyProof. You can reject it or withdraw your choice using Cookie preferences on any page. Withdrawing consent stops further collection on that browser and removes our Google Analytics cookies; it does not erase data Google already received. Analytics cookies expire after up to 90 days. Auth callback and recovery links containing private parameters are excluded.

Payments

If you subscribe, Stripe collects and processes your payment and billing details on its hosted checkout and billing portal. ReplyProof stores Stripe customer and subscription identifiers and subscription status, not your full card number or card security code. Stripe maintains payment records under its own retention requirements.

Security and access

Cloudflare provides encryption at rest, and HTTPS protects transit. Server-side account checks restrict workspace access. This is not end-to-end encryption. The owner dashboard shows account and usage metadata and submitted feedback. Infrastructure access is limited to authorized administration; it is not a promise that the operator can never access stored data.

Retention and deletion

Your workspace content remains available until you delete it. Removing a source deletes its active file and searchable chunks; quoted evidence already attached to an answer remains in that questionnaire until the questionnaire or workspace is deleted. Deleting a questionnaire removes its original uploaded spreadsheet and questions. Workspace deletion removes active uploaded files, extracted text, questions, answers, activity, and feedback. It does not immediately erase infrastructure backups or provider-retained records, which expire under provider retention settings.

Deidentified spending records remain to preserve budget accounting. A hashed account identifier supports a 90-day period to prevent repeated free-trial resets. Expired identifiers are removed during subsequent application cleanup. Application error records and aggregate request metrics are kept for approximately 30 days, with cleanup performed during subsequent application activity. Abuse warnings and review notes are kept for up to approximately 90 days, and short-window activity counters for approximately 24 hours, with cleanup during subsequent application activity. Workspace deletion removes these account-linked monitoring records. If an account is banned, a minimal hashed account identifier and restriction date remain until the restriction is lifted to prevent recreating the workspace to evade the ban. Owner action records are retained for administrative accountability. Your Supabase sign-in account remains after workspace deletion; request its removal from Account settings. Identity verification may be required.

Signed-out feedback and its internal notes are removed after approximately 90 days during subsequent application cleanup. Signed-in feedback and related internal notes are removed with workspace deletion. Hosting providers may retain infrastructure logs under their own policies.

Your choices

Download workspace data from Account settings and source files and saved page copies from Knowledge. You can delete questionnaires, remove sources, or delete the workspace. For access, correction, account removal, or privacy questions, use Account settings and select “Privacy or account removal.” Rights available to you depend on your location.

Changes to this notice

We will update this notice when our practices change. Material changes that affect your use of the beta will be communicated through the service.