Privacy policy

Last updated September 27, 2026

ReplyWrench is run by BYBOWU (bybowu.com). This policy explains what we collect when you use replywrench.bybowu.com and why. Questions: [email protected].

What we collect

• Your account: email, a hashed password, and the business details you enter in setup and settings (name, trade, city, phone, voice notes, Google review link).
• Job cards: your customer's first name, the job type, the town and the tech's name. A customer's phone number or email, if you type one, stays on your device to open your Messages or email app. It is never sent to us or stored by us.
• Review replies: the review text, star rating and reviewer first name you paste, the drafts we generate and the reply you choose.
• Review page visits: when a customer opens a review link from a job card, we record the time and how many times it was opened. We don't record who they are.
• Usage and billing: counts of job cards and drafts per month, AI token use, and your plan. Card details are handled by Stripe; we never see them.
• Product analytics: first-party events such as "job card created", kept for 13 months. Sign-up events also carry a random visit ID and the campaign tags of the ad or link that brought you (for example utm_source); no names, emails or ad click IDs. On our website and in the app we use Google Analytics 4 if you allow it (see Cookies).
• Landing page demo: the sample review you run is sent to Anthropic to write the example replies and isn't stored by us; a salted hash of your IP address limits demo runs and is deleted after 30 days.

Who processes it

• Anthropic writes reply drafts. We send it the review text, star rating, reviewer first name, your business name, trade, city, phone and voice settings and, if you pick one, the job type, town and tech first name.
• Stripe handles subscriptions and payments.
• Postmark sends account and digest emails.
• Google Analytics measures visits to our pages and key steps such as sign-up, with your consent where required.
• DigitalOcean hosts the app and database, and Cloudflare sits in front of it for security and speed.

We don't sell data, and we don't use your customers' information for anything other than running your account.

Cookies

We use a session cookie to keep you logged in, protect forms and, for sign-up counts, hold a random visit ID and the campaign tags of the link that brought you. It isn't shared with anyone. Google Analytics sets cookies only when analytics storage is allowed: visitors in Europe start with it off until they accept; everyone can decline in the banner. Ads storage is always off.

How long we keep it

Your account data, job cards, reviews and drafts are kept until you delete your account. Demo records are deleted after 30 days and analytics events after 13 months. Stripe keeps billing records as the law requires.

Your choices

• Export: download everything as one JSON file from Account.
• Delete: delete your account from Account. It removes your business, login, job cards, replies and tech links and cancels your subscription.
• Digest: turn the monthly email off in Settings or with the link in the email.

Security

Traffic is encrypted with HTTPS. Tech links are stored only as hashes and can be turned off at any time. API keys live in server configuration, never in code.

Changes

If we change this policy in a way that matters, we'll update the date above and email account owners.