Privacy Policy
Last updated 7 September 2026
Replyyyy is an email provider. This policy explains what it stores, why, who it is shared with, and how to get rid of it. It is written to be read, not to be survived.
Who runs this service
Replyyyy is operated by an independent developer. Contact: support@makesuretheyfarrive.com. For privacy requests, use the same address.
What Replyyyy stores
| Data | Why |
|---|---|
| Your email messages, including the original message exactly as it arrived, attachments, sender and recipient addresses, subjects and bodies | This is the service. A mail provider that does not keep your mail is not one. |
| Your account: email address, name, password (hashed, never stored in plain text), and two-factor secret if you enable it | To let you sign in and to recover access. |
| Which mailbox addresses belong to you | To route incoming mail to the right account. |
| Sorting decisions you make — which senders you approved or blocked, and where you filed their mail | So the same mistake is not repeated on that sender's next message. |
| Addresses that permanently rejected mail or reported it as spam | To stop sending to them. Required to send mail responsibly at all. |
Google account data
If you connect a Gmail address, Replyyyy requests the gmail.send scope. This is used for exactly one purpose: when you write a reply from a Gmail identity, the message is handed to Google so it genuinely leaves your Gmail account. That is what makes the reply pass authentication checks at the recipient, and it is why the message appears in your real Gmail Sent folder.
Alongside it, Replyyyy requests openid and email, which reveal your email address and nothing about your mailbox. These are needed because the sending permission on its own does not tell Replyyyy which address you connected — without them we would have to ask you to type it and take your word for it, and a mismatch would break sending in a way that is hard to explain. Your address is stored so the app knows which identity to send from.
Replyyyy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- Google user data is used only to provide the sending feature described above.
- It is not transferred to anyone else, except as needed to provide that feature, to comply with law, or as part of a merger or acquisition with your consent.
- It is not used for advertising, and no advertising profile is built from it.
- No human reads it, except with your explicit permission for support, for security reasons, or where the law requires it.
Access tokens obtained from Google are stored encrypted and used only to send the messages you compose. You can revoke access at any time from your Google account permissions page, or by disconnecting the identity in Replyyyy. Revoking stops sending from that address immediately.
Mail forwarded from Gmail into Replyyyy arrives as ordinary email, not through a Google API. Replyyyy has no access to your Gmail mailbox.
How your mail is protected
- All connections use TLS. Mail is stored on infrastructure operated by Cloudflare and Amazon Web Services, encrypted at rest by those providers.
- Every message body is stripped of executable content — scripts, embedded frames and script URLs — before it is stored, so opening a message cannot run a sender's code.
- Passwords are hashed. Two-factor authentication is available.
- Attachments are addressed in a way that requires you to hold a message referencing them; naming a file is not enough to read it.
Who your data is shared with
Nobody, other than the infrastructure providers required to run an email service. Your mail is not sold, rented, or used to train anything.
| Provider | Role |
|---|---|
| Cloudflare | Receives inbound mail, stores messages and attachments, hosts the database |
| Amazon Web Services (SES) | Delivers outbound mail |
| Vercel | Runs the application |
| Only if you connect a Gmail identity, to send from that address |
How long it is kept
Your mail is kept until you delete it or close your account. When you close your account, your messages, attachments, mailbox addresses and sorting decisions are deleted within 30 days. Addresses on the delivery suppression list are kept after that, because they record a recipient's refusal to receive mail and forgetting it would mean mailing them again.
Your choices
- Export. You can request a full copy of your mail in a standard mailbox format at any time.
- Deletion. You can delete individual messages, or close your account and have everything removed.
- Access and correction. Write to the address above and you will get an answer from a person.
- Disconnect Google. Revoke access at any time; nothing else about your account changes.
Children
Replyyyy is not intended for use by children under 13, and accounts are not knowingly created for them.
Changes to this policy
If this policy changes in a way that affects how your mail is handled, the change will be announced by email to your account address before it takes effect. The date at the top of this page always reflects the current version.