Privacy Policy

The short version

• The keys, tokens and passwords you give Reddy for other services are encrypted, and only you can see them, after confirming it's you.
• Reddy never gives your secret values to an AI. Your coding assistant gets names, statuses and links from Reddy, never values.
• Reddy changes things in your accounts and deploys your app only after you approve, in Reddy.
• No ads, no selling or renting your data, and no analytics or tracking cookies.
• You can export a project, delete it, disconnect any service and remove any device at any time.

What Reddy keeps, and why

• Your account. Your name and email. Your password is stored only as a one-way hash, so nobody can read it back. For a passkey, only its public half is stored. If you sign in with Google or GitHub, Reddy receives your name, email, whether that email is verified, and a link to your profile picture. Reddy asks them for nothing else and doesn't use their access for anything but signing you in.
• Your sign-ins. For each sign-in: when it happened, the IP address and the browser. This keeps your account safe and shows you where you're signed in.
• Emails Reddy sends you. Only about your account: a link to confirm your email, password reset links, a welcome, and a notice when your password changes, a passkey is added or a new device is paired. No newsletters or marketing.
• Your projects. Each app's name, the services it uses, the names of its settings (never their values unless you save them in Reddy), setup plans, your approvals, health check results, and where its code lives: the Git address (with any password removed), the branch and the latest commit id. Reddy never stores your code.
• Things you save in Reddy for your apps. API keys, tokens and passwords for services like Supabase, Resend or Stripe; sign-ins you make with "Sign in with Supabase"; values you type into Reddy's windows; and, for your own servers, the server's address, sign-in keys and any password you give. How these are protected is below.
• Your setup preferences. Extra email addresses you add for signing up to services, and how you like to sign up (for example with Google).
• Reddy Remote tasks. The instructions you send to your own computer, the progress and results it sends back (cleaned as described under Activity and logs), and the names and status of the computers you connect.

Reddy uses all of this only to run Reddy for you: to set up and check your apps' services, show you what happened, and keep your account safe.

Your keys and passwords

• Every value is encrypted on its own (AES-256-GCM) with a key that is itself locked by a master key kept outside the database. Each value is tied to its project, service and environment, so it can't be read anywhere else.
• You can see a value only after confirming it's you (your password or a passkey), and each time you look, it's recorded in your activity.
• No answer Reddy gives to a tool, no log, no activity record and no AI ever contains a secret value.
• Values leave Reddy only where you approve: once, into your app's settings file on your computer, or into your hosting provider's settings for production. Production values never go into a file on your computer.
• When you disconnect "Sign in with Supabase", Reddy also cancels that sign-in at Supabase.

AI and your data

Reddy does almost nothing with AI itself, and never with your values, your code or your projects' data. The thinking (what your app needs, reading errors, writing code) is done by your own AI assistant. Reddy uses AI in two narrow places, both about providers' websites, not about you, and only when the operator of this Reddy has switched them on:

• Site recipes for the browser helper. To know where to point on a provider's page, Reddy may send a description of that page (its labels, fields and buttons) to Anthropic's Claude. Anything that looks like a key, a token or an email address is removed in your browser before the description exists, and again on Reddy's server; password fields are only ever described as "a password field". The goal is to work out each site once and reuse it for everyone, so this rarely happens.
• Researching a service Reddy doesn't know yet. Reddy may ask Claude to read that provider's official documentation. It sends the provider's name and what the app uses it for.

Your AI coding assistant (Claude Code, Cursor or another) is yours, and what you tell it is between you and its maker. Reddy gives it names, statuses and links, never secret values.

The browser helper (Chrome extension)

• It runs only on the provider pages it supports (Supabase's dashboard and Resend today) and on Reddy's own site, and only during a setup you start in Reddy. A session ends after 30 minutes, or when you stop it.
• It reads the page's labels and fields to show you what to fill in. It never reads what's typed in a password field, and it hides anything that looks like a key, token or email address before describing the page to Reddy.
• It reads the name of the account you're signed in to on the provider only to ask "use this account?". That name stays in your browser and is never sent to Reddy.
• A new key or token goes to Reddy only when you click Send to Reddy and confirm. A verification code you paste into it goes into the page, nowhere else.
• It never clicks create, pay or delete buttons, never accepts terms for you, never signs you in, and never solves "are you a person?" checks.
• It asks Chrome for two permissions only: storage (for the current session, kept in memory) and access to Reddy's own site. It can't see other sites, your tabs or your browsing history.
• The use of information received from the browser helper adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.

Devices and notifications

• When you add a phone or computer as one of your devices, Reddy keeps the name you give it, its browser and operating system, and when it was last seen. Computers you connect for Reddy Remote report their name, which projects they have, and whether they're online.
• If you turn on notifications, your browser gives Reddy an address and keys for sending them, which Reddy stores encrypted. A notification says things like "Waiting for your OK" with the project's name. It is encrypted for your device and delivered by your browser's push service (Google, Apple or Mozilla, depending on the browser), which can't read it. Turn notifications off at any time in Settings.

Health checks

About once an hour, Reddy uses the credentials you saved to make read-only checks against your services: that a key still works, a project isn't paused, a sending domain is still verified. Results are kept in each project's history, and you're told when something breaks. These checks never change anything. Tests that would change something, like a test sign-up or a test payment, only run if you turn them on, in test mode, and are cleaned up afterwards.

Activity and logs

Reddy records what it did for you (for example "synced 4 settings to Vercel") so you can see it under Activity. Records use the names of settings, never their values. Before anything from a deploy, a server or a task is kept, Reddy removes the values it knows and anything that looks like a credential, and keeps only the end of long output. Our hosting provider also keeps short-lived technical logs of requests to the website.

Who else is involved

We don't sell or rent your data, and there are no ads. These services help run Reddy, and see only what their job needs:

• DigitalOcean hosts the Reddy website, app and database.
• Resend delivers Reddy's account emails, like password resets.
• Anthropic runs the AI uses described above, when they are switched on.
• Google and GitHub sign you in, only if you choose them.
• Browser push services deliver encrypted notifications, if you turn them on.

The services you connect (for example Supabase, Resend, Stripe, Vercel or DigitalOcean) receive requests from Reddy on your behalf, using the credentials you gave, and only for things you set up or approved. Their own privacy policies apply to the data they hold for you.

We'll share data with authorities only when the law requires it, and we'll tell you unless we're not allowed to.

Cookies

Reddy uses a cookie to keep you signed in, one to remember light or dark mode, and short-lived ones while you sign in with Google, GitHub or Supabase, which stop forged sign-ins. That's all: no analytics, advertising or tracking cookies. If you install Reddy on your phone, it keeps a copy of public files (like the logo) for speed, never your data.

How long Reddy keeps data

• Your account and projects stay while your account is open.
• Sign-in sessions end after 14 days without use, or when you sign out.
• When you delete a project or remove a credential, it's removed from the database straight away and from backups as they roll over.
• When your account is deleted, everything above goes with it, the same way.

Export, delete and your rights

• Export a project from its page: everything needed to run the app without Reddy, except secret values, which stay in your settings files and your providers' dashboards.
• Delete a project, disconnect a service, remove a device or a computer, or revoke an AI tool's access, all from the app.
• Delete your account by writing to [contact email] from your account's email. We'll confirm and delete it within 30 days.
• Get a copy of everything we hold about you, or correct it, by writing to the same address.

Depending on where you live (for example the European Union, the United Kingdom, South Africa or California), the law may give you more rights, such as objecting to how your data is used or complaining to your data protection authority. Write to us and we'll help.

Security

Everything travels over HTTPS. Credentials are encrypted as described above. Changes in your services and deploys need your approval in Reddy; a "yes" typed into a chat never counts. Each AI tool and computer has its own access, which you can revoke on its own. No system is perfect: if we learn that your data was exposed, we'll tell you without delay and say what we're doing about it.

Children and changes

Reddy isn't meant for anyone under 16, and we don't knowingly keep data about them.

If this policy changes, the new version will be here with its date. For an important change, we'll also email you before it applies.

Contact

Questions, requests or worries about your data: [contact email]. Reddy is run by [company name].