Privacy Policy

1. Information we process

X sign-in and account. When you choose to sign in with X, we receive your X account identifier and username, and may receive your public display name, profile image URL, whether your account is protected and certain public profile metrics. We create a RPLY.RUN user record and secure session. We request read-only X permissions. We do not ask for your X password or permission to post for you. The current server-side OAuth process obtains identity and does not persist the returned user OAuth access token as a stored credential.

Public X profile and activity data. In response to feature use, we process public X usernames, public profile details, public reply counts, selected calendar dates, timezones, available public post activity (including the text and public engagement counts of public posts) and associated analytics. Public-account information may concern individuals who have not signed up for RPLY.RUN. We cache data where permitted to support saved results and reduce repetitive X API calls.

Your use of the Service. We store Running Mates, recent account searches, account preferences, plan/entitlement and Fresh Check balances, refresh history and related account activity. Your browser may retain your last viewed runner and selected date, and a local copy of your Running Mates, recent searches and plan.

Purchases. Stripe provides hosted payment checkout and billing management. We process Stripe customer, subscription, purchase and payment reference identifiers, transaction status, timestamps and refund/chargeback information needed to deliver entitlements and reconcile charges. Stripe, not RPLY.RUN checkout forms, receives your card details.

Service analytics and diagnostics. We record product interaction event types, time, device category and an app-generated session identifier. Our infrastructure may provide coarse country information, technical request records and security logs. Browser storage includes a session-based event identifier. We use this information to keep the service operating and understand usage. If we enable account-linked product analytics after a separate privacy review, we will link only the signed-in internal account id to bounded event types, foreground-duration estimates and feature outcomes for up to 90 days, to operate the admin support and retention view. These records may also include coarse device and country categories, a masked IP address, a session identifier and an HTTP(S) referrer origin only. We will not put X handles, raw search text, tokens, referrer paths or query strings in those metric properties. We do not load third-party advertising or analytics scripts on the Service.

2. Why we use information

We process data to authenticate users; provide reply counts and user-requested public-account comparisons; save preferences and records; apply quotas, detect misuse and control provider costs; provide paid services and support; diagnose defects; protect users; meet recordkeeping, tax and legal obligations; and exercise lawful rights. Where required by data-protection law, processing must be supported by an appropriate lawful basis, such as contract performance, legal obligation, legitimate interest (subject to the required balancing), or consent when required. Public data is not necessarily exempt from privacy law.

3. Rankings

Rankings (including the Today's Top Runners preview on our home page) list only X accounts whose owner has chosen to join, by signing in with X and selecting Join Rankings or turning on Show me on Rankings in the account menu. Searching an account, running a Fresh Check or signing in does not add anyone. When you join, we record your X account identifier, the time and the version of the notice you were shown. Your choice applies only to Rankings; it is not consent to any other processing described in this Policy.

Rankings are public: anyone, including visitors who are not signed in, can see them. A listed account shows its X username, display name, profile image, its counts of replies, original posts and quotes for the current UTC day or week, when they were last updated, and a link to its X profile. The home page preview shows the three joined accounts with the most replies today (UTC). Counts are as of each account's last stored update and may be out of date or incomplete; the order is among joined accounts only and is not an official X ranking. Daily activity history and other analytics stay available to signed-in users only, and only signed-in users can refresh counts.

You can leave at any time by turning off Show me on Rankings; your account then leaves Rankings and the home page preview. It can still be searched and its public activity viewed elsewhere in the Service. We also leave out accounts that X reports as deleted, protected or suspended until X shows them as public again, and accounts we remove after a report or review. To ask us to delete, restrict or stop processing information about you, use the request options in this Policy or contact [email protected].

4. When we disclose information

We use X for sign-in and public account information; Stripe for payment processing, billing and refunds; and service providers for infrastructure, security, storage, hosting and diagnostics. The Service and its database run on servers operated by OVHcloud in Canada, and Cloudflare provides network delivery and security in front of them. We may disclose relevant information to vendors acting under applicable terms, when legally required, to defend rights or secure the Service, or in a lawful business transition.

5. Cookies and browser storage

Essential cookies include a secure rply_session session cookie (up to 30 days) and a short-lived secure X OAuth state cookie (about 10 minutes). The Service can store a last-view preference, a local copy of your account lists and a pseudonymous analytics identifier (rply.session in sessionStorage). See our Cookie & Tracking Notice. We do not use advertising cookies. If we introduce nonessential tracking that requires consent, we will ask before activating it.

6. International processing

Builders Den LLC is located in the United States and primarily markets in North America, while the Service is intended for eligible users worldwide. Information may be processed in or accessed from countries other than the country where you live. Where required, international transfers are subject to applicable disclosures, safeguards or other legal arrangements. Applicable protections may include EU/UK data protection rules, South Korea's Personal Information Protection Act and Japan's Act on the Protection of Personal Information, depending on the facts.

7. Retention and deletion

We keep information for as long as reasonably needed to provide the Service, maintain records, resolve disputes, prevent fraud and comply with legal and X developer requirements, subject to applicable law. The normal login session lasts up to 30 days unless ended earlier. The retention of cached public X information, saved searches, usage events and financial records depends on their purpose, server controls and legal obligations; records that must be retained for accounting, payment disputes, fraud or legal obligations may outlast account closure. We will review verified deletion requests and delete or de-identify relevant information when required by law, subject to legitimate retention exceptions.

8. Your choices and rights

Depending on applicable law, you may have rights to access, correct, obtain a copy of, restrict, object to, or request deletion of personal information, or withdraw consent where consent is the legal basis. You may also have the right to complain to a data protection authority. Contact [email protected] with the nature of the request and enough details to verify your identity. You may request review of public X account information even if you do not have an RPLY.RUN account. We will respond within legally applicable time limits and explain any lawful exceptions.

Revoking RPLY.RUN's permission in your X settings may affect future logins; it does not necessarily remove previous records and does not cancel a Pro subscription. For subscription cancellation, please contact support or use the subscription management function.

9. Children and security

The Service is intended for adults 18 or older and is not designed for children. We employ security measures such as session controls and secure connections. No internet-based service is entirely risk-free; contact us promptly about any suspected account misuse or privacy concern.

10. Updates and contact

We may update this Policy, with any notices required by applicable law. For privacy questions, account closure and data rights requests, contact Builders Den LLC at [email protected].