Privacy

Nothing is kept, and there is no setting that changes that

Retention used to be four switches that started turned off. They are gone. Trade Reply holds no stored conversations, no stored replies, no stored screenshots and no personalisation, whether or not you ever open Settings.

An analysis is held briefly while you are working with it — long enough that a keyboard whose signal dropped can retry without being charged twice. After five minutes it is no longer used, and within ten it is deleted. That buffer does contain what the model wrote, and a reply to “my drain is blocked at 42 Maple Street” will name the street, because a reply that avoided it would be useless. What we can tell you is that it does not outlive the request: the row carries an expiry from the moment it is written and a scheduled job removes it.

What is recorded for longer is a usage ledger: who made a request, which model answered, how many tokens it used, how long it took and whether it succeeded. It carries no conversation content. It exists because not keeping your conversations must not also mean losing track of what each request cost: our cost accounting reads it. Only our servers write it, so nothing in the app can add to it or change it.

An account without a subscription gets a few conversations free, and to count them we record a fingerprint of each one: a code our servers compute from the conversation’s text with a key only they hold. It is not the text, and it cannot be turned back into it. It only lets us tell a conversation you have already had from a new one, so asking for another version of the same reply is not counted twice. These fingerprints are kept with your account, so that the free conversations are not handed out again, and are deleted when you delete it.

Nothing is read without an explicit tap

The keyboard never reads while you are typing. Every read happens in response to an action you named — analyse this screenshot, paste this text, refine this draft. The clipboard is read only when you tap Paste, never to decide whether to offer pasting.

Secure fields are refused

The AI panel does not appear in password fields or in numeric and phone pads. On Android it also stays out of email address fields and fields an app has marked as not wanting suggestions. The check errs toward refusing: an AI key that does nothing where it might have worked is a worse feature, but reading a field the app asked us not to help with is a broken promise.

What leaves your phone, and when

• Analyse from paste, draft or selection — the text you supplied, and nothing else on screen.
• Analyse a screenshot from the keyboard — usually no image at all. Your phone reads the conversation itself and sends only the text. If the conversation contains a photo your customer sent, that photo is cropped out and only the crop goes; if your phone cannot read the screenshot, the whole image is sent once. On Android, every screenshot is sent whole while your replies are set to a language that isn’t written in the Latin alphabet. Never your photo library.
• Analyse an image in the app — a screenshot or photo you share to Trade Reply from another app, or choose or take inside the app. Nothing is sent until you tap Analyze. Then the whole image is sent, because the app doesn’t read it on the phone first. Before it goes, the app saves it as a new image, so nothing stored inside the original file goes with it, such as where a photo was taken. Shared text is sent as text.
• Refine — the drafted reply only. Rewording a reply needs no conversation, so none is sent.
• Saved replies, and ordinary typing — nothing leaves the device at all.

Screenshots and photos

Most screenshots never leave your phone. The keyboards read the conversation on the device — Apple’s Vision framework on iPhone, ML Kit on Android — and send the text, the same way pasting does. Nothing is uploaded, so there is nothing to delete and nothing for a provider to keep.

On Android, the phone reads only the Latin alphabet, which is the one English and Spanish are written in. If you have set replies to Chinese, Japanese, Korean, Hindi, Russian or Arabic, the Android keyboard sends the whole screenshot without trying to read it. Read on the phone, it would come out as timestamps and names, and a reply written to those would be wrong.

From the keyboard, an image is sent in two cases. The first is when your customer sent a photo: that photo is cropped out of the screenshot and only the crop is sent. The second is when the phone cannot read the screenshot at all: the whole image is sent once. An image you share into the app, or choose or take in it, is always sent whole. Anything uploaded goes to private storage, is passed to the AI provider inline rather than as a link, and is deleted the moment it has been read. There is no setting that keeps it. A photo of someone’s basement is not ours to keep merely because keeping it was convenient.

Who else sees this

Trade Reply is operated by Superfime LLC. Four companies process data from the app on our behalf, under contract, and none of them is given it to use for their own purposes:

• Our AI provider — the AI that writes your replies. It receives the conversation text or image you send for a reply. Requests are sent with retention switched off, so it is asked not to keep them either.
• Supabase — the database, sign-in and file storage behind the app.
• Sentry — crash reports. A report is a stack trace, the screen it happened on, the build, your account id and your business id. It never contains a screenshot, the rendered contents of the screen, or a message.
• RevenueCat — subscription status, working with the App Store and Google Play. It sees your business id and what was purchased, never a card number. On iPhone, if you installed the app after tapping one of our ads in the App Store, Apple also tells it which ad campaign and search keyword that was.

Apple and Google process your purchase and, if you use them to sign in, your identity. Their terms govern that.

On Android, the text in a screenshot is read on the phone by Google’s ML Kit. Google’s terms say the image and the words it reads never leave the phone. ML Kit does send Google data about its own use: the phone’s make, model and Android version, the app’s name and version, an identifier for that installation (which Google says is not meant to identify you or the phone), how long a reading took, the image’s format and size, and error codes. Google uses that data to maintain and improve ML Kit and to detect misuse, and does not share it with anyone else. The app has no setting that turns it off.

Consent, and whose data this is

Nothing reaches our AI provider until you have agreed to it. You are asked during setup, on the screen before your first practice reply, and tapping Start Practice is the agreement. Every AI endpoint refuses without a recorded agreement.

The uncomfortable part is worth stating plainly: most of what gets sent is your customer’s words. Someone who texted you about their water heater never agreed to anything, and you are agreeing on their behalf. A screenshot sends everything visible in it. That is worth a second thought before sending something told to you in confidence.

You can turn AI processing off at any time in Settings › Privacy, and agree again there later. Without an agreement, the keyboard still types and your saved replies still work — only the AI is refused.

Analytics

In the app

Events record what happened, never what was said. Properties are counts, durations, and identifiers only — a database constraint rejects any field named like message content, and both writers drop anything that is not a simple value. Confidence is stored as a bucket rather than a number, because a precise score is a fingerprint of one specific request in a way “high” is not.

No data from the app is used to track you across apps or websites.

On this website

This website is measured by two tools, neither of which the app uses: Google Analytics and Ahrefs Web Analytics. Between them they record which pages are read, approximately where the reader is — city at the most precise, never an address — and what kind of device and browser they used. Google Analytics also records which buttons, links and example replies on a page are used — by name only, such as which example was opened or which tone was picked, never the words in it. Neither receives anything from the app: no conversations, no screenshots, no account, and no way to connect a visit here to a customer of yours.

Google Analytics runs without cookies in the UK, the EEA and Switzerland — nothing is stored on the device and the measurement carries no identifier — which is why this site asks you to accept nothing. Everywhere else it sets its own cookie so that a second visit counts as a second visit rather than a new person. Google’s advertising features are switched off on the property, so none of this follows anyone to another site.

Ahrefs Web Analytics sets no cookie at all — anywhere, for anyone. Ahrefs works out a country and city from the IP address and then discards it, never storing it in their database or their logs, and counts a returning reader with a hash of a salt they throw away every twenty-four hours. Nothing it records follows anyone to another site, another device, or another day. It is here to show which pages are worth writing, including the ones AI assistants send people to.

Google publishes a browser add-on that opts you out of Google Analytics here and on every other site that uses it.

Your controls

• Export — everything held for your business, as JSON.
• Delete account — removes you and any business you solely own, and transfers businesses you share rather than deleting a colleague’s work.

There is no longer a “delete my conversation data” button, because there is no longer any conversation data to delete. A control you have to find and press is a worse promise than never having kept the thing in the first place.

Children

Trade Reply is a tool for running a trade business and is not directed at children. We do not knowingly collect data from anyone under 13, and you must be old enough to enter into a contract to hold an account.

Contact

Trade Reply is operated by Superfime LLC, which is the controller of the data described here. Questions about any of it, including a request to see, correct or delete what we hold: support@tradereply.co.