Privacy policy

Who runs this

ReplyHey is run by a person. You can contact us at d@devkonic.com with questions, requests or complaints about anything on this page.

What the web app collects

Your account. Your email address and sign-in details, held by Clerk, our authentication provider. ReplyHey never sees or stores a password.

What you tell us to watch. The website addresses of your products, the keywords and subreddits you choose, and the settings on those.

Public posts we find for you. ReplyHey reads public posts on Reddit, X and LinkedIn that match your keywords, and stores the post title, the body, the public author name, the link and the time it was posted. This is public material, gathered from public pages and search interfaces. We do not collect anything from a private account, a private group or a direct message.

The drafts. The reply and the direct-message draft an AI model writes for each post, plus a relevance score and the short reason behind it.

Billing. Stripe handles your card. ReplyHey stores the subscription status and a Stripe customer ID, never a card number.

Usage and advertising. The replyhey.com website runs Dashi Metrics and Google Analytics, both of which record pages viewed, referrer and approximate region. It also carries the Reddit advertising pixel, and reports sign-ups and subscriptions back to Reddit Ads so we can tell which adverts worked. That is the one place a third party learns something about your visit for its own purposes, and it is confined to the public marketing pages and the sign-up flow. The browser extension carries none of it.

What the browser extension collects

Almost nothing, is the short answer. ReplyHey Autopilot has no third-party analytics, no tracking and no server of its own. It talks to replyhey.com, and to Reddit when it posts or looks up a post for you, using your own signed-in session. It counts itself when it is installed, when it is updated and when you save an API key, and everything else it keeps is kept in your own browser.

Held in your browser only (Chrome’s local extension storage, never uploaded anywhere but replyhey.com): your ReplyHey API key, the work list ReplyHey last sent it (the drafts to send, the promo threads and the weekly posts, with which platforms this browser is signed in to), your Reddit, X and LinkedIn account names as ReplyHey has them, the flair you picked for each subreddit, a record of recent attempts (lead IDs with times) so nothing is sent twice, the pacing it was given, when it last sent, whether sending is stopped, error counts, the last status line the panel showed you, your panel preferences (theme and which tab is open), and a random ID the extension gives itself so one install is not counted twice. Removing the extension deletes all of it.

Sent to replyhey.com: your API key, so the server knows whose leads to hand over; the ID of each lead it sends; and, afterwards, whether that send succeeded, with the link to what it posted and, for a weekly post, any error from its first comment. If a send failed, it also sends which step failed and the error text. That last part is how we find out that Reddit has moved a button. It carries no page content.

The install count. When the extension is installed or updated it sends replyhey.com that random ID and its version number, so we know how many browsers are running it and which build. It sends the same two things again if you save an API key, which is what tells us an install got as far as working. There is nothing else in that message: no name, no address, no page, no machine or profile detail, and nothing that outlives the extension — reinstalling gives you a new random ID.

Sent to Reddit, X or LinkedIn: the draft you approved or Autopilot picked, posted from the account that browser is already signed in to. That is the entire interaction. The extension never asks for a password, never signs in as you, never reads your feed, your messages or your other tabs, and only posts what your ReplyHey settings allow: drafts you approved in the ReplyHey app, or what Autopilot picks while you have it on there.

The pages it can read. The extension can run on reddit.com, x.com and linkedin.com, because that is where a reply has to be typed. It uses one background tab for a run, opens each lead in that tab itself, and closes it when the run ends. It has no access to any other website, and it never reads a tab you opened.

Whether you are signed in. The Settings screen lists Reddit, X and LinkedIn with a tick against each one this browser has a session for, so a send that fails because a login expired says so instead of leaving you guessing. It answers that by asking Chrome whether three cookies exist — reddit_session, auth_token and li_at — and it uses only the answer. The cookie itself is never stored, never read for what is in it, and never sent to us or to anybody else. Nothing checks it while a send is running.

Sending and the panel. The extension sends what you approve in the ReplyHey app, or what Autopilot picks while you have it on there, from your own accounts at the pace you set there. With Autopilot on it can also post free promo threads and publish your scheduled weekly posts, if you switched those on. It checks in every few minutes and carries on with the side panel closed. The panel has a Sending tab, which shows status and a Stop button that ends sending at once, and a Calendar tab, which lists your weekly posts. A Reddit weekly post can be posted from there with Post now, after you choose its flair and confirm. Every other setting lives in the ReplyHey app.

Why we are allowed to hold it

To provide the service you asked for, which covers your account, your sites, your leads and your drafts; and our legitimate interest in keeping the product working and unabused, which covers error reports and basic analytics. If you are in the EEA or the UK, those are Article 6(1)(b) and Article 6(1)(f) respectively.

Who else sees it

Only the companies that run parts of the product, and only what each one needs: Clerk (sign-in), Neon (the database), Vercel and Hetzner (hosting and the scheduled fetches), Stripe (payments), Resend (the email digest), SocialCrawl and Scrape.do (reading the public posts), Google and OpenRouter (the AI models that score a post and draft a reply), Crew chat (what you ask the crew goes to an AI model through our LLM gateway, with the account data it needs to answer), and the analytics and advertising services named above. That is the whole list. We do not sell or rent your data to anybody.

How long it is kept

Your account data lasts as long as your account. Leads are kept while they are useful to you and are removed with the site they belong to. Delete a site in the app and its leads and drafts go with it, immediately. Ask us to close your account and everything else follows within 30 days, apart from what we must keep for tax and accounting.

Your choices

You can see, correct, export or delete your data — ask, and it is done. You can turn the email digest off in Settings. You can revoke an API key in Settings, which cuts off any extension or AI client holding it. You can remove the extension at any time, which deletes everything it stored. If you are in the EEA or the UK you also have the right to complain to your data protection authority.

Children

ReplyHey is a business tool and is not for anyone under 16.

Changes

If this page changes in a way that matters, the date at the top changes and existing customers get an email. Small corrections just move the date.

Back to ReplyHey