Privacy Policy

This policy explains how NMajor Studios LLC, a Wyoming limited liability company, handles personal information for PatchReply at patchreply.com. For what the Chrome extension does on your device, see the extension privacy policy.

1. What we collect

• Account data: your email address, name, whether your email is verified, a password hash if you set a password, your Google account identifier if you sign in with Google, and account dates.
• Session and security data: session tokens and expiry dates, IP address and browser user agent for each signed-in session, and rate-limit records. Sign-in rate limiting briefly stores the IP address and route (deleted within a day); our other counters store keyed hashes instead of IP addresses.
• Public links: when you publish a Review report, we store its title, notes, Text edits, page titles and addresses (with query strings and fragments removed), element and location details, capture environment details (browser, operating system, screen), and the screenshots you chose to include.
• Support and privacy requests: your email, optional name, request type, and message.
• Email delivery records: for verification, sign-in, password-reset, email-change, and account-deletion emails.
• Technical logs: Cloudflare processes request details such as IP address, URL, and timestamps to deliver and secure the site.

2. The homepage voice demo

If you try voice on our homepage, your recording (up to 30 seconds) is sent to Cloudflare Workers AI for transcription and the text is returned to your browser. We don’t store the recording or the transcript. We keep only hashed counters to enforce daily limits.

3. How we use information

• to provide accounts and public links you request, and to show your links in your dashboard;
• to send account emails you trigger (verification, sign-in links, password resets, email changes, account deletion);
• to answer support and privacy requests;
• to prevent abuse and secure the service; and
• to comply with law.

Where privacy law requires a legal basis, we rely on performing our contract with you, our legitimate interest in running and protecting the service, legal obligations, or your consent where required. We only send transactional email today; we don’t send marketing email.

4. Public links are public

Anyone with a public link can read the report and its screenshots and copy them. Links ask search engines not to index them, but that isn’t access control. Links expire 30 days after publishing or renewal and are deleted 7 days later unless renewed.

5. Service providers

• Cloudflare: hosting, Workers, D1 database, R2 file storage for public links, Workers AI for the homepage demo, network security, and logs.
• AhaSend: delivery of account emails.
• Google: only if you choose “Continue with Google,” to confirm your identity and email address.
• Chatwoot (self-hosted at chatwoot.nmajor.net) and MXroute: receiving and answering contact and privacy requests and email to support@ and privacy@patchreply.com.

We don’t sell personal information, share it for cross-context behavioral advertising, or use it to train AI models. We may disclose information when required by law, to protect people or the service, or in a merger or sale with appropriate privacy obligations.

6. Cookies

We use one essential cookie to keep you signed in. We don’t use advertising or analytics cookies. See the cookie notice.

7. Retention

• Account data: until you delete your account.
• Public links: until you delete them, or 7 days after they expire.
• Sessions: up to 30 days of inactivity, or until you sign out.
• Rate-limit records: up to about a day after their window ends.
• Support and privacy requests, email delivery records, and provider logs: as long as needed to answer requests, secure the service, and meet legal duties.

8. Deleting your data

You can delete your account from Settings after confirming by email. That deletes your account, sessions, and sign-in methods, and stops and deletes all your public links. Our database provider keeps short-term backups (up to 30 days) for recovery. Reviews saved in the extension stay on your device.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to object to or restrict processing, to withdraw consent, and to appeal. Use the privacy request form or email privacy@patchreply.com. We may verify your identity before acting, and we won’t discriminate against you for exercising your rights.

10. Children

PatchReply isn’t for children. Accounts must belong to someone old enough to enter a binding contract. If you believe a child gave us personal information, contact us and we’ll delete it.

11. International transfers and security

We and our providers may process information in the United States and other countries. We use HTTPS, password hashing, access controls, server-side authorization, input limits, and rate limits. No service can guarantee absolute security; tell us through the contact form if you suspect a problem.

12. Changes

We’ll post a new effective date when we update this policy and give notice or ask for consent where the law requires.

13. Contact

Privacy: privacy request form or privacy@patchreply.com. Everything else: contact form.