Security & data handling

• TLS 1.3 in transit

  All traffic between your device and our servers is encrypted.

• AES-256 at rest

  Data stored in our database and object storage is encrypted at rest.

• EU hosting

  Your account and profile live in the EU (Supabase, Frankfurt region).

• Row-level security

  Every table enforces per-user access at the database layer.

• No AI training

  Your conversations are never used to train ReplyNow's or providers' models.

• Automatic deletion

  Uploaded screenshots and text are discarded as soon as replies are generated.

• Google OAuth + HIBP

  Sign in with Google or a strong password checked against known breaches.

• Least-privilege access

  Only a small number of engineers can access production, using SSO + MFA.

1. You upload a screenshot or paste text into ReplyNow over HTTPS.
2. The content is sent to the AI model via the Lovable AI Gateway with a no-training data agreement.
3. Four replies come back to your browser. The original upload is discarded on our side within seconds.
4. Only metadata (timestamp, goal, generated reply text) is retained — in your browser's local storage, not on our servers.
5. Delete your account and every associated record is removed within 30 days.

We appreciate responsible disclosure. Email pekka@nebelung.io with a description of the issue and any proof-of-concept. Please give us a reasonable window to fix the issue before disclosing publicly. We do not currently run a paid bounty programme but will publicly credit researchers who ask us to.

ReplyNow is an early-stage product. We do not currently hold ISO 27001, SOC 2, or HIPAA certifications and do not offer a signed DPA to consumers. If you need any of these for a business rollout, get in touch — an enterprise tier is on our roadmap.