ReplyLocal — Privacy Policy

Browser extension (Chrome & Edge) · Effective July 1, 2026

The short version: nothing leaves your browser until you click Generate. When you do, the review you clicked and your business name are sent to my server to write one draft reply, and that text is never stored — the server keeps only a random install ID and a monthly usage count. No browsing history, no analytics, no ads, no sale of data. And ReplyLocal never posts anything — you review, edit, and post every reply yourself in Google's own interface.

ReplyLocal is built and operated by Nathan Avery (Nathan Avery Dev), a solo developer in Oklahoma City. It is a browser extension that adds a "Draft reply" button to the Google Business Profile review-management screens. This policy explains exactly what data moves where, what is stored, and what is not collected at all.

1. What is sent, and only when you ask

The extension sends data to my server only when you click Generate on a specific review. That request contains:

The review you clicked — its text, star rating, and the reviewer's display name as it already appears on the review card.
Your business name (and, if you set one in the extension's options, your business type) so the draft fits your business.
Your draft settings — tone, length, and any optional notes you typed for that reply.
A random install ID (a UUID generated when you install the extension) used only to count free-tier usage, and your license key if you entered one.

Nothing is read or sent in the background. The extension only runs on the three Google review-management surfaces listed in §5, and even there it sends nothing until you click Generate.

2. Where it goes

The request goes to my API running on Google Cloud Run (Google Cloud, us-central1). The server forwards the review text and business details to Anthropic's Claude API to generate the draft, then returns the draft to your browser. That processing is transient: the review text exists on the server only for the duration of the request. Anthropic's handling of API requests is governed by Anthropic's privacy policy and its commercial API terms.

If you enter a license key, the server also sends that key to Gumroad's license-verification API to confirm your purchase is active. Gumroad's handling is governed by Gumroad's privacy policy.

3. What is stored

On my server (Google Cloud Firestore):

Your random install ID with a count of drafts generated this month and first/last-seen timestamps — this is how the 10-free-drafts-per-month tier is enforced.
If you use a license key: a SHA-256 hash of the key (not the key itself) with its verification status, cached for about 72 hours so I don't have to re-check Gumroad on every draft.
Server logs contain status codes and counts only — never review text, reviewer names, or drafts.

In your browser (chrome.storage.sync): your install ID, your license key if you entered one, and your saved defaults (tone, business type, sign-off). This stays in your browser profile and syncs only through your own browser account, the same way any extension setting does.

4. What is NOT collected — at all

No browsing history. The extension cannot see and does not touch pages outside the three Google surfaces it runs on.
No analytics or tracking. There is no analytics library, no tracking pixel, no error-reporting service, no third-party scripts.
No stored review content. Review text is processed to generate your draft and then discarded.
No sale or sharing of data. I do not sell data, share it with data brokers, or use it for advertising — and there is essentially nothing to sell, because nothing beyond a usage counter is retained.
No accounts. The extension has no sign-up; the free tier is keyed to the random install ID only.

5. Permissions, and why each exists

storage — saves your install ID, license key, and defaults in your browser.
business.google.com — shows the "Draft reply" button in the Google Business Profile manager's review list.
google.com/maps — shows the same button in the Google Maps review-management panel.
google.com/search — shows the same button in the profile manager that Google embeds directly in Search results for owners.

Those are the only permissions requested. There is no tabs, history, or all-sites access.

6. It never posts for you

ReplyLocal drafts text. It does not post, schedule, or submit replies — the draft appears in a panel with Copy and Insert buttons, and you click Google's own reply button after reading and editing it. This is a deliberate design decision, not a limitation.

7. Chrome Web Store Limited Use

ReplyLocal's use and transfer of information received from Google APIs and from the pages it runs on adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements: data is used only to provide the single, user-visible feature (drafting the reply you asked for), is not transferred except to the service providers named in §2 as needed to provide that feature, is never sold, and is never used for advertising or creditworthiness purposes.

8. Retention and deletion

Uninstalling the extension removes everything stored in your browser.
The server-side usage counter is keyed only to a random ID that identifies an install, not a person. If you want it deleted anyway, email me — I'll walk you through finding your install ID in the extension's stored settings and delete the record.
License-key verification records (the hash and its status) are re-checked against Gumroad roughly every 72 hours and are deleted on request the same way.

9. Changes to this policy

If this policy changes, the updated version will be posted at this URL with a new effective date. This page is the canonical version linked from the Chrome Web Store and Edge Add-ons listings.

10. Contact

Nathan Avery — Nathan Avery Dev, Oklahoma City, OK
Email: nathan@nathanaverydev.com