Privacy

The default is that nothing is kept

Every retention setting starts turned off. If you never open Settings, Trade Reply holds no stored conversations, no stored replies, no stored screenshots and no personalisation.

What is always recorded is a usage ledger: who made a request, which model answered, how many tokens it used, how long it took and whether it succeeded. It carries no conversation content. It exists because turning off retention must not also turn off the bill, and because a monthly quota needs a count you cannot edit from the app.

Nothing is read without an explicit tap

The keyboard never reads while you are typing. Every read happens in response to an action you named — analyse this screenshot, paste this text, refine this draft. The clipboard is read only when you tap Paste, never to decide whether to offer pasting.

Secure fields are refused

The AI panel does not appear in password fields, numeric and phone pads, or fields an app has marked as not wanting suggestions. The check errs toward refusing: an AI key that does nothing where it might have worked is a worse feature, but reading a field the app asked us not to help with is a broken promise.

What leaves your phone, and when

• Analyse from paste, draft or selection — the text you supplied, and nothing else on screen.
• Analyse from a screenshot — usually no image at all. Your phone reads the conversation itself and sends only the text. If the conversation contains a photo your customer sent, that photo is cropped out and only the crop goes; if your phone cannot read the screenshot, the whole image is sent once. Never your photo library.
• Refine — the drafted reply only. Rewording a reply needs no conversation, so none is sent.
• Saved replies, and ordinary typing — nothing leaves the device at all.

Screenshots and photos

Most screenshots never leave your phone. The keyboards read the conversation on the device — Apple’s Vision framework on iPhone, ML Kit on Android — and send the text, the same way pasting does. Nothing is uploaded, so there is nothing to delete and nothing for a provider to keep.

An image is sent in two cases: when your customer sent a photo, in which case that photo is cropped out of the screenshot and only the crop is sent; and when the phone cannot read the screenshot at all, in which case the whole image is sent once. Anything uploaded goes to private storage, is passed to the AI provider inline rather than as a link, and is deleted the moment it has been read unless you have turned on screenshot storage. A photo of someone’s basement is not ours to keep merely because keeping it was convenient.

Who else sees this

Trade Reply is operated by Superfime LLC. Four companies process data on our behalf, under contract, and none of them is given it to use for their own purposes:

• OpenAI — the AI provider. It receives the conversation text or image you send for a reply. Requests are sent with retention switched off, so it is asked not to keep them either.
• Supabase — the database, sign-in and file storage behind the app.
• Sentry — crash reports. A report is a stack trace, the screen it happened on, the build, your account id and your business id. It never contains a screenshot, the rendered contents of the screen, or a message.
• RevenueCat — subscription status, working with the App Store and Google Play. It sees your business id and what was purchased, never a card number.

Apple and Google process your purchase and, if you use them to sign in, your identity. Their terms govern that.

Consent, and whose data this is

Nothing reaches our AI provider until you have agreed to it, on a screen that names the provider and appears before you set up the keyboard. Every AI endpoint refuses without a recorded agreement.

The uncomfortable part is worth stating plainly: most of what gets sent is your customer’s words. Someone who texted you about their water heater never agreed to anything, and you are agreeing on their behalf. A screenshot sends everything visible in it. That is worth a second thought before sending something told to you in confidence.

Declining leaves you a working keyboard and your saved replies.

Analytics

Events record what happened, never what was said. Properties are counts, durations, and identifiers only — a database constraint rejects any field named like message content, and both writers drop anything that is not a simple value. Confidence is stored as a bucket rather than a number, because a precise score is a fingerprint of one specific request in a way “high” is not.

No data is used to track you across apps or websites.

Your controls

• Export — everything held for your business, as JSON.
• Delete conversation data — removes every analysis, conversation and screenshot record, keeping your business, services and saved replies.
• Delete account — removes you and any business you solely own, and transfers businesses you share rather than deleting a colleague’s work.

Deleting conversation data does not reset the month’s usage count. That ledger holds no conversation content, and letting a privacy control zero a billing record would make it a way to get free replies.

Children

Trade Reply is a tool for running a trade business and is not directed at children. We do not knowingly collect data from anyone under 13, and you must be old enough to enter into a contract to hold an account.

Contact

Trade Reply is operated by Superfime LLC, which is the controller of the data described here. Questions about any of it, including a request to see, correct or delete what we hold: support@tradereply.co.