Replyo Get the app

Privacy Policy

Effective date: October 8, 2026

Replyo is a mobile app, and Replyo Manager is an optional managed review reply service. Both are operated by mcode ("we", "us"). This policy explains what data we collect, why we collect it, and how we use it in the app, on this website, and when providing Replyo Manager.

The short version: we never sell your data. In the Replyo app, nothing is published until you approve it. Replyo Manager staff review drafts; under your specific written authorization, routine replies we approve are published in a scheduled batch. We send one- and two-star or otherwise sensitive reviews to you for approval. You can remove our profile access when the service ends.

1. Who we are

Replyo is developed and operated by mcode, based in Croatia (European Union). For anything related to this policy or your data, contact us at support@getreplyo.app.

2. What we collect and why

Google account authorization (OAuth token)

To connect the Replyo app to your Google Business Profile, you sign in with Google using Google's official OAuth flow. We never see or store your Google password. What we receive and store is an authorization token that allows Replyo to access your Business Profile data on your behalf. You can revoke this app access at any time in the app or from your Google account's security settings.

Replyo Manager access

If you use Replyo Manager, you invite our designated Google account as a manager of your profile after giving us written authorization for the agreed workflow. We do not ask for your Google password. Our staff use an internal dashboard to review incoming Google reviews, prepare replies, and publish them within that scope. The dashboard is for Replyo staff; client approval links only record your decision and do not give you direct access to Google's APIs. You remain the profile owner or co-owner and may remove our access; when the service ends, we remove our access within seven business days.

Business and review data

Using the authorization you give us, we access business profile information (such as business name and location) and Google reviews (such as reviewer name, star rating, review text, dates, and existing replies). In the app, we use this data to show your review inbox, sort reviews, send notifications, and generate drafts. For Replyo Manager, we use it to prepare, review, and publish responses within the service you authorized. Manager review content and reply drafts are stored temporarily in a secure queue and deleted within 29 days.

Address search

When you use address search during business profile setup, the search text and selected country are sent through our backend to Google Places to suggest addresses. Selecting a suggestion retrieves its address details for your form. We do not store the list of suggestions or your search history. We retain request counters to limit misuse while your Google connection is active. The address you confirm is used for creating and verifying your business profile. Google's handling of this information is described in the Google Privacy Policy.

Account information

Replyo creates an anonymous internal account reference stored on your device. Google Business Profile authorization is associated with this reference. We do not receive your Google account email or account name through this authorization flow. Reviewers’ public names and your business name are part of the review and business data described above.

Replyo Manager communications

For Replyo Manager, we store the client contact email and the written-authorization record needed to operate the service. We send an email with a secure, time-limited link when reviews need your approval, and we notify you separately after replies are published. The review page lets you approve a response, request a revision, or suggest your own wording. Suggested revisions return to the Replyo team for review before publication; an approved response is scheduled for the next publishing batch.

Website inquiries

When you contact us through the Replyo Manager website, we use the business name, contact email, message, optional public Google profile link and language you provide to respond to your inquiry and discuss the service. The form sends these details to our support inbox through Amazon SES; it does not grant access to your profile or subscribe you to marketing messages. To limit automated submissions, we temporarily store request counters linked to a keyed hash of the connection IP address, rather than the raw address. The counters expire after two hours and are removed by our daily cleanup job. You can ask us to delete inquiry correspondence by contacting support@getreplyo.app.

Website language

Our website uses Firebase Hosting to determine the approximate country of a connection from its IP address and select Croatian or English on the main entry pages. You can change the language using the EN/HR links. An explicit language choice is stored in your browser so we can remember it on future visits; it remains there until you change your choice or clear this site's browser storage. This preference is used only to select the website language.

Device push token

A push notification token issued by Apple or Google for your device, so we can send you a notification when a new review arrives. This token identifies your device for notifications only — it does not give us access to anything else on your phone.

Subscription status

If you subscribe to Replyo Pro, Apple or Google processes the payment. We never see your card number or payment details. We receive only your subscription status (active, expired, cancelled) from the App Store or Google Play so we can unlock Pro features for you.

Basic analytics and diagnostics

The current app does not include a usage analytics or crash-reporting SDK. Our service providers process operational logs needed to run and protect their services. We do not use your review content for advertising.

Pre-launch waitlist email

Before Replyo launched, visitors could leave an email address and submission date so we could send one availability notice. The website no longer offers waitlist sign-ups. We do not add these addresses to a newsletter or use them for other purposes. Ask us at support@getreplyo.app to delete a previous waitlist entry. We delete the list after launch emails have been sent.

3. What we do NOT do

4. AI-generated reply drafts

When you ask the Replyo app to draft a reply, the review text and relevant business context (such as your business name and preferred tone) are sent to OpenAI after the app asks for your permission. For Replyo Manager, review rating, review text, and business-provided response preferences may also be sent to OpenAI to prepare a reply draft under the authorization you give us. We do not need to send the reviewer's display name for this drafting. This processing is only to generate a draft. We disable Responses API application-state storage for these requests; provider security and abuse-monitoring retention may still apply. Demo example drafts are generated locally and do not contact OpenAI. App drafts are suggestions and are not published until you send them; Manager replies follow the separate workflow described above.

5. How your data is stored and secured

Your data is stored with reputable cloud infrastructure providers, encrypted in transit and at rest. Access tokens are stored securely and are used only to perform the actions you have requested. We limit internal access to personal data to what is strictly necessary to operate and support the service.

6. Data sharing

We share data only with the service providers necessary to run Replyo: Google/Firebase for authorization, hosting, database and app identity; Expo, Apple and Google for push delivery; OpenAI for AI drafting; our transactional email provider for Manager approval links and service notices; and RevenueCat plus the app stores for subscription management. Each provider processes data for the purposes described in this policy. We may also disclose data if required by law.

7. Data retention and deletion

We keep app data while your account is active. If you delete your account (available in the app's settings, or through a deletion request), we delete your personal data, stored review data, and OAuth tokens through the in-app deletion flow or within 30 days for a verified support request, except for records we must keep by law. For Replyo Manager, content obtained from Google Business Profile APIs, including review text and reply drafts, is kept securely and temporarily for no more than 29 days, then deleted. Approval tokens expire and are deleted with the review item. Separate service and authorization records may be kept as needed for billing and legal obligations, without retaining the review content. When the service ends, we remove our Google profile access within seven business days. Disconnecting your Google account from the app stops further app data fetching.

8. Your rights (GDPR and CCPA)

If you are in the European Economic Area or the United Kingdom, you have rights under the GDPR, including the right to access, correct, export, delete, and restrict the processing of your personal data, and the right to lodge a complaint with your local data protection authority. Our legal bases for processing are the performance of our contract with you (providing the app) and our legitimate interest in keeping the service secure and improving it.

If you are a California resident, you have rights under the CCPA/CPRA, including the right to know what personal information we collect, the right to delete it, and the right to opt out of its sale — noting that we do not sell personal information.

To exercise any of these rights, email support@getreplyo.app. We respond to all requests within 30 days.

9. International data transfers

Replyo is operated from the European Union. Where data is processed outside the EEA (for example, by cloud or AI providers), we rely on appropriate safeguards such as Standard Contractual Clauses.

10. Children

Replyo is a tool for business owners and is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

If we make material changes to this policy, we will notify you in the app or by email before the changes take effect, and we will update the effective date above.

12. Contact

Questions, concerns, or requests: support@getreplyo.app.