Privacy policy

Effective date: July 3, 2026 · Applies to the ReplyVault browser extension and this website.

Short version: ReplyVault runs entirely in your browser. We operate no servers, use no analytics, and receive none of your data — not your API key, not your emails, not your usage. There is nothing for us to sell, leak, or subpoena.

What the extension accesses

• Your Instantly API key. You paste it in; it is stored in your browser's local extension storage (chrome.storage.local) on your device. It is transmitted to exactly one place: api.instantly.ai, over HTTPS, as the authorization for your own export requests. It is never sent to us or anyone else.
• Your email data. Emails travel directly from Instantly's API to your browser, are held locally (in memory and in your browser's IndexedDB while an export is running or paused), and are written to the file you download. They never touch any ReplyVault infrastructure — none exists.
• Your license key (paid tier only). To confirm a purchase, the extension sends the license key string — and nothing else — to our payment provider, Polar (api.polar.sh), at most once per day. Polar's handling of purchase data is described in Polar's privacy policy.

What we collect

Nothing. The extension contains no telemetry, no analytics, no error reporting, no tracking pixels, and no remote code. We cannot see who uses it or how.

What this website collects

This is a static site with no analytics scripts and no cookies set by us. Our hosting provider (Cloudflare Pages) may log requests (IP address, user agent) to operate the service, per Cloudflare's privacy policy.

Payments

Purchases are processed by Polar (merchant of record). We never see your card details. The purchase gives you a license key; validating that key is the only contact the extension ever has with Polar.

Data retention and deletion

Everything the extension stores lives on your device: settings, the API key, license cache, and any in-progress export buffer. Removing the extension (or clearing its site data) deletes all of it. Interrupted export buffers are automatically discarded after 7 days.

Permissions, in plain language

• storage — remember your settings and export progress on your device.
• downloads — save the CSV/JSON file you asked for.
• Host access to api.instantly.ai — fetch your emails for you.
• Host access to api.polar.sh — check a license key you enter.

The extension requests no access to your browsing, tabs, cookies, or any other site.

Changes

If this policy changes, the new version will be posted at this URL with an updated effective date. Because the architecture is no-backend by design, changes can only narrow, not widen, what we could ever collect without a new extension version you'd have to install.

Contact

Questions: support@reply-vault.com