Privacy Policy

This policy explains, in plain English, what Reply Monk collects and why, who handles it, how long we keep it and what you can do about it. It covers this website, the Reply Monk web app, the browser extension and the installable phone app.

1. Who we are

Reply Monk ("we", "us") is the service at replymonk.xyz. For any privacy question, or to ask us to act on your data, email support@replymonk.xyz.

2. What we collect

Your account

Your name, email address and sign-in details. If you sign in with a social account, we receive the basic profile details that account shares with us.

What you create and store in Reply Monk

• Drafts and their version history, and past AI generations (your history).
• Your voice: the writing samples you add or import, and the style profile we build from them.
• Memories (facts about you picked up from co-writer chats), your knowledge base, your library of saved posts and hooks, and your personas.
• Scheduled posts, ideas, and the results you type in, import or read from a screenshot.
• Files you upload.

Usage

Counts of what you use (for example replies and posts generated, idea batches, storage) so we can apply your plan's allowance and prevent abuse.

Payments

You enter card details on Stripe's or PayPal's pages, never on ours. We keep the payment provider's customer and subscription IDs and the status of your plan. We do not see or store card numbers.

From the browser extension

• When you ask for a reply, the text of the post or message you are replying to, and the page context needed to write it, is sent to us to generate the reply.
• Diagnostics are on by default. They are reports that a button could not be found on a site, a daily check-in, and error reports. You can switch them off in the extension popup, which stops all of it.
• Off by default: "Log my engagement", "Store my edited text", and "Include email addresses" in webmail replies. Until you switch these on, we do not do those things. With the email setting off, addresses are reduced to first names or "[email]" before text goes to the AI.
• Direct-message history is never saved.

From Telegram (optional)

• Telegram is a channel you choose to connect. We keep the chat ID and your Telegram handle and first name for display, and nothing else about your Telegram account. Disconnecting in Settings, or sending /stop, deletes them.
• Reminders and drafts we send there pass through Telegram and are stored on Telegram's servers. Telegram chats are not end-to-end encrypted. Billing and payment messages are never sent to Telegram.
• If you send the bot a voice note, a photo, a forwarded post or a link, we hold a reference to it for 30 minutes and only download the file after you tap Write it. The file is read by an AI provider and then dropped; we do not store it. We keep the text that came out of it as the source of your draft, and the text of your message for up to one hour so the request can finish.

3. How AI processing works

To write a reply or draft, we send your prompt and the context it needs (for example the post you are replying to, parts of your voice profile, and relevant bits of your knowledge base) to an AI provider. The service uses OpenAI, Anthropic or Google; which provider handles a given request is our choice and can change.

• Voice memo and Telegram voice-note transcription, and knowledge-base search, use OpenAI.
• Audio from voice memos and Telegram voice notes, photos of notes, and screenshots you drop in to read results are not stored.
• What these providers do with data they receive is governed by our agreements with them and their own terms.

Nothing is posted for you. You review every draft and publish it yourself.

4. How long we keep things

• Your content (drafts, history, voice, knowledge, library and so on) stays until you delete it or delete your account.
• Post text captured with a generation (the third-party post a reply was written for) is cleared after 90 days by default. The reply itself is kept.
• Raw usage events are removed 90 days after they have been rolled up into monthly totals.
• Read notifications and payment webhook records are removed after 90 days.
• Data export files are removed 24 hours after they are created.
• Direct-message history is never saved.

5. How we protect your data

• AI provider keys and tokens for connected social accounts are encrypted at rest.
• Sign-in sessions use secure, HTTP-only cookies and last 30 days. The Security page in the app lets you see every signed-in device and sign any of them out.
• Resetting your password signs you out everywhere and revokes your API tokens.
• You need a verified email before you can spend credits.

Your drafts, voice samples and knowledge base are stored in our database in the normal way; they are not end-to-end encrypted. We do not hold a third-party security certification. See the Security page for the full picture.

6. Your choices

• Download your data. In Settings, Profile, you can build a file of everything you own (without credentials). It is available for 24 hours.
• Delete your account. In Settings, Profile. This removes everything you own. If you have an active paid plan, we cancel it first; if we cannot reach the payment provider, the deletion is refused so you are not billed afterwards.
• Payment records. Stripe and PayPal keep their own records as they are required to, and deleting your account does not erase them. These records stay until we remove them by hand; email us if you want that done.
• Emails. Every notification email has an unsubscribe link, and you can set notification preferences and quiet hours in the app. Some notices, such as a failed payment, cannot be switched off.
• Extension. Change the privacy switches in the extension popup at any time.

7. Who else handles your data

We use these types of provider to run the service:

• A hosting provider for the app and database.
• Stripe and PayPal for payments.
• OpenAI, Anthropic and Google for AI processing (see above).
• An email provider to send account and notification emails.
• Optional analytics on this website (Google Analytics), if enabled.

8. Cookies

• In the app: a sign-in cookie that keeps you logged in.
• On this website: optional Google Analytics cookies that measure visits, when analytics is switched on.

9. Children

Reply Monk is not intended for children. We do not knowingly collect data from children. If you believe a child has signed up, email us and we will look into it.

10. Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and, for significant changes, tell account holders by email or in the app.

11. Contact

Questions or requests: support@replymonk.xyz.