Privacy policy

This policy explains what ReplyDial (“we”, “us”) collects, why, how long we keep it, and the choices you have. ReplyDial is operated by Priyanka Wagh, Sweden, which is the data controller for the personal data described here. ReplyDial is developed and maintained by Rahul Wagh. Questions or requests: contact@replydial.com.

1. The short version

• ReplyDial only does what you ask it to: it shows you the comments on your own channel that you have not answered, drafts a reply when you click Draft, and posts a reply when you click Post.
• We never post anything to your channel on our own. You approve each reply individually, and it is posted only when you click Post, with exactly the text you approved. There is no bulk posting, no scheduling, and no unattended posting: if you post several approved replies at once, they are sent one at a time with a pause between them, while you watch, and you can stop at any point.
• We do not sell your data, show ads, or use your YouTube data to train AI models.
• You can revoke our access, disconnect your channel, and delete your account at any time. Disconnecting deletes the YouTube data we hold for you.

2. Revoking access

You can withdraw ReplyDial’s access to your Google account at any time, without contacting us, from your Google Account’s security settings: security.google.com/settings/security/permissions. Inside ReplyDial, the Disconnect channel button does the same and also deletes the YouTube data and tokens we stored for you.

2b. Free tools (no sign-in)

The free tools at /tools (unanswered comments checker, comment exporter, quota calculator, channel analyzer, Discover) read public YouTube data through YouTube API Services with an API key: channel details, video titles, descriptions, tags, durations, publish dates, public view, like and comment counts, whether captions exist, YouTube’s paid-promotion flag and topic tags, and public comments. They do not sign in to YouTube and do not access private analytics. The checker and the exporter hold a result in memory for up to 24 hours so that a repeated lookup does not cost quota, then discard it. The channel analyzer keeps each channel report in our database for up to 30 days (reused for a day, refreshed on request, then deleted by a daily job); the report is the public profile of a channel and is not linked to the person who ran it. Discover searches an inventory built from those reports (one summary row per analyzed channel: size, niche, uploads, sponsoring brands, scores and whether a contact is listed, never the contact itself), refreshed with the report and deleted on the same 30-day schedule; a keyword search that the inventory cannot answer is run on YouTube once and the channels it returns are stored as rows of the same kind (name, size, country, topic tags). We keep no database of creators, sponsors, comments or contacts beyond those reports and that inventory. Where a result shows an email address or link, it is text the creator published in their own channel or video description, shown as written. Labels such as niche, confidence and sponsor grouping are ReplyDial’s own analysis of that public data and are marked as such on the page. By using the free tools you agree to the YouTube Terms of Service, and Google’s Privacy Policy applies to the YouTube data involved. The tools record only an anonymised count of lookups per day and a hashed IP for rate limiting, kept for one hour.

3. YouTube API Services and Google user data

The ReplyDial app uses YouTube API Services to read and reply to comments on your channel. By using it you also agree to the YouTube Terms of Service, and Google’s handling of your data is governed by the Google Privacy Policy.

ReplyDial’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: we use Google user data only to provide the features you see in the app, we do not transfer it to others except as needed to provide those features, to comply with the law, or as part of a merger or acquisition with the same protections, we do not use it for advertising, and no person at ReplyDial reads it unless you ask us to for support, it is needed for security or legal compliance, or it has been aggregated and anonymised.

4. Information we collect

Account

• From Google sign-in: your Google account identifier, name, email address, and profile picture. We use these to create and secure your account and to contact you about it.
• Settings you type into ReplyDial, such as the tone you want drafts to use.
• Usage counters (how many drafts and replies you made each day), which enforce plan limits.

YouTube channel data (only after you connect a channel)

• When you grant the YouTube permission (the youtube.force-ssl scope), Google gives us access and refresh tokens for your channel. They are encrypted at rest (AES-256-GCM) and never sent to your browser.
• Your channel’s identifier and title, your videos’ identifiers and titles, and the comments and replies on your videos: text, author display name and channel, timestamps, and like counts.
• A log of the replies you posted through ReplyDial (comment, video, reply id, and text), which lets you and us verify what was sent and lets our anti-spam limits work.
• The comments you dismissed, so they stay hidden.

Billing (paid plans)

• Payments are taken by Paddle, our merchant of record. Paddle collects your card or other payment details and your billing address; we never see your card number.
• We store your Paddle customer and subscription identifiers, your plan, and its status, plus a record of the billing events Paddle sends us, to know which plan to give you.

Beta requests and referrals

• If you asked for beta access we stored your email address, optionally your channel link, the referral code that brought you here, and campaign tags from the link you followed.
• A salted, one-way hash of your IP address, used only to limit abusive signups. We do not store your raw IP address with your request.

Log data

Our hosting provider records standard server logs when you use the site: IP address, browser and device type, the pages and endpoints requested, the referring page, timestamps, and error details. We use them to keep the service secure, to fix problems, and to count visits in aggregate (how many people came each day, from search, from AI assistants, or from other sites, from which country, and which pages they read, with crawlers told apart from people). The country is estimated from the IP address with a public IP-to-country table (DB-IP) when the counts are computed; it is not stored with your account. Those counts are computed on our servers from the logs; no analytics script runs in your browser and no advertising or cross-site tracking is involved.

5. How we use your information

• To sign you in and keep your account secure. If you sign in with your email address instead of Google, we send a one-time link to that address; the link expires after 20 minutes and its token is deleted within a day.
• To show you which comments on your channel have no reply from you.
• To draft a reply when you ask for one, and to spot viewer requests you may want to collect.
• To post a reply to YouTube only when you click Post, using exactly the text you approved.
• To enforce plan limits and the anti-spam pacing that protects your channel and our API access.
• To manage your subscription and give you the plan you paid for.
• To email you about your account, security, or changes to the service. We do not send marketing email to app users without a separate opt-in.
• To detect abuse and defend legal claims.

Legal bases under the GDPR: performance of our contract with you (Art. 6(1)(b)) for running the service and billing; your consent (Art. 6(1)(a)) for the YouTube permission and for email updates, which you can withdraw at any time; and our legitimate interests (Art. 6(1)(f)) in security, abuse prevention, and improving the service in ways that do not involve reading your data.

6. AI processing

To draft a reply, the comment text, its author’s display name, the video title, and your tone settings are sent to our AI provider, Anthropic, which processes them solely to return the draft. Under Anthropic’s commercial terms this content is not used to train their models, and Anthropic deletes it within 30 days; it is kept only that long for abuse monitoring. We do not use your YouTube data to develop, improve, or train generalised AI or machine-learning models.

7. Data about people without a ReplyDial account

The comments we process are public comments left on your videos by your viewers. We process their display name, channel identifier, and comment text only so you can see and answer them. We do not contact commenters, build profiles of them, or use their data for anything else, and we delete or refresh it within 30 days as described below. If you are a commenter and want to know what a creator holds about you through ReplyDial, write to contact@replydial.com.

8. How we share your information

We do not sell personal data, and we do not share it with advertisers. We share it only with the service providers below, under data-processing agreements, and only for the purposes in this policy:

• Google Cloud: hosting and our managed PostgreSQL database, in the EU (Finland). Google and YouTube API Services: sign-in and channel data.
• Anthropic: AI drafting, as described in section 6.
• Paddle: payments, invoicing, and tax handling for paid plans.
• Resend: transactional email.

Some providers process data outside the EU/EEA, mainly in the United States. Where they do, transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.

We may also disclose information if the law requires it, to respond to a valid legal request, or where necessary to prevent fraud, abuse, or harm to people or to the service. If ReplyDial is ever sold or merged, your data may transfer to the new owner under the protections of this policy; we will tell you before that happens.

9. Cookies

We use only first-party cookies that the service needs, and no advertising or cross-site tracking cookies:

• a session cookie that keeps you signed in to the app;
• a short-lived cookie that protects the Google sign-in and connect flow against forgery (10 minutes);
• rd_ref, set for 30 days if you arrive through a referral link, so the person who invited you gets credit;
• rd_analyzer, set for one hour when you click Save or Watch on a channel report before signing in, so the report is saved to your account right after sign-in;
• rd_first, set for 30 days on your first visit: the page you landed on, the site that linked you here, and any campaign tags in the link, so we know where sign-ups come from. If you sign in, it is copied to your account once and never shared.
• rd_vid, a random id set for one year, so the free-tool lookups a browser makes before signing in can be shown next to that account afterwards. It identifies the browser only to us, carries nothing about you, and is never shared.

Paddle’s checkout sets its own cookies when you open it; they are covered by Paddle’s privacy policy. We do not run third-party analytics or advertising tags on the site. On the free tools we record each lookup (the channel or video looked up, how it was typed, and whether it was answered from our own records) against the rd_vid id, for 90 days. Inside the app we keep our own small record of what you did: signed in, connected a channel, loaded the inbox, drafted or posted a reply, when a reply was blocked and why, exported a file, and which app pages you opened. It holds counts and status codes, never the text of comments or replies, is seen only by the people who run ReplyDial (to help you and to fix problems), and is deleted after 90 days.

10. Data retention

• Comments and other data obtained from YouTube API Services: refreshed or deleted within 30 days. We keep no long-term copy of your comments.
• Every limit in this section is enforced by a daily job across all accounts, including accounts that are no longer used.
• Your posted-reply log: 30 days, then deleted. The list of comments you dismissed holds comment identifiers only; each is re-confirmed against live YouTube data when your inbox loads and is deleted as soon as YouTube reports the comment gone, or after 90 days without any confirmation. All of it is deleted immediately when you disconnect your channel.
• Google tokens: until you disconnect, revoke access, or delete your account.
• Account and settings: for as long as your account exists.
• Usage counters and the in-app activity record described under Cookies: 90 days.
• Saved channel reports (analyzer workspace): the list stays until you delete an entry or your account. The YouTube data inside a report (statistics, the channel’s name and handle, sponsor names) is refreshed when you open it; after 30 days without a refresh it is deleted by a daily job and only the channel’s ID is kept, so the entry can be re-run. Watched channels are re-run about once a week, only when you open the workspace.
• Billing records: 7 years after the transaction, because Swedish accounting law requires it.
• Server logs: 30 days. Page-request records used for the aggregate visit counts above (URL, referring page, browser type, IP address, time): 13 months.
• Beta requests: until access opens or you ask us to remove you.

Deleting your account deletes everything associated with it except the billing records above and anything we must keep to comply with the law or resolve a dispute.

11. Security

All traffic to ReplyDial is encrypted in transit (HTTPS). Data at rest is encrypted by our hosting provider, and Google tokens are additionally encrypted by us with a key kept outside the database. Access to production systems is limited to the people who run the service and is logged. No system is perfectly secure; if we ever learn of a breach affecting your data we will tell you and the authorities as the GDPR requires.

12. Your rights and choices

Under the GDPR you can ask us to access, correct, delete, or restrict your personal data, object to processing, receive a copy in a portable format, and withdraw consent at any time. Most of this you can do yourself: disconnect your channel or delete your account in the app, revoke access at Google, or reply “stop” to any email. For anything else, write to contact@replydial.com; we answer within 30 days. You can also complain to your data protection authority. In Sweden that is the Swedish Authority for Privacy Protection (IMY).

13. International users

ReplyDial is operated from Sweden and hosted in the EU. If you use it from elsewhere, your data is processed in the EU and by the providers listed in section 8, and your local rights may differ from those described here.

14. Children

ReplyDial is not directed at children under 16 (or the age of digital consent where you live), and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

15. Changes

If we change this policy in a way that affects how we use your data, we will tell you by email or in the app before the change takes effect. The date at the top shows the latest revision.

16. Contact

Priyanka Wagh, Sweden
Privacy requests and general contact: contact@replydial.com
See also our terms of service.