Privacy policy

1. What we collect

Your account: email address, name (if you sign in with Google), and your plan and trial status.

Your product profile: the website you enter, the description, keywords and subreddits you choose, your reply drafts, lead notes and settings.

Your Reddit connection: if you connect Reddit, your Reddit username, karma, account age and OAuth tokens. Tokens are encrypted at rest (AES-256-GCM). We never see your Reddit password.

Public Reddit content: posts that match your keywords (title, text, author username, link, score), and the status of comments you posted through Karmaquill.

Billing: handled by Stripe. We store only your Stripe customer id, never card details.

2. How we use Reddit data

Reddit content is used only to show you relevant threads, draft reply suggestions and track your own comments, and only inside your private account. We follow Reddit's Responsible Builder Policy and Data API Terms.

Retention: Reddit content you don't act on is removed from our systems within 48 hours; we keep only the post id and our relevance score. Threads you act on (drafts, posted replies, leads in progress) are re-checked against Reddit at least daily, and content or author details deleted on Reddit are removed from Karmaquill.

We do not sell, license or share Reddit data, use it for advertising, use it to train AI models, or use it to infer sensitive characteristics about anyone.

We never post, vote or send messages without your explicit action. Replies are posted from your account only after you approve them, and private messages are only suggested when the other person asked to be messaged, and are always sent by you on reddit.com.

3. AI processing

To score threads and draft replies and messages, we send the relevant text (your product profile and the thread) to our AI provider, Anthropic (Claude API). This is for generating a response only; it is not used to train models.

4. Service providers

We use a small number of providers to run Karmaquill: hosting and database, email delivery (sign-in links and the daily digest), Stripe (payments), Anthropic (AI), and Reddit (via its official API). Each receives only what it needs to provide its service.

5. Cookies

We use one essential cookie to keep you signed in, plus a short-lived cookie while you connect Reddit. No advertising or tracking cookies.

6. How long we keep your data

Reddit content: see section 2. Your account data: for as long as your account is open. When you delete your account, we delete your data within 30 days, except billing records we must keep by law.

7. Your choices and rights

You can disconnect Reddit at any time in Settings, which deletes your stored tokens. To access, correct, export or delete your data, email [email protected]. Depending on where you live (for example the EU/UK under GDPR), you may also have the right to object to processing or complain to your data protection authority.

8. Changes

If we change this policy materially, we'll tell you by email or in the app before the change takes effect.