Privacy Policy

Introduction

Welcome to ReplyPilot — a Reddit growth workspace: a Chrome extension that finds relevant conversations, drafts replies that follow each subreddit's rules, and keeps you in control of what gets posted, together with its companion website (https://xmhreal.lol, the "Site"). ReplyPilot is operated by an independent developer (referred to as "we" or "us"). Your privacy matters to us. This policy explains how we collect, use, store, and protect your information when you use the extension and the Site.

Last updated: 2026-09-17

Information We Collect

1. Account Information

   • What: Your email address, display name, and avatar (from email/password sign-up, or provided by Google when you sign in with Google).
   • Why: To create and manage your account, authenticate you, send verification and password-reset emails, and provide support.

2. Credits & Usage Records

   • What: Your credit ledger — grants, consumption, and refunds (e.g., keyword searches, AI drafts, subreddit knowledge learning), plus order/payment records once payments are enabled.
   • Why: To track balances, prevent double charging, auto-refund on failures, and provide billing history.

3. Reddit Content Processed by the Extension (Important)

   • What: When you use the extension to draft a reply to a post or comment, the title, body, and relevant comment text of that thread are sent to our servers and forwarded in real time to AI providers to generate a draft. The same applies when you use the writing studio.
   • What we do NOT do: We do not collect your Reddit browsing history, we do not store the thread content you draft from, and the extension will never submit, post, or send anything on your behalf — every reply is placed into the Reddit comment box for you to review, edit, and send manually.

4. Reddit Sign-in State Check

   • What: When you use extension features that need to know whether you are logged in to Reddit, the extension makes a read-only request to Reddit from your browser. We never receive or store your Reddit password or session token.
   • Why: To tell you whether you are signed in, and to keep drafts and account-risk warnings accurate.

5. Subreddit Knowledge

   • What: Distilled summaries of a subreddit's official rules, unwritten norms, and writing style, learned from public subreddit pages at your request. Knowledge is shared across the workspace so the same subreddit is not learned twice, and it is not tied to your individual identity in the stored record.
   • Why: To generate drafts that respect each community's rules and tone.

6. Product Profiles

   • What: The product description, audience, keywords, and subreddit lists you configure in the dashboard.
   • Why: To score new posts during opportunity scans and to target monitoring.

7. Comment Tracking Records

   • What: The identifiers of replies you have chosen to track, used for anonymous visibility checks (whether the comment is still publicly visible).
   • Why: To show you whether your replies survived moderation, without accessing your Reddit account.

8. AI Provider Keys (BYOK)

   • What: If you connect your own AI provider key (paid plans), the key is stored encrypted and used only to make requests on your behalf.
   • Why: To let AI actions run on your own provider account and skip credit costs.

9. Cookies & Sessions

   • What: Session cookies that keep you signed in.
   • Why: To keep you logged in across the Site and the extension.

10. Watch Keywords

    • What: The keyword list you actively configure in the extension (synced only while signed in; deletable anytime in the extension).
    • Why: To sync your watch configuration across devices and mark keyword matches in search results and post pages.

11. Technical Information

    • What: Basic request information such as IP address and browser type (logged by default by our infrastructure provider).
    • Why: Security protection and troubleshooting.

Third-Party Services & Data Forwarding

To operate the service, we forward necessary data to the following providers; their handling of data is governed by their own privacy policies:

Except as described above or required by law, we do not sell or share your personal information with anyone else.

Data Storage & Security

Data is stored on Cloudflare infrastructure (database and cache), and transmitted over TLS. We apply access controls to prevent unauthorized access. However, no method of transmission over the Internet or electronic storage is 100% secure.

Data Retention & Deletion

• Account information and credit ledgers are retained while your account exists.
• Thread content and AI drafts are processed in real time and are not persisted.
• Subreddit knowledge profiles are retained while they are useful to the workspace, and can be refreshed or removed on request.
• Stored AI provider keys are deleted when you disconnect them.
• You may request deletion of your account and associated data at any time via the contact below; we will process it within a reasonable period.

Changes to This Policy

We may update this policy from time to time and will post the new version on this page, updating the "Last updated" date above. Significant changes will be highlighted.

Contact Us

Questions about this policy or our data practices:

• Operator: ReplyPilot (independent developer)
• Website: https://xmhreal.lol
• Email: [email protected]

By using ReplyPilot, you have read and agree to this privacy policy.