Reply Wizard Sign in Add to Chrome

Privacy Policy

Last updated 26 October 2026 · Palworks FZE LLC, United Arab Emirates · support@replywizard.app

This policy explains what personal data Reply Wizard collects, why, who else handles it, how long we keep it and what you can ask us to do with it. It covers the Reply Wizard browser extension for WhatsApp Web, the Reply Wizard plans, our servers at api.replywizard.app, mcp.replywizard.app and config.replywizard.app, and this website, replywizard.app.

Reply Wizard is published by Palworks FZE LLC, Amber Gem Tower, Mezzanine Floor, Sheikh Khalifa Street, P.O. Box 4848, Ajman, United Arab Emirates (“we”, “us”). We decide how and why this data is processed. You can reach us at support@replywizard.app, and about privacy in particular at grievance@replywizard.app.

Summary

  • Your chats stay in your browser until you ask for something. Opening a chat sends nothing. When you ask for a reply, a summary, a transcription, a translation or a rewrite, only what that one request needs is sent, and only to the AI service that will answer it.
  • We do not keep your messages or your audio. When a request goes through our servers, the content is passed on and not stored after the request completes.
  • We do not sell personal data, and we do not use it for advertising.
  • What we do keep depends on what you use: nothing at all for the on-device features; an account record (email address, plan, approximate location, usage counts) if you use a Reply Wizard plan; payment records if you buy one; and pseudonymous usage analytics, which you can switch off.

1. What stays on your device

The extension keeps the following in your browser's own storage. We never receive it:

  • your settings, prompt templates, saved templates, reminders and business facts;
  • your history of requests and answers, and the transcripts of voice notes;
  • the API keys you enter for AI providers, stored encrypted;
  • the on-device speech and AI models you download.

Uninstalling the extension deletes all of it. On-device transcription (Whisper) and Chrome's built-in AI run inside your browser and send no message or audio anywhere.

2. Messages and audio you ask us to process

The extension reads the WhatsApp Web page you have open, in your browser, at the moment you ask it to do something. What happens next depends on how you set it up.

With your own API key

The content of the request (the recent messages of that chat, the voice note's audio, your draft, or your business facts where they apply) goes straight from your browser to the AI provider you chose, under that provider's own terms. It does not pass through our servers, and your API key is never sent to us.

With a Reply Wizard plan (Free, Pro or Power)

The request goes to our gateway at api.replywizard.app so that we can check your plan and count your usage. From there:

  • text, and audio for transcription, are processed by Microsoft's Azure OpenAI Service, OpenAI's API, Google's Gemini API or Groq, as applicable;
  • text from a user in Hong Kong, Macau or mainland China, where OpenAI and Google do not offer their APIs, is processed by Microsoft's Azure OpenAI Service or Alibaba Cloud Model Studio (Qwen, in Singapore), never by OpenAI or Google.

Neither we nor our gateway store the content or the audio after the request completes, and we do not log it. What we record about each request is described in section 3.

With the Studio plan

Requests go from your browser to OpenRouter directly, using a key we create for you there. Our gateway is not in that path.

When you connect an AI assistant

If you let an AI assistant (for example Claude or ChatGPT) use your WhatsApp through Reply Wizard, it can ask for your chat list, recent messages, contact details or a summary, and can place a draft in a chat's message box. If you turn on sending, it can also ask to send a message to a chat you have talked with: the text waits in that chat's message box and is sent only when you press Send. Out of the box, Reply Wizard never sends a message.

  • On your own computer (the local bridge used by desktop assistants), the data passes between the assistant and your browser on your machine and does not reach us.
  • Through our relay (mcp.replywizard.app, used by claude.ai, ChatGPT and similar web assistants on a paid plan), each request and its answer pass through our relay on the way between the assistant and your browser. The relay does not store or log their content, including the text of a draft or a message to be sent. We keep the record of the connected browser and assistant described in section 3. The assistant then handles the data under its own terms.

3. Personal data we collect and keep

Your plan account

When you start a plan (including the free plan) we create an account record holding:

  • your email address, if you gave one (the free plan can start without one; we then hold only a random identifier created by the extension for that browser);
  • your plan, its status and its dates;
  • your country, taken from your payment details or, if there are none, from the location of your internet connection;
  • your approximate city and postal area, worked out by our hosting provider, Cloudflare, from the IP address a plan request, a free plan start or a purchase handover comes from. We store the city name and postal code, never the IP address. We use the postal area with the city and country to spot the same person starting repeated free plans or trials, and to understand where our customers are;
  • a scrambled form (hash) of your plan key, never the key itself, and when it was last used;
  • for a paid plan, the computers it is set up on: a coarse label for each (for example “Chrome on Windows”) and, for each day, which of them were used and with which WhatsApp number (as the keyed hash described below), so that you can see and remove them in My account and so that we can notice a paid plan shared between several people. We only observe this; it does not limit your plan;
  • daily usage counts: how many replies and transcriptions, how many tokens and seconds of audio, what they cost us, and how many requests were refused. These are numbers, never content.

We use this to provide the plan, enforce its allowance, send you account email, help you when something goes wrong, notice accounts that are not working, and understand which features and regions our customers use. We keep these records in an internal customer database and in an internal spreadsheet that only we can open.

Purchases

Plans are sold by Paddle, our merchant of record (and, for subscriptions bought before Paddle, by Stripe). You enter your card details on their checkout and they never reach us. From them we receive: your email address, the name on the card, your country and, where they collect it, your postal code; the plan, the subscription's status and dates; the amounts paid; and refunds or disputes. We use this to deliver your plan, answer billing questions, keep accounting records and spot duplicate purchases. From Paddle we also receive the payment card’s type, brand, last four digits and expiry date. We do not store them: we keep only a keyed one-way fingerprint made from them, so we can tell when one card is used for more than one free trial or account. If a renewal payment fails, Paddle may email you, and on our checkout and My account pages its script (Paddle Retain) may show a notice asking you to update your card; on My account it is told your Paddle customer number so it can recognise you. It sets no cookie of its own.

Signing in on replywizard.app

If you sign in to My account we email you a one-time code or link (stored only in scrambled form, for at most 7 days). We set one cookie on api.replywizard.app that keeps you signed in for up to 30 days after you last use it. For each signed-in browser we record a coarse label (for example “Chrome on Windows”) and the first part of its IP address, so you can recognise and sign out your sessions.

Connected assistants and browsers

For the relay we keep, per account: each connected browser's label (taken from its browser name), a scrambled form of its access token and when it was last seen; each authorised assistant's name; and daily counts of which tools were used and whether they succeeded.

Support messages

When you use the Support form (in the extension or on this website) we receive your name, email address, optional phone number, message, optional rating and optional screenshot, plus a random identifier for that browser and the extension version. It is delivered as an email to our support mailbox, and we receive a short notification (your name and the start of your message) in our team chat. Screenshots larger than 2 MB are held in cloud storage that deletes them after 30 days; smaller ones are attached to the email.

Security and abuse prevention

Our servers see the IP address of every request. We use it, held for no more than 48 hours, in counters that limit how often the free plan, sign-in, key recovery and the Support form can be used from one address. Our hosting provider, Cloudflare, also processes it to deliver and protect the service. For each request made with a plan key we also note whether it came from the extension, a web browser or a scripting tool, read from the request’s Origin and User-Agent headers, so we can detect a key used outside the extension, which our Acceptable Use Policy does not allow. When we find a likely breach of that policy we keep a record of it: the account, the date, the kind of software and the rule involved.

The extension reads the phone number of the WhatsApp account that is open in WhatsApp Web and keeps it, with a one-way hash (SHA-256) of it, in your browser's extension storage. It sends them to our servers only if you use a Reply Wizard plan or the free plan: the hash travels with each request to our servers, and the number itself is sent when it is first learned or changes. Neither is sent to any other AI service. The purpose is to keep one free plan per WhatsApp number and tie it to that number (a new free plan starts only once the extension has read the number, and the free plan works only with it), to stop the same person taking repeated free trials, and to notice a plan key that is shared or used outside the extension. Our legal basis is our legitimate interest in preventing abuse. Our servers keep a keyed hash of the number, which cannot be turned back into it, and the number itself with its country calling code, which only we can read. We delete both 12 months after your account closes. If you use your own API key, a Chrome on-device option or another provider, nothing of this is sent.

Proving your email address (free plan)

To add an email address to the free plan you can choose Continue with Google. Google then tells us your email address and that Google has verified it. We receive nothing else from your Google account and get no access to it. If you type an email address instead, we email it a 6-digit code; the code is stored only as a scrambled form (hash) for 15 minutes or until it is used. We record that the address was proven, and how, beside it on your account. If you set up Reply Wizard again on another browser with the same WhatsApp number, we email a 6-digit code to the address on that free plan, and once you enter it the plan moves to the new browser and stops working on the old one.

Updates to settings

The extension regularly downloads small signed settings files from config.replywizard.app (for example, the default AI model). These requests carry no identifier; Cloudflare sees the IP address as it does for any request. You can switch this off in the extension under Privacy.

4. Usage analytics

In the extension

Unless you switch it off (extension settings, Privacy), the extension sends usage events to Google Analytics 4 and PostHog. They are tied to a random identifier created for your browser, not to your name, email or WhatsApp account, so they are pseudonymous rather than anonymous. An event records things like: which feature was used and from where in the interface; which AI provider and setting were chosen; how long a request took; whether it succeeded, and an error code if not; the extension version; and the language a message was translated into. Message lengths, audio lengths and counts are sent as ranges.

Events never contain message content, chat or contact names, phone numbers, email addresses or API keys.

PostHog works out an approximate location (country, region, city and postal area) from the connection an event arrives on, then discards the IP address; coordinates are removed before anything is kept. We use the location to understand where the product is used and to spot abuse. Google Analytics receives no location from the extension.

On this website

Most pages of replywizard.app use Google Analytics 4, Microsoft Clarity (which records how a page is used, including a replay of scrolling, clicks and mouse movement; form fields are masked) and Cloudflare Web Analytics. The home page embeds a YouTube video in privacy-enhanced mode. The pages used for checkout, sign-in, connecting an assistant and receiving your key run no analytics. If you visit from the European Economic Area, the United Kingdom or Switzerland, Google Analytics and Clarity load only after you press Accept on the cookie notice. Elsewhere they load without asking, and you can decline them with the Cookie settings link at the foot of each page, which also changes an earlier choice. To tell where you are, the page asks Cloudflare for your country; we do not store it. Cloudflare Web Analytics sets no cookies.

5. Email we send you

We send email only about your account: confirming a purchase, a sign-in code or link, a link to recover your key, a check-in if a plan you pay for has not been used, an alert when a plan you pay for has used 80% and 95% of its allowance and when it is used up (you can switch off the first two in My account), and, once, a request to rate Reply Wizard after you have used a paid plan for about a week. They never contain your key, and you can reply STOP to the last two. We do not send marketing email.

6. Why we process it (legal bases)

  • To provide the service you asked for (performing our contract with you): processing your requests, running your plan and account, taking payments, sending account email and answering support.
  • Our legitimate interests, balanced against yours: preventing abuse and fraud, keeping the service working, understanding how it is used so we can improve it, and keeping internal customer records.
  • Legal obligations: keeping tax and accounting records.
  • Your consent, where the law requires it, for analytics; you can withdraw it at any time by switching analytics off.

7. Who else handles it

We use these service providers. Each processes data only to provide its service to us.

  • Cloudflare (Cloudflare, Inc.): hosts our servers, website, relay, database and file storage, and protects them from abuse; processes the IP address of every request and works out the approximate city, postal area and country we store.
  • Google (Google LLC): the Gemini API answers plan requests; Google Analytics 4 measures usage; Google Workspace holds our internal customer spreadsheet and team chat, where we receive account and billing notifications that include a customer's email address, plan and amounts.
  • OpenAI (OpenAI OpCo, LLC): answers plan requests. Under its API terms it does not use them to train its models; it may keep them for up to 30 days to detect abuse.
  • Groq (Groq, Inc.): answers plan requests.
  • Microsoft (Microsoft Corporation): the Azure OpenAI Service answers plan requests. Under its terms Microsoft does not use them to train models; it may keep them for up to 30 days to detect abuse.
  • Alibaba Cloud (Alibaba Cloud (Singapore) Private Limited): Model Studio (Qwen) answers plan requests from Hong Kong, Macau and mainland China, processed in Singapore.
  • OpenRouter (OpenRouter, Inc.): the model access behind the Studio plan.
  • Paddle (Paddle.com Market Limited) and Stripe (Stripe, Inc.): sell plans and take payments, as merchant of record or payment processor, under their own privacy policies.
  • Resend (Resend, Inc.): sends our account email and delivers Support form messages to us.
  • Zoho (Zoho Corporation): hosts our support mailbox.
  • PostHog (PostHog Inc.): product analytics.
  • Microsoft Clarity (Microsoft Corporation): website analytics.
  • Hugging Face: serves the on-device speech models the extension downloads; the download itself reveals your IP address to it.

An AI model reviews our servers' operating statistics to warn us of problems; it receives counts and pseudonymous account labels, never names or email addresses. The AI providers you choose yourself (with your own key) and the AI assistants you connect act under their own terms, not on our behalf.

We may also disclose data where the law requires it, to protect our rights or users' safety, or to a buyer of our business, who would be bound by this policy.

8. International transfers

Our providers process data in several countries, including the United States, the European Union and India. Where data protection law requires it, these transfers rely on the providers' standard contractual clauses or equivalent safeguards.

9. How long we keep it

  • Message content and audio: not kept after the request completes.
  • Plan account record and daily usage counts: while your account exists, and deleted when you ask us to delete it.
  • Payment and invoice records: as long as tax and accounting law requires, which can be several years after the purchase.
  • Sign-in codes and links: up to 7 days. Signed-in sessions: until 30 days after last use, or when you sign out.
  • IP addresses in abuse-prevention counters: up to 48 hours.
  • Records of a likely breach of our Acceptable Use Policy: up to 3 years after the account closes, or longer while a claim or dispute about it is open.
  • Your WhatsApp number and its keyed hash: 12 months after your account closes.
  • Which computers used a paid plan each day, and with which number: 180 days.
  • Email codes for the free plan: 15 minutes, or until used.
  • Support emails: until the matter is resolved and they are no longer needed; large screenshots: 30 days.
  • Google Analytics (extension): event data 2 months, user-level data 14 months. PostHog: for the retention period of our PostHog plan.
  • Everything stored in the extension itself: until you delete it or uninstall the extension.

10. Your choices and rights

  • Use the on-device features, or your own API key, and nothing reaches us.
  • Switch off analytics, or the settings updates, in the extension under Privacy.
  • Disconnect an AI assistant or a browser, and sign out sessions, in My account.
  • Ask us for a copy of your data, to correct it, to delete it, or to stop or restrict a use of it, by writing to grievance@replywizard.app from the email address on your account. We answer within 30 days. Deleting your account ends your plan.
  • Object to processing based on our legitimate interests, and withdraw consent at any time.
  • Complain to the data protection authority where you live.

California residents. In the last 12 months we collected: identifiers (email address, random identifiers, IP address); customer records (name on card, postal code); commercial information (plans bought and amounts paid); internet activity (usage analytics); approximate geolocation (city, postal area and country); audio (voice notes you ask us to transcribe, not retained); and the content of messages you ask us to process (not retained, used only to provide the service). We used them for the purposes in section 6, we do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. You have the rights to know, delete, correct and not be discriminated against for exercising them; write to us as above.

11. Children

Reply Wizard is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, write to us and we will delete it.

12. Security

We use encrypted connections throughout, store plan keys, sign-in codes and access tokens only in scrambled form, keep your own API keys encrypted on your device, and limit access to our systems to the people who run them. No system is perfectly secure, and we will tell you and the authorities about a breach where the law requires it.

13. Changes to this policy

We will update this page when what we collect or how we use it changes, and change the date at the top. A material change will also be announced in the extension or by email before it takes effect.