Reply Wizard Sign in Add to Chrome

Privacy Policy

Last updated 17 October 2026 · Palworks FZE LLC, United Arab Emirates · [email protected]

This policy explains what personal data Reply Wizard collects, why, who else handles it, how long we keep it and what you can ask us to do with it. It covers the Reply Wizard browser extension for WhatsApp Web, the Reply Wizard plans, our servers at api.replywizard.app, mcp.replywizard.app and config.replywizard.app, and this website, replywizard.app.

Reply Wizard is published by Palworks FZE LLC, Amber Gem Tower, Mezzanine Floor, Sheikh Khalifa Street, P.O. Box 4848, Ajman, United Arab Emirates (“we”, “us”). We decide how and why this data is processed. You can reach us at [email protected], and about privacy in particular at [email protected].

Summary

  • Your chats stay in your browser until you ask for something. Opening a chat sends nothing. When you ask for a reply, a summary, a transcription, a translation or a rewrite, only what that one request needs is sent, and only to the AI service that will answer it.
  • We do not keep your messages or your audio. When a request goes through our servers, the content is passed on and not stored after the request completes.
  • We do not sell personal data, and we do not use it for advertising.
  • What we do keep depends on what you use: nothing at all for the on-device features; an account record (email address, plan, approximate location, usage counts) if you use a Reply Wizard plan; payment records if you buy one; and pseudonymous usage analytics, which you can switch off.

1. What stays on your device

The extension keeps the following in your browser's own storage. We never receive it:

  • your settings, prompt templates, saved templates, reminders and business facts;
  • your history of requests and answers, and the transcripts of voice notes;
  • the API keys you enter for AI providers, stored encrypted;
  • the on-device speech and AI models you download.

Uninstalling the extension deletes all of it. On-device transcription (Whisper) and Chrome's built-in AI run inside your browser and send no message or audio anywhere.

2. Messages and audio you ask us to process

The extension reads the WhatsApp Web page you have open, in your browser, at the moment you ask it to do something. What happens next depends on how you set it up.

With your own API key

The content of the request (the recent messages of that chat, the voice note's audio, your draft, or your business facts where they apply) goes straight from your browser to the AI provider you chose, under that provider's own terms. It does not pass through our servers, and your API key is never sent to us.

With a Reply Wizard plan (Free, Pro or Power)

The request goes to our gateway at api.replywizard.app so that we can check your plan and count your usage. From there:

  • text, and audio for transcription, are processed by Microsoft's Azure OpenAI Service, OpenAI's API, Google's Gemini API or Groq, as applicable;
  • text from a user in Hong Kong, Macau or mainland China, where OpenAI and Google do not offer their APIs, is processed by Microsoft's Azure OpenAI Service or Alibaba Cloud Model Studio (Qwen, in Singapore), never by OpenAI or Google.

Neither we nor our gateway store the content or the audio after the request completes, and we do not log it. What we record about each request is described in section 3.

With the Studio plan

Requests go from your browser to OpenRouter directly, using a key we create for you there. Our gateway is not in that path.

When you connect an AI assistant

If you let an AI assistant (for example Claude or ChatGPT) use your WhatsApp through Reply Wizard, it can ask for your chat list, recent messages, contact details or a summary, and can place a draft in a chat's message box. If you turn on sending, it can also ask to send a message to a chat you have talked with: the text waits in that chat's message box and is sent only when you press Send. Out of the box, Reply Wizard never sends a message.

  • On your own computer (the local bridge used by desktop assistants), the data passes between the assistant and your browser on your machine and does not reach us.
  • Through our relay (mcp.replywizard.app, used by claude.ai, ChatGPT and similar web assistants on a paid plan), each request and its answer pass through our relay on the way between the assistant and your browser. The relay does not store or log their content, including the text of a draft or a message to be sent. We keep the record of the connected browser and assistant described in section 3. The assistant then handles the data under its own terms.

3. Personal data we collect and keep

Your plan account

When you start a plan (including the free plan) we create an account record holding:

  • your email address, if you gave one (the free plan can start without one; we then hold only a random identifier created by the extension for that browser);
  • your plan, its status and its dates;
  • your country, taken from your payment details or, if there are none, from the location of your internet connection;
  • your approximate city, worked out by our hosting provider, Cloudflare, from the IP address a plan request comes from. We store the city name, never the IP address;
  • a scrambled form (hash) of your plan key, never the key itself, and when it was last used;
  • daily usage counts: how many replies and transcriptions, how many tokens and seconds of audio, what they cost us, and how many requests were refused. These are numbers, never content.

We use this to provide the plan, enforce its allowance, send you account email, help you when something goes wrong, notice accounts that are not working, and understand which features and regions our customers use. We keep these records in an internal customer database and in an internal spreadsheet that only we can open.

Purchases

Plans are sold by Paddle, our merchant of record (and, for subscriptions bought before Paddle, by Stripe). You enter your card details on their checkout and they never reach us. From them we receive: your email address, the name on the card, your country and, where they collect it, your postal code; the plan, the subscription's status and dates; the amounts paid; and refunds or disputes. We use this to deliver your plan, answer billing questions, keep accounting records and spot duplicate purchases. If a renewal payment fails, Paddle may email you, and on our checkout and My account pages its script (Paddle Retain) may show a notice asking you to update your card; on My account it is told your Paddle customer number so it can recognise you. It sets no cookie of its own.

Signing in on replywizard.app

If you sign in to My account we email you a one-time code or link (stored only in scrambled form, for at most 7 days). We set one cookie on api.replywizard.app that keeps you signed in for up to 30 days after you last use it. For each signed-in browser we record a coarse label (for example “Chrome on Windows”) and the first part of its IP address, so you can recognise and sign out your sessions.

Connected assistants and browsers

For the relay we keep, per account: each connected browser's label (taken from its browser name), a scrambled form of its access token and when it was last seen; each authorised assistant's name; and daily counts of which tools were used and whether they succeeded.

Support messages

When you use the Support form (in the extension or on this website) we receive your name, email address, optional phone number, message, optional rating and optional screenshot, plus a random identifier for that browser and the extension version. It is delivered as an email to our support mailbox, and we receive a short notification (your name and the start of your message) in our team chat. Screenshots larger than 2 MB are held in cloud storage that deletes them after 30 days; smaller ones are attached to the email.

Security and abuse prevention

Our servers see the IP address of every request. We use it, held for no more than 48 hours, in counters that limit how often the free plan, sign-in, key recovery and the Support form can be used from one address. Our hosting provider, Cloudflare, also processes it to deliver and protect the service.

The extension reads the phone number of the WhatsApp account that is open in WhatsApp Web, turns it into a one-way hash (SHA-256) on your computer and keeps that hash in your browser's extension storage. It sends the hash to our servers only if you use a Reply Wizard plan or the free plan. The number itself is never stored by the extension, never logged and never sent. Because phone numbers are few enough to try one by one, someone with access to your browser profile could match the stored hash to your number, so treat it like the rest of your browser data. The purpose is to stop the same person taking repeated free trials or free plans. Our legal basis is our legitimate interest in preventing abuse. Our server does not keep the hash as received: it stores a keyed hash of it, so neither we nor anyone who copies our database can turn it back into your number. We delete it 12 months after your account closes. If you use your own API key, a Chrome on-device option or another provider, nothing of this is sent.

Updates to settings

The extension regularly downloads small signed settings files from config.replywizard.app (for example, the default AI model). These requests carry no identifier; Cloudflare sees the IP address as it does for any request. You can switch this off in the extension under Privacy.

4. Usage analytics

In the extension

Unless you switch it off (extension settings, Privacy), the extension sends usage events to Google Analytics 4 and PostHog. They are tied to a random identifier created for your browser, not to your name, email or WhatsApp account, so they are pseudonymous rather than anonymous. An event records things like: which feature was used and from where in the interface; which AI provider and setting were chosen; how long a request took; whether it succeeded, and an error code if not; the extension version; and the language a message was translated into. Message lengths, audio lengths and counts are sent as ranges.

Events never contain message content, chat or contact names, phone numbers, email addresses or API keys.

PostHog works out an approximate location (country, region and city) from the connection an event arrives on, then discards the IP address; postcode and coordinates are removed before anything is kept. Google Analytics receives no location from the extension.

On this website

Most pages of replywizard.app use Google Analytics 4, Microsoft Clarity (which records how a page is used, including a replay of scrolling, clicks and mouse movement; form fields are masked) and Cloudflare Web Analytics. The home page embeds a YouTube video in privacy-enhanced mode. The pages used for checkout, sign-in, connecting an assistant and receiving your key run no analytics. If you visit from the European Economic Area, the United Kingdom or Switzerland, Google Analytics and Clarity load only after you press Accept on the cookie notice. Elsewhere they load without asking, and you can decline them with the Cookie settings link at the foot of each page, which also changes an earlier choice. To tell where you are, the page asks Cloudflare for your country; we do not store it. Cloudflare Web Analytics sets no cookies.

5. Email we send you

We send email only about your account: confirming a purchase, a sign-in code or link, a link to recover your key, a check-in if a plan you pay for has not been used, and, once, a request to rate Reply Wizard after you have used a paid plan for about a week. They never contain your key, and you can reply STOP to the last two. We do not send marketing email.

6. Why we process it (legal bases)

  • To provide the service you asked for (performing our contract with you): processing your requests, running your plan and account, taking payments, sending account email and answering support.
  • Our legitimate interests, balanced against yours: preventing abuse and fraud, keeping the service working, understanding how it is used so we can improve it, and keeping internal customer records.
  • Legal obligations: keeping tax and accounting records.
  • Your consent, where the law requires it, for analytics; you can withdraw it at any time by switching analytics off.

7. Who else handles it

We use these service providers. Each processes data only to provide its service to us.

  • Cloudflare (Cloudflare, Inc.): hosts our servers, website, relay, database and file storage, and protects them from abuse; processes the IP address of every request and works out the approximate city and country we store.
  • Google (Google LLC): the Gemini API answers plan requests; Google Analytics 4 measures usage; Google Workspace holds our internal customer spreadsheet and team chat, where we receive account and billing notifications that include a customer's email address, plan and amounts.
  • OpenAI (OpenAI OpCo, LLC): answers plan requests. Under its API terms it does not use them to train its models; it may keep them for up to 30 days to detect abuse.
  • Groq (Groq, Inc.): answers plan requests.
  • Microsoft (Microsoft Corporation): the Azure OpenAI Service answers plan requests. Under its terms Microsoft does not use them to train models; it may keep them for up to 30 days to detect abuse.
  • Alibaba Cloud (Alibaba Cloud (Singapore) Private Limited): Model Studio (Qwen) answers plan requests from Hong Kong, Macau and mainland China, processed in Singapore.
  • OpenRouter (OpenRouter, Inc.): the model access behind the Studio plan.
  • Paddle (Paddle.com Market Limited) and Stripe (Stripe, Inc.): sell plans and take payments, as merchant of record or payment processor, under their own privacy policies.
  • Resend (Resend, Inc.): sends our account email and delivers Support form messages to us.
  • Zoho (Zoho Corporation): hosts our support mailbox.
  • PostHog (PostHog Inc.): product analytics.
  • Microsoft Clarity (Microsoft Corporation): website analytics.
  • Hugging Face: serves the on-device speech models the extension downloads; the download itself reveals your IP address to it.

An AI model reviews our servers' operating statistics to warn us of problems; it receives counts and pseudonymous account labels, never names or email addresses. The AI providers you choose yourself (with your own key) and the AI assistants you connect act under their own terms, not on our behalf.

We may also disclose data where the law requires it, to protect our rights or users' safety, or to a buyer of our business, who would be bound by this policy.

8. International transfers

Our providers process data in several countries, including the United States, the European Union and India. Where data protection law requires it, these transfers rely on the providers' standard contractual clauses or equivalent safeguards.

9. How long we keep it

  • Message content and audio: not kept after the request completes.
  • Plan account record and daily usage counts: while your account exists, and deleted when you ask us to delete it.
  • Payment and invoice records: as long as tax and accounting law requires, which can be several years after the purchase.
  • Sign-in codes and links: up to 7 days. Signed-in sessions: until 30 days after last use, or when you sign out.
  • IP addresses in abuse-prevention counters: up to 48 hours.
  • The keyed hash of your WhatsApp number: 12 months after your account closes.
  • Support emails: until the matter is resolved and they are no longer needed; large screenshots: 30 days.
  • Google Analytics (extension): event data 2 months, user-level data 14 months. PostHog: for the retention period of our PostHog plan.
  • Everything stored in the extension itself: until you delete it or uninstall the extension.

10. Your choices and rights

  • Use the on-device features, or your own API key, and nothing reaches us.
  • Switch off analytics, or the settings updates, in the extension under Privacy.
  • Disconnect an AI assistant or a browser, and sign out sessions, in My account.
  • Ask us for a copy of your data, to correct it, to delete it, or to stop or restrict a use of it, by writing to [email protected] from the email address on your account. We answer within 30 days. Deleting your account ends your plan.
  • Object to processing based on our legitimate interests, and withdraw consent at any time.
  • Complain to the data protection authority where you live.

California residents. In the last 12 months we collected: identifiers (email address, random identifiers, IP address); customer records (name on card, postal code); commercial information (plans bought and amounts paid); internet activity (usage analytics); approximate geolocation (city and country); audio (voice notes you ask us to transcribe, not retained); and the content of messages you ask us to process (not retained, used only to provide the service). We used them for the purposes in section 6, we do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. You have the rights to know, delete, correct and not be discriminated against for exercising them; write to us as above.

11. Children

Reply Wizard is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, write to us and we will delete it.

12. Security

We use encrypted connections throughout, store plan keys, sign-in codes and access tokens only in scrambled form, keep your own API keys encrypted on your device, and limit access to our systems to the people who run them. No system is perfectly secure, and we will tell you and the authorities about a breach where the law requires it.

13. Changes to this policy

We will update this page when what we collect or how we use it changes, and change the date at the top. A material change will also be announced in the extension or by email before it takes effect.