Privacy Policy

Last updated: October 15, 2026

Who operates ReplyWink

ReplyWink is operated by independent developer Zhu Jingyang in China. For privacy requests, contact support@replywink.com. This policy covers the extension, website, and our support and license operations.

Local extension storage

The extension uses browser local storage for AI provider endpoints and keys, account context, prompt templates, reply history, preferences, free-usage records, and license state. We do not upload your reply ledger or AI API key to a ReplyWink database. Uninstalling removes the extension's local data; it does not delete purchase or support records held by service providers.

Reply records contain handled-post URLs, author handles, processing status and timestamps, with at most 500 recent entries retained. This is a limited interaction history, not a record of all pages you visit. Free-usage timestamps cover a rolling 24-hour window and older entries are pruned on subsequent writes. Account setup may process your X username, display name, biography and visible posts. Version 1.0.5 stores current AI profiles locally and removes legacy synced OpenAI configuration after a local profile is available.

Local X History Library

As you browse the Bookmarks timeline in X History, ReplyWink saves loaded posts locally in IndexedDB. Likes collection is optional and off by default. Records include the account handle and display name, post text or readable media descriptions, author, original URL, links, media types, source labels, publication and collection dates, and read timestamps. Accounts are separated using the visible logged-in handle; handles can change. Only loaded posts are covered. Media files are not downloaded.

Library collection, search and review do not use AI, telemetry, a ReplyWink backend or cloud indexing. Visiting a normal post page can still use existing scoring features when enabled. Removing a bookmark or losing access to an original post does not remove its saved snapshot. Local deletion removes the snapshot and keeps a minimal account/post deletion marker to prevent automatic recapture or import restoration. A backup can restore deleted records only when you explicitly choose that option.

You can export a versioned JSON file and preview an import in the Library. Exports include saved posts and account/read metadata across your local accounts, but exclude AI keys, license credentials, X cookies and other extension settings. Exported files remain under your control. The unlimitedStorage permission supports long-term local retention; actual disk capacity still limits storage and failures are displayed. Uninstalling removes the local Library, so export a backup before uninstalling.

Local Follow review

With an active license, you can start a scan in a dedicated logged-in X tab. ReplyWink scrolls your Following page and reads loaded account cards. Optional profile checks visit up to 20 selected profiles one at a time. The extension never clicks Follow or Unfollow. X prohibits non-API website automation; read-only or slow scanning does not remove this platform-policy risk. Missing a “Follows you” label is a possible non-follower, not proof. Coverage is limited to page-accessible content, with individual observation times.

A separate local IndexedDB stores the visible account ID (where available), handle, name, bio, avatar URL, relationship observations, scan progress and your ignored-account choices. Legacy keep/review fields remain in local records and backups for compatibility; the former Reviewed mark no longer controls the interface. The last three ended scan rounds and current materialized observations are retained, together with your personal marks. Relationship data is not uploaded to ReplyWink or an AI provider. Existing license activation/validation still uses the license service. Scan and profile-check tabs suppress the existing AI scoring feature. Account changes, reloads, errors or a browser restart pause scanning; continuing is explicit.

You can export the selected account’s follow data as an independent JSON backup, preview and import historical evidence, or clear it without changing your X relationships or bookmark library. Backups exclude cookies, credentials, license keys and running tasks. Imported evidence retains its original observation dates. Saved data is not removed when a license becomes inactive; export and local deletion remain available. Uninstalling removes extension data. Avatar images are not archived and viewing one may contact X’s image host.

Your AI provider

Scoring, drafting, translation, and AI-assisted setup send the content needed for that feature, such as post text, profile information, prompts, and your account context, to the AI endpoint you configure. Scoring may run while browsing when enabled. Your API key authenticates requests to that provider. The provider's privacy, retention, training, and international-transfer policies apply; review them before sending personal or confidential information. A local endpoint can keep inference on your own machine.

License activation and validation

The extension sends your license key and device activation information to our Cloudflare-hosted service at license.replywink.com. That service forwards license requests to Creem to activate, validate, or deactivate your license. Validation may occur automatically to check an active license. These requests do not include your AI API key or reply ledger. Cloudflare and Creem process network information, including IP addresses and request metadata, to deliver and secure the service.

Purchases

Creem handles checkout as merchant of record. It processes information needed for payment, tax, fraud prevention, receipts, license delivery, and refunds, such as your email, billing details, and payment information. We can access order and license information needed to support purchases, but do not receive your full payment card details. See Creem's privacy policy for its processing practices.

Website and support

Cloudflare hosts the website and processes network and security data to serve it. The homepage loads fonts from Google Fonts, which receives the network information needed to deliver those fonts. The public website uses self-hosted Rybbit at stats.lzgpt.top to measure page visits, referral sources, device/browser information and selected clicks, such as Chrome Web Store and checkout links. Rybbit may store a visitor identifier in browser storage. Raw IP storage, session replay, form tracking and clipboard capture are disabled. This website analytics does not run inside the extension and does not collect AI API keys, license keys, post text or reply drafts. We do not add advertising trackers.

Messages sent to support@replywink.com are routed by Cloudflare to our support inbox hosted by QQ Mail. We receive the sender address, message, and any attachments you choose to send. Do not include API keys, full license keys, payment card details, or unnecessary sensitive information.

Purposes, sharing, and retention

We use this information to deliver the product, verify paid access, answer support requests, process refunds, prevent fraud, and meet legal obligations. Where applicable, processing relies on performance of our agreement, legitimate interests in operating and protecting the service, legal obligations, or consent where required. We do not sell personal information or use it for targeted advertising.

We retain support information only as long as needed to address requests and related disputes, and order-related records as required for tax, accounting, and legal obligations. Cloudflare, Creem, email providers, and your AI provider have their own retention policies. Providers may process data in countries outside your residence.

Your choices and rights

You can change your AI provider, disable available automatic features, stop generating content, deactivate a license, or uninstall the extension. Depending on your location, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal information, withdraw consent where relevant, and complain to a supervisory authority. Contact support to exercise rights concerning information we hold. We may need to verify your request, and legally required records may need to be retained.

Chrome Web Store Limited Use

ReplyWink's use and transfer of information received through Chrome APIs adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. We use this information only for disclosed user-facing features and permitted service operations, not for personalized advertising, creditworthiness or lending decisions.

Changes and contact

We update this policy when our practices change. The date above identifies the latest version. Send questions or privacy requests to support@replywink.com.