Privacy Policy

1. Introduction and Scope

Welcome to ReplyContext. This Privacy Policy explains how helpful bits GmbH ("Company," "we," "us," or "our") collects, uses, discloses, and protects information about you when you use our ReplyContext mobile application, website located at replycontext.com, and related services (collectively, the "Services").

ReplyContext is a mobile application that turns your stated intent, optionally together with a message you captured (shared or pasted text, or a screenshot), into one AI-drafted reply, which you review, edit, and copy into the conversation yourself.

By accessing or using our Services, you agree to this Privacy Policy and our Terms of Service. If you do not agree with this Privacy Policy, please do not use our Services.

We reserve the right to modify this Privacy Policy at any time. We will notify you of material changes by updating the "Effective Date" above and, where appropriate, by sending you an email notification or displaying a prominent notice within our Services. Your continued use of the Services after any changes indicates your acceptance of the updated Privacy Policy.

2. Company Information

ReplyContext is operated by helpful bits GmbH, a German limited liability company (Gesellschaft mit beschränkter Haftung) organized under German law, offering services to users in the United States, European Union, European Economic Area, and United Kingdom.

For users in the European Union and European Economic Area, helpful bits GmbH serves as the data controller responsible for your personal information collected through the Services.

For users in the United States, helpful bits GmbH operates subject to applicable U.S. federal and state privacy laws, including state-specific privacy regulations described in Section 10 of this Privacy Policy.

3. Where Your Data Is Processed

ReplyContext's application backend and database are hosted in Germany, in the European Union, for all users. If you use the Services from the United States, your service data is processed on those EU systems; this Privacy Policy exists to describe your rights under U.S. law, not to indicate U.S. hosting. ReplyContext does not request precise device location and does not select where your account data is stored based on your location. AI model processing for reply requests takes place through the model processor disclosed on our sub-processors page, whose processing may take place outside the EU/EEA.

4. Notice at Collection: Information We Collect

We collect several categories of information from and about users of our Services. The following table provides a comprehensive overview of the personal information we collect, the sources from which we collect it, the purposes for which we use it, and whether we disclose it to third parties.

Note: We do not collect sensitive personal information such as Social Security numbers, driver's license numbers, financial account information (processed by Apple or Google), precise geolocation data, racial or ethnic origin, religious beliefs, genetic data, biometric data for identification purposes, health information, or information about sex life or sexual orientation.

5. How We Use Your Information

We use the information we collect for the following purposes:

5.1 Provision of Services

• Operating and maintaining the ReplyContext application and services
• Generating and refining replies from the intent, instructions, and any captured message you submit, through a single AI model call per request
• Maintaining optional per-user memory records (numeric style signals derived from accepted edits)
• Retaining reply operation records for idempotent billing and feedback verification
• Providing the share extension and text-selection entry points

5.2 Account, Subscription, and Purchase Management

• Creating and maintaining your account
• Authenticating your identity
• Managing subscriptions and, if offered, reply credit purchases
• Verifying subscriptions through Apple's App Store and any credit pack purchase through the store where it was bought
• If you buy a credit pack, crediting it to your account, recovering an unfinished purchase, and adjusting credit for refunds or voids
• Communicating subscription status and renewals

5.3 Communications

• Responding to your inquiries and support requests
• Sending service or legal notices when required

5.4 Service Improvement and Development

• Reviewing aggregate reply counts, token use, latency, and error outcomes
• Testing and troubleshooting technical and billing issues

5.5 Security and Fraud Prevention

• Detecting and preventing fraud, abuse, and security incidents
• Using request IP information for rate limiting and abuse prevention
• Protecting against unauthorized access and use
• Investigating suspicious activity
• Maintaining system integrity and security

5.6 Legal Compliance

• Complying with applicable laws, regulations, and legal processes
• Responding to government requests and law enforcement
• Enforcing our Terms of Service and other agreements
• Protecting our legal rights and interests
• Resolving disputes and preventing prohibited activities

5.7 Aggregate Operational Data

We may aggregate operational counts and costs so they no longer identify an individual account. We use those aggregates to operate the Service, understand capacity and cost, and diagnose reliability.

6. Mobile Application Privacy

6.1 Local Data Storage

ReplyContext stores certain information locally on your device to provide functionality:

• User preferences and settings
• Your replies, each with the messages, screenshots, and words you captured for it. A reply you have not copied stays until you delete it. A copied reply stays for 30 days by default; in Settings, under Reply History, you can keep copied replies for 7, 30, or 90 days, or turn off "Keep copied replies" to remove each reply the moment you copy it. You can delete any reply, or all copied replies, yourself.
• Your personal vocabulary for dictation (names and terms you add), stored only on the device until you delete it
• Authentication tokens (stored securely in the platform keystore)

Local data remains on your device and is transmitted to our servers when you request transcription, a reply, or a revision.

6.2 Capture Surfaces

The application receives content only when you explicitly hand it over:

• iOS Share Extension: Receives what you share to it and can draft the reply in place; it does not read other content on your screen
• In the App: Receives only the text you paste and the screenshots or files you pick from Photos or Files
• Android Share and Process Text: The system share sheet and text-selection action pass only the items you select
• Dictation: When you tap the microphone, the main app asks for microphone permission and records up to 60 seconds. It sends the recording, and your personal vocabulary if you added one, through the ReplyContext server to Google Gemini for transcription; the app asks you to confirm this before your first recording. Gemini uses the vocabulary only as a spelling reference. Temporary audio is deleted after upload, cancellation, or interruption; neither audio nor transcript is stored in the ReplyContext application database. The editable transcript stays in your local draft under its retention controls.
• No Background Collection: ReplyContext does not read your notifications, keyboard input, or screen content, and does not request privileged access such as notification listeners or accessibility services

6.3 Device Permissions

Our application may request the following permissions:

• Network Access: Required to communicate with our servers
• Microphone: Requested when you first use dictation, and used only while you record
• Photos and Files: No permission is requested; the system picker gives the app only the screenshots or files you pick

You can manage these permissions through your device's Settings app. Denying permissions may limit functionality.

6.4 Data Deletion on Uninstall

Local capture and reply history is controlled by the app and your device. Uninstall behavior depends on the operating system, backup settings, and platform policies. Before uninstalling, use the app's local-data controls when you want to remove its working copies. Server-side data is separate:

• Data stored on our servers (account information, memory records, reply operation records) will remain until you request deletion
• Operating-system backups or platform-managed data may follow the platform vendor's policies
• To fully delete your account and server-stored data, use Delete Account in the app's Settings or contact us at Email

7. Information Sharing and Disclosure

We share your information with third parties only in the limited circumstances described below. We do not sell your personal information.

7.1 Third-Party AI Processing

To provide our core Service, the ReplyContext server in Germany (EU) sends any captured message, your stated intent, any instructions, and any retrieved style signals directly to Google’s Gemini API. Each reply generation or revision involves a single model call. Dictation recordings, with any personal vocabulary, take the same route for transcription.

The processors currently involved in AI processing are listed on our sub-processors page. They process your data according to our data processing agreements with them and their published terms.

7.2 Service Providers

We engage third-party companies and individuals to perform services on our behalf, including:

• Cloud hosting and infrastructure providers
• Data storage and database services
• Security and fraud prevention services

These service providers have access to your information only to perform tasks on our behalf and are obligated not to disclose or use it for other purposes.

7.3 Payment Processors

Payments are processed by the store you purchase through. Apple's App Store processes iOS subscriptions and, if a reply credit pack is offered in the app, credit pack purchases; Google Play processes credit pack purchases if a released Android app offers them. Apple and Google process your payment details according to their own privacy policies and terms; we do not receive your payment card details.

We receive only the limited transaction data needed to operate your account: transaction confirmation and status, subscription and purchase status, and store transaction identifiers. For a Google Play purchase this is the product id, purchase token, purchase state, and an obfuscated account identifier. We use this data to verify the purchase, credit your account, recover an unfinished purchase, record credit consumption, and adjust credit when a store refunds or voids a purchase.

7.4 Business Transfers

If helpful bits GmbH is involved in a merger, acquisition, asset sale, bankruptcy, or other business transaction, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice in our Services of any change in ownership or use of your personal information.

7.5 Legal Requirements and Protection of Rights

We may disclose your information if required to do so by law or if we believe in good faith that such action is necessary to:

• Comply with legal obligations, court orders, or government requests
• Enforce our Terms of Service or other agreements
• Detect, prevent, or address fraud, security, or technical issues
• Protect the rights, property, or safety of helpful bits GmbH, our users, or the public
• Investigate potential violations of our Terms or policies

7.6 Aggregated or De-identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify you. This may include usage statistics, industry trends, or demographic information shared with partners, researchers, or the public.

7.7 With Your Consent

We may share your information with third parties when we have your explicit consent to do so.

8. Third-Party AI Data Processing

The core function of ReplyContext is drafting a reply from the content you submit. This section provides additional detail about how your data is handled in this process.

8.1 Data Transmitted for a Reply Request

When you request a reply or revision, the ReplyContext server sends the following information directly to Google’s Gemini API:

• Any captured message content (text or screenshot)
• Your stated intent and any instructions
• The numeric style signals retrieved for the request, when memory is enabled

8.2 Third-Party Message Content

A captured message usually contains content written by another person. That content is processed solely to draft your reply, is treated as untrusted data rather than instructions, and is not persisted in the ReplyContext application database after the request. Google handles the request under the terms disclosed on our sub-processors page.

8.3 Minimizing Data Transmission

To protect your privacy, we:

• Transmit content only when you explicitly request a reply
• Send only the content you captured for that request - we have no access to your other messages, notifications, or typing
• Make exactly one model call per generation or revision
• Do not retain the captured message, your intent, your instructions, your personal vocabulary, or the reply text after the request completes
• Do not use your content to develop or train ReplyContext-owned AI models; third-party processor terms are disclosed separately

8.4 AI Provider and Model

The AI provider and model are determined by us server-side, and the processors involved are listed on our sub-processors page.

9. Data Security

We implement reasonable administrative, technical, and physical security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure.

9.1 Security Measures

• Encryption: Data transmitted between your device and our servers is encrypted using industry-standard TLS/SSL protocols
• Secure Storage: Sensitive data stored on your device is protected using iOS Keychain and encryption
• Access Controls: We implement strict access controls to limit who can access user data
• Authentication: We use secure authentication mechanisms to protect your account
• Monitoring: We monitor our systems for suspicious activity and potential security incidents
• Regular Updates: We regularly update our security practices and software to address new threats

9.2 Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and relevant authorities as required by applicable law. Notification will be provided via email to the address associated with your account and/or through a prominent notice in our Services.

9.3 Your Security Responsibilities

You are responsible for maintaining the security of your account credentials. We recommend:

• Protecting the Apple or Google account you use to sign in
• Not sharing your account credentials with others
• Keeping your device and iOS software up to date
• Using device security features like passcodes, Face ID, or Touch ID
• Immediately notifying us if you suspect unauthorized access to your account

10. State-Specific Privacy Rights (United States)

Residents of certain U.S. states have specific privacy rights under state law. This section describes rights available to residents of California, Virginia, Colorado, Connecticut, and Nevada.

10.1 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know

You have the right to request disclosure of:

• Categories and specific pieces of personal information we have collected about you
• Categories of sources from which we collected your personal information
• Our business or commercial purposes for collecting or selling personal information
• Categories of third parties with whom we share personal information
• Specific pieces of personal information we have about you

Right to Delete

You have the right to request deletion of personal information we have collected from you, subject to certain exceptions under California law.

Right to Correct

You have the right to request correction of inaccurate personal information we maintain about you.

Right to Opt-Out of Sale or Sharing

We do not sell your personal information as defined by California law. If our practices change, we will update this Privacy Policy and provide you with notice and an opportunity to opt out.

Right to Limit Use of Sensitive Personal Information

We do not use or disclose sensitive personal information for purposes other than those permitted under CPRA without providing you the right to limit such use.

Right to Non-Discrimination

You have the right not to receive discriminatory treatment for exercising your CCPA/CPRA rights. We will not:

• Deny you goods or services
• Charge different prices or rates, including through discounts or penalties
• Provide a different level or quality of goods or services
• Suggest you will receive different prices, rates, or quality of goods or services

Authorized Agent

You may designate an authorized agent to make requests on your behalf. We may require verification that you authorized the agent and verification of your identity.

California "Shine the Light" Law

California Civil Code Section 1798.83 permits California residents to request information regarding disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

10.2 Virginia Privacy Rights (VCDPA)

If you are a Virginia resident, you have the right to:

• Confirm whether we are processing your personal data and access such data
• Correct inaccuracies in your personal data
• Delete personal data you provided to us
• Obtain a copy of your personal data in a portable format
• Opt out of targeted advertising, sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects

10.3 Colorado Privacy Rights (CPA)

Colorado residents have similar rights as Virginia residents under the Colorado Privacy Act, including rights to access, correct, delete, and obtain a portable copy of personal data, as well as opt out of certain processing activities.

10.4 Connecticut Privacy Rights (CTDPA)

Connecticut residents have rights similar to Virginia and Colorado residents under the Connecticut Data Privacy Act, including rights to access, correct, delete, data portability, and opt-out rights.

10.5 Nevada Privacy Rights

Nevada residents have the right to opt out of the sale of certain covered information we have collected about you to third parties. We do not currently sell your covered information as defined under Nevada law. If our practices change, we will update this Privacy Policy and provide Nevada residents with an opt-out opportunity.

10.6 Exercising State Privacy Rights

To exercise any of the rights described above, please contact us at Email with "State Privacy Rights Request" in the subject line. We will verify your identity before processing your request and respond within the timeframe required by applicable state law.

11. International Data Transfers

helpful bits GmbH is a German company, and ReplyContext's application backend and database are hosted in Germany, in the European Union, for all users. If you are in the United States, this means your account data, memory records, and reply operation records are transferred to and processed in Germany. AI model processing for reply requests may take place outside the EU/EEA, as described on our sub-processors page.

11.1 EU/EEA/UK Users

If you are located in the European Union, European Economic Area, or United Kingdom, your personal data may be transferred to and processed in the United States and other countries that may not provide the same level of data protection as your home country.

We implement appropriate safeguards for international data transfers, including:

• Standard Contractual Clauses approved by the European Commission
• Ensuring service providers comply with GDPR requirements
• Implementing technical and organizational measures to protect data
• Conducting data protection impact assessments where required

11.2 Legal Basis for Processing (GDPR)

For users in the EU/EEA/UK, we process your personal data based on the following legal grounds:

• Contractual Necessity: Processing necessary to provide Services under our Terms of Service
• Legitimate Interests: Processing for fraud prevention, security, service improvement, and business operations
• Legal Obligations: Processing to comply with applicable laws and regulations
• Consent: Processing based on your explicit consent (which you may withdraw at any time)

11.3 GDPR Rights

If you are subject to the General Data Protection Regulation (GDPR), you have additional rights:

• Right of access to your personal data
• Right to rectification of inaccurate personal data
• Right to erasure ("right to be forgotten") in certain circumstances
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on legitimate interests
• Right to withdraw consent (where processing is based on consent)
• Right to lodge a complaint with a supervisory authority

12. Children's Privacy

Our Services are not directed to individuals under the age of 18, and we do not knowingly collect personal information from children under 18. If you are under 18, do not use our Services or provide any information to us.

If we learn that we have collected personal information from a child under 18 without verification of parental consent, we will delete that information as quickly as possible. If you believe we might have information from or about a child under 18, please contact us immediately at Email.

12.1 COPPA Compliance

Our Services comply with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect, use, or disclose personal information from children under 13. Our Terms of Service require users to be at least 18 years old.

13. Data Retention

We retain your personal information for as long as necessary to provide Services, comply with legal obligations, resolve disputes, and enforce our agreements.

13.1 Retention Periods

• Account Information: Kept while needed to operate the account, then only for applicable legal or dispute obligations
• Memory Records: Numeric style signals are kept until you delete them (individually or all at once) or the account is cleaned up, subject to legal obligations. Deleting all signals preserves your learning on/off setting.
• Captured Messages, Intent, and Reply Text: Processed transiently and not persisted in the ReplyContext application database; the copies on your iPhone follow Section 6.1
• Personal Vocabulary: Stored only on your device until you delete it; sent with each dictation request and not persisted in the ReplyContext application database
• Reply Operation Records: Operational metadata (identifiers, token counts, reply hash) kept while needed for billing integrity, feedback verification, security, and legal obligations
• Usage Data: Kept only while needed for service operation, security, and aggregate analysis
• Transaction Records: Kept for the period required by applicable tax and accounting law
• Communications: Kept while needed to resolve the request and meet legal or dispute obligations

13.2 Deletion Requests

You may request deletion of your personal data at any time by contacting us at Email. We process deletion requests within the timeframe required by applicable law, except where:

• Retention is required by law
• Data is needed to complete a transaction, provide a requested service, or fulfill our Terms
• Retention is necessary to detect security incidents or protect against illegal activity
• Data is needed to exercise or defend legal claims

14. How to Exercise Your Privacy Rights

14.1 Submitting Requests

To exercise your privacy rights, including rights to access, correct, delete, or port your data, please contact us at:

14.2 Verification Process

To protect your privacy and security, we will verify your identity before processing requests to access, correct, or delete your personal information. We may request:

• Email address associated with your account
• Account user ID
• Verification that you have access to the email address on file
• Additional information to verify your identity for sensitive requests

14.3 Response Timing

We will respond to your request within the timeframe required by applicable law:

• California (CCPA/CPRA): 45 days, with possible 45-day extension
• Virginia, Colorado, Connecticut: 45 days, with possible 45-day extension
• GDPR (EU/EEA/UK): 30 days, with possible 60-day extension for complex requests

14.4 In-App Controls

The current app provides these direct controls:

• View and delete individual style signals
• Enable or disable memory learning and retrieval together ("Learn from my edits", off until you turn it on)
• Delete all style signals (your on/off setting is kept), clear local app data, sign out, or delete the account
• Choose how long copied replies stay on your iPhone (7, 30, or 90 days), turn off "Keep copied replies", or delete any reply, or all copied replies
• Add or delete words in your personal vocabulary

14.5 Appeal Process

If we deny your privacy rights request, you have the right to appeal our decision. To appeal, respond to our denial email with "Appeal" in the subject line and explain why you believe our denial was incorrect. We will respond to appeals within the timeframe required by applicable law.

15. Do Not Sell or Share My Personal Information

We do not sell or share your personal information as defined by California and other state privacy laws.

We do not:

• Sell your personal information to third parties for monetary consideration
• Share your personal information with third parties for cross-context behavioral advertising
• Use your personal information for targeted advertising based on your activity across different services

We share your data with third-party AI providers solely to provide the Services you request, which does not constitute "selling" or "sharing" under applicable privacy laws. We also share data with service providers who perform services on our behalf, subject to contractual restrictions on their use of your information.

If our practices change in the future, we will update this Privacy Policy and provide required notice and opt-out mechanisms before implementing any sale or sharing of personal information.

16. Cookies and Tracking Technologies

16.1 Website Locale Cookie

Replycontext.com uses one functional cookie, NEXT_LOCALE, to remember the selected website language. The current site does not set analytics or advertising cookies.

16.2 Mobile App Storage

The mobile apps use platform storage for local reply data, preferences, and authentication. They do not include a third-party advertising, analytics, or cross-app tracking SDK.

16.3 Your Choices

You can remove or block the locale cookie in your browser. Doing so can make the website ask for or infer a language again; it does not affect the mobile apps.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will:

• Update the "Effective Date" at the top of this Privacy Policy
• Post the revised Privacy Policy on our website and in our mobile application
• For material changes, provide notice via email to the address associated with your account
• For material changes affecting your rights, may display a prominent notice in our Services

We encourage you to review this Privacy Policy periodically. Your continued use of our Services after changes to this Privacy Policy constitutes your acceptance of the revised policy.

If we make material changes that retroactively expand our rights to use personal information we previously collected about you, we will obtain your consent before implementing such changes.

18. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our privacy practices, or if you wish to exercise your privacy rights, please contact us:

18.1 Response Timing

We strive to respond to all privacy inquiries within a reasonable timeframe, typically within 5-10 business days for general inquiries and within timeframes required by law for privacy rights requests.

18.2 Supervisory Authority (EU/EEA/UK Users)

If you are located in the European Union, European Economic Area, or United Kingdom, you have the right to lodge a complaint with your local data protection supervisory authority if you believe our processing of your personal data violates applicable law.

18.3 California Consumer Rights Requests

California residents may also contact us via email at Email to exercise CCPA/CPRA rights. We do not discriminate against California residents who exercise their privacy rights.

19. Additional Provisions

19.1 Third-Party Links

Our Services may contain links to third-party websites, applications, or services not operated by us. This Privacy Policy does not apply to third-party services. We are not responsible for the privacy practices of third parties and encourage you to review their privacy policies.

19.2 AI-Generated Content Privacy

Replies generated by AI may not be unique. Similar inputs submitted by different users may generate similar outputs. We cannot guarantee that AI-generated content has not been generated for other users or does not contain information from other sources.

19.3 California Privacy Rights Notice

Under California Civil Code Section 1798.83, California residents are entitled to request information regarding disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

19.4 Data Protection Officer

For questions specifically related to GDPR compliance or EU/EEA data protection, you may contact our data protection team at Email with "GDPR Inquiry" in the subject line.

19.5 Accessibility

We are committed to making our Privacy Policy accessible. If you have difficulty accessing this Privacy Policy or need it in an alternative format, please contact us at Email.