Privacy Policy

ReplyCue is a Chrome extension that drafts comments for you to review and post yourself. This policy explains what data it handles. The operator of ReplyCue ("we") is the controller of the personal data described here. Contact: [email protected].

The short version

• ReplyCue reads a page only when you click its button in a comment box.
• It sends what is needed to write that one comment, and we don't store the post or the comment.
• It never posts, likes or browses for you, and it doesn't track the sites you visit.
• We don't sell data, and we don't use it for advertising or to train AI models.

What is sent when you ask for a comment

When you click Generate, the extension collects the following from the page you are on and sends it over an encrypted connection:

• the post text (up to 2,500 characters), its author's name and headline, and the platform it is on;
• one image from the post, resized to at most 512 pixels, if the post has one;
• up to 5 comments visible under the post, and the comment you are replying to, if any;
• any text you already typed in the comment box, and a sentence you selected, if any;
• the tone, length and language you chose, and the language the extension detected for the post;
• your role and custom voice, if you saved them in the extension.

On the Guest, Free and Pro plans this goes to our server, which runs on Supabase in the EU (Ireland), and from there to Anthropic, which writes the comment. Our server checks your plan and your usage, passes the request on and returns the result. It does not save the post content or the generated comment. Anthropic does not use API data to train its models, and deletes it within 30 days unless it is flagged for a usage policy violation or the law requires it to be kept longer.

On the BYOK plan, the request goes directly from your browser to the AI provider whose key you entered (Anthropic, OpenAI, Google or Groq). We don't see it. That provider's own terms and privacy policy apply.

What we keep

• Account. If you sign in with Google, we receive your email address and your Google account identifier. We keep your plan and a count of comments generated per day (Free) or per month (Pro).
• Guests. To enforce the free daily limit without an account, we store a one-way hash of a browser fingerprint and a one-way hash of your network's address range (the first 24 bits of an IPv4 address, or 64 bits of IPv6), with a daily count. We cannot turn these hashes back into your IP address. They are deleted automatically after 30 days.
• Payments. Stripe processes payments and stores your card details. We keep only the Stripe customer and subscription identifiers and your plan status. Stripe sends us billing events so we know when your plan starts, renews or ends.
• Security logs. Our hosting providers keep standard request logs (time, IP address, error codes) for a short period to keep the service running and to stop abuse.

Settings such as your tone, role, custom voice, interface language and any API key you enter for BYOK are stored in your browser's extension storage, not on our servers. Uninstalling the extension removes them.

Why we use it (legal basis)

• To provide the service you asked for, including your account and subscription: performance of a contract.
• To enforce usage limits, prevent abuse and keep the service secure: our legitimate interests.
• To keep payment and tax records: legal obligation.

Who we share it with

We use these service providers, each under a data processing agreement:

• Supabase (database, authentication and server functions, EU region);
• Anthropic (AI model that writes comments on the Guest, Free and Pro plans, United States);
• Stripe (payments and billing);
• Google (sign-in with Google);
• Cloudflare (hosting for this website).

Some providers process data outside the UK and EEA, mainly in the United States. Those transfers rely on the UK International Data Transfer Addendum, the EU Standard Contractual Clauses or the UK-US data bridge, as applicable. We may also disclose data if the law requires it.

Google user data

ReplyCue's use of information received from Google APIs adheres to the Google API Services User Data Policy and the Chrome Web Store User Data Policy, including the Limited Use requirements. We use your Google email address only to create and identify your ReplyCue account.

How long we keep it

Account data, including usage counts, is kept while your account exists. Guest usage counters are deleted after 30 days. Payment records are kept for as long as UK tax law requires (currently six years). When you ask us to delete your account, we delete your profile and usage data within 30 days, except records we must keep by law.

Your rights

Under UK and EU data protection law you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable format. Email [email protected] from the address on your account. We reply within one month. You can also complain to the UK Information Commissioner's Office at ico.org.uk, or to your local data protection authority.

Children

ReplyCue is not meant for anyone under 16, and we don't knowingly collect data from children.

Changes

If we change this policy, we will update the date above. If a change materially affects how we use your data, we will tell you in the extension before it takes effect.