Privacy Policy
Draft37 is a browser extension and service that watches Reddit communities you choose, finds conversations where someone is asking for what your product does, and helps you draft a reply. You review and post everything yourself — Draft37 never posts anything.
This page says what data we collect, where it goes, how long we keep it, and how to get it removed. It covers two groups of people: customers (you, with a Draft37 account) and Reddit authors (people whose public posts and comments pass through the service). If you are a Reddit author who found their post here, the section “If your Reddit post appeared in Draft37”is for you.
The short version
- Reddit is read by your own browser, with your own Reddit login. Our servers never touch Reddit and hold no Reddit credentials.
- Everything is read-only: the extension never posts, comments, or messages anyone on Reddit.
- Stored Reddit conversations are stripped after 90 days (username, text, and link erased) unless they became a lead you are still working.
- We run no analytics or ad trackers — not on this site, not in the extension — and we never sell data.
- Anyone, customer or not, can write to support@draft37.com to have their data removed.
What we collect about you (customers)
Account. Your email address and a display name (by default, the part of your email before the @). If you sign up with a password, we store it in hashed form, never as readable text. If you sign in with Google, we receive your name, email, and profile picture from Google, and store the sign-in tokens Google issues so the link keeps working — they are used only to sign you in, never to read anything else from your Google account. Signing in on our website sets a strictly necessary sign-in cookie on our own domain; we set no other cookies and no tracking cookies anywhere. Each sign-in session records your IP address and browser type; signing out ends it, and it expires on a timer regardless.
Your product profile. What you tell us about your product so the matching can judge fit: your website address, product name and description, who it is for, the problems it solves, keywords, competitors, and the subreddits you watch. If you onboard with a website address, we fetch that site (see “Who processes data for us”) and draft the profile from its text.
Your activity on leads. When you mark a lead done or move it back to the inbox, we record that action. Your reply drafts are not collected: draft text is edited in your browser and goes to your clipboard, never to our servers.
Waitlist. If you join the waitlist, we store your email address and the signup time — nothing else.
How reading Reddit works
The extension reads Reddit from your machine, through your own logged-in browser session, the same way your browser loads Reddit when you visit it. It only everreads — every request it makes to Reddit is a plain page read. It checks the communities you watch about once a day while your browser is open (plus when you press “Check now”), and it stops entirely when your browser is closed.
Some things deliberately never leave your browser:
- Your Reddit username — shown in the extension panel, sent nowhere.
- Your Reddit session cookie — the extension never reads its value at all; it only notices whether you are logged in.
- Your reply drafts.
Besides the conversations themselves, the extension does send us a record of each check: which communities it read, how many items it looked at, how many the filter dropped, and, when Reddit refuses a read, that it was refused and the status code it returned. That record names communities, never people, and carries nothing from your Reddit session. It is how we can tell a quiet day apart from a broken one.
Your Draft37 sign-in token is kept in your browser and sent only to our own servers to authenticate you — never to Reddit or anyone else. The extension requests browser access only to reddit.com, and contains no analytics, tracking, or third-party code that talks to anyone else.
What we store about Reddit conversations
When your extension finds public posts and comments in the communities you watch, the ones that look relevant are uploaded to our servers to be judged. For each one we store the author’s Reddit username, the title and text of the post or comment, its link, when it was written, and vote counts, together with our AI’s written assessment of whether it is a real lead for your product. A small sample of filtered-out conversations is kept too, so we can check the filter isn’t discarding real leads.
This is public content, written by people who are not Draft37 customers. How long we keep it — and how its authors can have it removed — is covered in the next two sections.
How long we keep things
Our rule: conversation data is kept only as long as it serves its purpose — helping you find and answer fresh conversations. Draft37 is built around new conversations, so a months-old judged conversation that never became a lead serves no purpose, and we chose90 days as the window: comfortably past every feature that reads this data (the longest looks back 30 days), and well inside what data-protection practice considers defensible. The window is enforced by an automated job that runs in our database every day — it is not a manual promise.
- Judged conversations that did not become a lead, and filter samples: stripped at 90 days. The author’s username, the text, the title, and the link are erased in place. No name, text, or link remains — what stays is the verdict, category labels, the community name, timestamps, and cost counters. (The judging record of a conversation that did become a lead stays paired with that lead and follows its lifetime.)
- Leads in your inbox or marked done: kept while your account exists. They are the thing you use the product for. If a lead is discarded outright instead of kept in Done, it is stripped like the log, 90 days after your last action on it. “Start over” in Settings deletes your Watch’s stored leads immediately; the judging record’s copy of each conversation remains until the 90-day erasure reaches it.
- Your actions on leads: kept while your account exists, deleted with it.
- The record of each check (communities read, counts, and any read Reddit refused): kept while your account exists. It names communities, never people, so there is nothing in it to strip.
- The audience summary (recurring themes with short quotes, each carrying its author’s username and link) is a cache, deleted once it is 60 days old — keeping every stored quote inside the same ~90-day horizon as its source.
- Your account and product profile: kept while your account exists. Email support@draft37.com to delete your account and we delete this along with your stored leads.
- Waitlist emails: kept until launch outreach is done, or removed on request.
We say stripped rather than anonymised on purpose. What remains, the community name and the timestamps, could in principle be used to find the original public post again, so we do not claim the record becomes anonymous. What we can promise is that it stops holding anyone’s name, words, or link.
One honest limitation: we do not detect when a post is deleted or edited on Reddit itself. Our stored copy remains until the 90-day erasure reaches it, or until its author asks us to remove it, which works at any time.
If your Reddit post appeared in Draft37
You wrote something publicly on Reddit, and a Draft37 customer watching that community may have a copy of it: your username, what you wrote, and a link to it, stored so that one customer could see you were asking about something their product does. It is not shown to anyone else, not used to profile you, and not sold. Our legal basis for this is legitimate interest: connecting a public request with someone whose product answers it.
Your content is stripped automatically on the schedule above. If you don’t want to wait, email support@draft37.com with a link to the post or comment (or your username), and we will remove your content from our systems. You don’t need an account, and we won’t ask you to prove anything beyond pointing at the content.
Who processes data for us
We run no ad networks and sell nothing. The services below process data solely to run Draft37, and our servers and databases are in the United States:
- OpenRouter — the AI calls: judging each candidate conversation (the author’s username and text, alongside your product profile), drafting your product profile during onboarding (from your website’s text or the description you typed), and building the audience summary. OpenRouter routes each request to the AI model’s operator (for example OpenAI); requests may pass through Cloudflare as a gateway.
- Firecrawl — fetches your own website during onboarding to draft your product profile. Reddit content is never sent to Firecrawl.
- Postmark — sends account emails (verification, password reset) to your address. These emails contain only our own text and links.
- Neon (database), Upstash (job queue), Fly.io (servers, Virginia, US), Vercel (this website) — infrastructure hosting.
- Google — only if you choose “Sign in with Google”.
What we never do
- Post, comment, vote, or message anyone on Reddit — on your behalf or otherwise.
- Hold Reddit credentials on our servers, or read your Reddit cookie.
- Sell or rent anyone’s data, or share it for advertising.
- Run analytics or tracking scripts on this site or in the extension.
- Store your password readably, or your reply drafts at all.
Chrome Web Store
Draft37’s use of information received from Google APIs adheres to theChrome Web Store User Data Policy, including the Limited Use requirements.
Your rights
Wherever you are, you can ask us what we hold about you, ask for it to be corrected or deleted, or object to our processing of it — emailsupport@draft37.com and we will act on it. If you are in the EU or UK, these are your GDPR rights (access, rectification, erasure, restriction, objection, portability), and you also have the right to complain to your data-protection authority.
Changes
When our practices change, this page changes with them and the date at the top moves. Meaningful changes are announced to account holders by email.