Privacy Policy

Last updated: July 2026

AI Reply Writer (“we”, “us”, “the Service”) provides a Chrome extension and a web app that help you draft and summarize replies on the sites you already use. This notice explains what we collect, why we collect it, who else sees it, and the choices and rights you have. We have tried to describe what the product actually does rather than list every possibility, so you can tell what applies to you.

If you do not agree with this notice, please stop using the Service. Questions at any time: support@aireplywriter.com.

Contents

1. Who we are
2. What information we collect
3. How we use your information
4. AI processing of your content
5. The Chrome extension and its permissions
6. Cookies and local storage
7. Who we share information with
8. International transfers
9. How long we keep information
10. How we keep information safe
11. Your privacy rights
12. California residents (CCPA/CPRA)
13. Do-Not-Track signals
14. Children
15. Changes to this notice
16. How to contact us

1. Who we are

AI Reply Writer operates the website https://aireplywriter.com, the web app, and the “AI Reply Writer” Chrome extension. For data-protection purposes we are the controller of the personal information described here.

To be completed: insert the registered legal entity and postal address that operates the Service. Data-protection law requires the controller to be identifiable, and the Chrome Web Store asks for it too.

Contact for any privacy matter: support@aireplywriter.com.

2. What information we collect

Account information. Sign-in is handled by Clerk, our authentication provider. When you register — with an email and password, or with “Continue with Google” — Clerk passes us your email address, a unique account identifier, and, if you used Google, the name and profile picture on that Google account. We never receive or store your password, and signing in with Google gives us no access to your Gmail, Drive, contacts, or any other Google service.

Content you submit for drafting. To generate or summarize a reply, the extension or app sends the text you have chosen — the conversation, post, comment, review, or page content you are replying to or asking about — and any images attached to or appearing in that content, to our server, which forwards it to an AI model provider to produce your result. We do not store the body of this content in our database after your result is returned, we do not sell it, and we do not use it to build advertising profiles or to train our own models.

Diagnostics from the extension. So we can tell when a button stops appearing after a website changes its layout, the extension reports events describing what happened, not what you wrote: the platform (for example “Gmail”), the button or anchor position involved, whether it succeeded, an error category and message, the model used, an HTTP status, the extension version, the URL of the page the event happened on, and your account id and email if you are signed in.

Usage records. For each generation we record which model was used, whether it counted as a regular or advanced request, whether it came from the web app or the extension, how many credits it consumed, and whether it succeeded. This is what enforces your plan’s monthly allowance.

Approximate location and timezone. To show times correctly and set sensible defaults, the extension asks the free service ipwho.is for the timezone, city, and country associated with your IP address. Your IP address is visible to that service when this happens. The result is cached on your own device and refreshed occasionally; we do not store it in our database. If the lookup fails or is blocked, the extension falls back to your device’s own timezone and nothing is lost.

Support tickets. If you report an issue or send an enquiry, we store the name, email, and message you provide so we can reply and keep a record.

Billing. If you buy a paid plan, Stripe collects and processes your payment details and we store only an identifier linking your account to your Stripe customer and subscription status. We never see or store full card numbers.

3. How we use your information

We use the information above only for the purposes below. For people in the UK, EEA, and Switzerland, the “legal basis” column is the ground we rely on under the GDPR.

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not use your submitted content for marketing. Where we rely on legitimate interests, you can object — see section 11.

4. AI processing of your content

Generating a reply requires sending your selected content to an AI model. Depending on the model you pick, that is:

• Google (Gemini API) — for the Gemini models.
• OpenRouter — which routes the request onward to the provider that serves the model you chose, such as OpenAI or Anthropic.

These providers process your content to produce the response and handle it under their own terms and privacy policies, which we encourage you to read. We do not control their internal retention. We ourselves do not retain the content of your requests after returning your result, and we never use it to train models.

Please treat AI output as a draft. It can be wrong, and you should read anything before you send it. Avoid submitting content you are not permitted to share with a third-party processor — for example material covered by a confidentiality obligation, or special-category data such as health information.

5. The Chrome extension and its permissions

The extension asks for only what it needs, and Chrome shows you each permission before you install:

• Access to the listed websites — so it can place the “AI Reply” button in the right place and read the specific conversation you ask it to draft a reply for.
• activeTab and scripting — so that when you click the toolbar icon, it can open the on-page assistant and read the current page’s text to answer your question.
• storage — to remember your preferences, the cached timezone lookup, and the link to your account.
• alarms — to schedule routine background upkeep, such as refreshing your plan status.

The extension reads page content only in response to something you do — clicking the AI Reply button or the toolbar icon — and only to produce the result you asked for. It does not run in the background collecting the pages you visit, and it does not read pages on websites outside its listed set. Our AI provider keys stay on our server and are never exposed to the websites you visit or stored in the extension.

A note about Gmail specifically. The extension works on Gmail the same way it works on any other supported website: through a content script on mail.google.com that runs when you use it. It does not use the Gmail API, requests no Gmail OAuth scopes, cannot read your mailbox in the background, cannot access your archive or history, and cannot send email on your behalf. If that ever changes, this notice will be updated before the feature ships.

6. Cookies and local storage

We keep this deliberately small. Our authentication provider sets a session cookie so you stay signed in — this is strictly necessary and the Service cannot work without it. The website and extension also use your browser’s local storage to remember preferences such as your chosen language, theme, and text size, and to cache the timezone lookup described above. We do not use advertising cookies, third-party tracking pixels, or cross-site advertising networks. Blocking or clearing this storage will sign you out and reset your preferences, but nothing else breaks.

7. Who we share information with

We share information only with service providers who process it on our behalf to run the Service, and only as far as their part requires:

• Clerk — authentication and account management.
• Vercel — hosting of the website, app, and API.
• Neon — our PostgreSQL database.
• Google (Gemini API) and OpenRouter (routing to providers such as OpenAI and Anthropic) — AI generation.
• Stripe — payment processing and subscriptions.
• Resend — delivering support and service emails.
• ipwho.is — timezone and approximate city from IP, as described in section 2.

Beyond these, we may disclose information where we are legally required to — to comply with applicable law, a court order, or a lawful request from a public authority — or where necessary to investigate suspected abuse, fraud, or threats to someone’s safety, or to establish or defend legal claims. If we are ever involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction; we would notify you and this notice would continue to apply until replaced.

We do not sell your personal information and we do not share it with data brokers or advertising networks.

8. International transfers

We and our service providers operate internationally, and the providers listed above are largely established in the United States. If you use the Service from the UK, EEA, Switzerland, or elsewhere outside the US, your information will be transferred to and processed in countries whose data-protection laws may differ from your own. Where we transfer personal information out of the UK or EEA, we rely on appropriate safeguards — typically the European Commission’s Standard Contractual Clauses and the UK Addendum, incorporated into our agreements with those providers. You can ask us for details of the safeguards that apply by emailing support@aireplywriter.com.

9. How long we keep information

Where information cannot be deleted immediately — for example because it sits in an encrypted backup — we isolate it from further processing until deletion is possible.

10. How we keep information safe

We use industry-standard technical and organisational measures: encrypted connections (HTTPS) everywhere, AI provider keys held server-side and never shipped to the browser or extension, access to production data limited to those who need it, and authentication delegated to a specialist provider so we never handle your password. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to protect your information and will notify you and the relevant authority of a qualifying breach as the law requires.

11. Your privacy rights

Depending on where you live, you may have the right to: access a copy of your personal information; correct information that is inaccurate; delete your information; restrict or object to processing, including processing based on legitimate interests; receive your information in a portable format; and withdraw consent where we relied on it, without affecting processing that already happened.

To exercise any of these, email support@aireplywriter.com from the address on your account. We will respond within the time the applicable law allows — one month under the GDPR, extendable where a request is complex — and we may need to verify your identity first, using information we already hold rather than asking for more where we can avoid it. We will not charge you or treat you differently for exercising these rights.

You can also close your account at any time by emailing us, and stop all collection immediately by signing out and uninstalling the extension.

If you are in the EEA or UK and think we have handled your information unlawfully, you may complain to your local supervisory authority — the EEA authority list, the UK’s ICO, or Switzerland’s FDPIC. We would appreciate the chance to address it first.

12. California residents (CCPA/CPRA)

If you are a California resident, you have the rights to know, delete, correct, and opt out described below, and you will not be discriminated against for using them.

Categories we collect. In the past twelve months we have collected:

Sensitive personal information. We do not ask for it. Content you choose to submit for drafting could contain it, which is why we do not retain that content and why we ask you not to submit anything you should not share with a processor.

Selling and sharing. We have not sold personal information or shared it for cross-context behavioural advertising in the past twelve months, and we do not intend to. We disclose the categories above to the service providers listed in section 7 for the business purposes in section 3.

To exercise a California right, email support@aireplywriter.com. You may use an authorised agent if they provide proof of authorisation. Under the “Shine the Light” law you may also request the categories of personal information disclosed to third parties for their own direct marketing — we disclose none.

13. Do-Not-Track signals

There is still no finalised standard for Do-Not-Track, so we do not respond to DNT browser signals. This matters little here: we do not run cross-site advertising trackers in the first place. If a standard is adopted that applies to us, we will follow it and update this notice.

14. Children

The Service is not directed to children under 13, or under the minimum age of digital consent where you live (16 in parts of the EEA), and we do not knowingly collect their personal information. If you believe a child has given us information, email support@aireplywriter.com and we will delete it.

15. Changes to this notice

We may update this notice as the Service changes or the law does. The “Last updated” date above always reflects the current version. If a change materially affects your rights or how we use your information, we will give notice within the Service or by email before it takes effect where we reasonably can.

16. How to contact us

For any question, request, or complaint about this notice or your personal information: support@aireplywriter.com. See also our Terms of Service.