Security & privacy
What we store, and what we don’t claim.
A plain account of how Reply Monk handles your writing, your sign-in and your payments, including what is not in place yet.
Page last updated 8 November 2026
What we store
Your content lives with your account
Everything you create is tied to you, private by default, and removed when you delete your account.
| Area | What it includes |
|---|---|
| Account | Name, email, sign-in details, plan and usage counts. |
| Your writing | Drafts and versions, AI history, voice samples and style profile, memories, personas. |
| Your sources | Knowledge base, saved posts and hooks, uploaded files. |
| Your plan for posting | Scheduled posts, ideas, and results you type in, import or read from a screenshot. |
| Payments | Stripe or PayPal customer and subscription IDs, and plan status. Never card numbers. |
| Not stored | Voice memo audio, results screenshots, direct-message history. |
Text of a third-party post saved with a generation is cleared after 90 days by default; the reply is kept. Raw usage events, read notifications and payment webhook records are removed after 90 days, and data export files after 24 hours.
Extension
What stays off until you turn it on
The browser extension keeps its switches on your device. These are the defaults.
-
Log my engagement
Off by default. Your replies are not logged unless you switch this on.
-
Store my edited text
Off by default. The text you edit is not stored unless you switch this on.
-
Include email addresses
Off by default. Without it, addresses in webmail replies are reduced to first names or “[email]” before text goes to the AI.
-
LinkedIn-safe mode
On by default for new installs. The extension adds nothing to LinkedIn until you opt in after a risk notice.
-
Send diagnostics
On by default. Selector-miss reports, a daily check-in and error reports. Switching it off stops all of it.
How AI processing works
Prompts go to an AI provider to write your draft
To write a reply or a draft, Reply Monk sends your prompt and the context it needs, such as the post you are replying to, your voice profile and relevant parts of your knowledge base, to an AI provider. The service uses OpenAI, Anthropic or Google. Voice memo transcription and knowledge search use OpenAI.
- Voice memo audio and results screenshots are not stored.
- Links and email addresses the AI invents are removed from its output.
- If the provider never answers, your credit is returned.
- Nothing is posted for you. You approve and publish every draft.
Account security
Control over who is signed in
-
Sessions you can see and end
Sign-in uses secure, HTTP-only cookies that page scripts cannot read, and sessions last 30 days. The Security page in the app lists every signed-in device and lets you sign one out, or all of them.
-
Verified email
You need a verified email before you can spend credits, which helps keep bots out.
-
Password reset
Resetting your password signs you out everywhere and revokes all your API tokens. Reset links expire after an hour.
-
API tokens
Only a hash of each token is stored and the token is shown once. You choose its scopes and expiry (7, 30, 90 or 365 days, or none) and can revoke it any time.
-
Encrypted keys and tokens
AI provider keys and tokens for connected social accounts are encrypted at rest. Keys are shown masked.
Payments
Card details never reach us
You enter card details on Stripe’s or PayPal’s own pages. Reply Monk keeps only the customer and subscription IDs and your plan status. Stripe payments are confirmed by signed webhooks, PayPal payments by PayPal’s own verification, and we never trust the browser’s “success” page to decide whether you paid.
See the refund policy for how cancelling works.
Your controls
Take your data or leave
-
Download your data
Settings, Profile builds a file of everything you own, without credentials. It is available for 24 hours.
-
Delete your account
Removes everything you own. An active paid plan is cancelled first. Stripe and PayPal keep their own payment records.
-
Unsubscribe
Every notification email has an unsubscribe link, and you can set preferences and quiet hours in the app.
What we don’t claim
Things that are not in place yet
- There is no SOC 2 report or other third-party security audit.
- Two-factor sign-in is not available yet.
- Content is not end-to-end encrypted.
- We do not claim zero data retention. See the retention periods in the privacy policy.
- Platforms such as LinkedIn restrict third-party tools. Safe mode reduces that risk; it does not remove it.
- Revoking a session can take a few minutes to take effect everywhere.
Report a problem
Found something that looks wrong?
Tell us what you saw and how to reproduce it.
Wondering who reads these? Read about who runs Reply Monk.
Does Reply Monk post for me?
No. It writes drafts and reminds you when to post. You review every draft and publish it yourself, and the extension only puts a draft in the box.
Are my drafts end-to-end encrypted?
No. Drafts, voice samples and knowledge are stored in our database in the normal way. Only credentials such as provider keys and connected-account tokens are encrypted at rest.
Is my data used to improve AI models?
We can’t give a blanket promise on this yet. Your prompts go to the AI provider that handles the request, and what that provider does with them is covered by our agreements with them.
Is Telegram private?
It is optional. Messages we send there are stored on Telegram’s servers and are not end-to-end encrypted, and billing messages never go there. Voice notes and photos you send are read for one request and not stored by us. You can disconnect any time in Settings or with /stop.
How do I delete my data?
In Settings, Profile, you can download everything you own and delete your account. Deleting removes your content and cancels any active paid plan first.
Show up this week, in your own voice.
Set up your voice in a few minutes, then write your first post or reply. You stay in control of every word.
Free plan · 20 replies or posts a month · No card needed