← Back to ReddForce

Privacy Policy

ReddForce Chrome Extension · Last updated: August 2026

ReddForce is a Chrome extension that helps founders find Reddit posts relevant to their product and reply to them. This policy explains exactly what data the extension handles, where that data lives, who it is shared with, and how to delete it. It covers both the extension and the reddforce.com website.

1. What the extension does

You paste your product's website URL. The extension opens that one page in a background tab, reads its visible text, and sends that text to our server, which uses Anthropic's Claude API to work out what your product does and which subreddits and search terms are relevant. You review and edit that list. The extension then searches Reddit's public API, scores the posts it finds against your product, and saves the good ones to a lead list stored inside your own browser.

From that list you can write a comment reply or a direct message. When you click send, the extension posts the message you wrote through your own signed-in Reddit session. Nothing is sent automatically, in bulk, or on a schedule. You write and approve every message.

2. What data we collect, and why

2.1 Account information

• Your email address and Google account ID. Collected when you sign in with Google on reddforce.com. We use it to identify your account, to count your free runs, to check whether you have an active subscription, and to pre-fill your email at checkout. Your Google password is never seen by us. We do not receive or store your name or profile picture.
• A sign-in token. A signed token is stored in your browser's extension storage so you do not have to sign in every time. It expires after 30 days.
• Subscription status. Whether your subscription is active or cancelled, and the subscription ID issued by our payment provider.
• Usage counters. How many scans and AI calls your account has made, used to enforce free plan limits and to prevent abuse of our paid API access.

2.2 Content we process for you

• Text from the website you enter. The visible text of the URL you type in. Headings, paragraphs and meta description. Navigation, footers and scripts are skipped. This is sent to our server and on to Anthropic's Claude API to build your product profile.
• Public Reddit post content. Titles, body text, subreddit names, authors and post URLs returned by Reddit's public search API. These are sent to our server and on to Claude to be triaged, scored and summarised. This content is public on Reddit; we do not access private subreddits, your Reddit inbox, or anyone's private messages.
• Subreddit descriptions. The public description of the subreddits your scan touches, used to improve scoring accuracy.

2.3 Messages you write

• Direct message drafts and comment drafts. Saved against each lead so you do not lose your work. These are stored only in your browser. They are never sent to our servers and never sent to Anthropic. The extension does not write your messages for you; drafts start from a local template you edit.
• The message itself, when you click send. The text you wrote is transmitted to Reddit, using your own signed-in Reddit session, so that it can be posted as a comment or delivered as a chat message. It goes to Reddit and nowhere else.
• Timestamps. When you sent a DM or posted a comment, stored in your browser so the interface can show you what you have already done.

2.4 Product usage and diagnostics

• Usage events. Actions such as starting a scan, opening the CRM, generating a draft, or clicking upgrade, sent to PostHog. Once you sign in these events are associated with your email address.
• Error reports. Unhandled errors inside the extension's own pages, so we can find and fix bugs.
• Session replay of the extension's own pages. PostHog records how you interact with the extension's popup and CRM pages so we can see where the product is confusing. Read section 3 below for exactly what this does and does not capture.
• Approximate location. PostHog derives an approximate country, region and city from the IP address of these requests. We do not use GPS and never ask for precise location.
• IP address at sign-in. When you sign in, your IP address is briefly written to our rate-limit store to stop automated abuse of the sign-in endpoint. It is deleted automatically after 60 seconds.

3. What session replay records

Session replay applies only to ReddForce's own pages, meaning the extension popup and the extension's CRM tab. It never runs on Reddit, on your own website, or on any other page you visit.

• Masked and never recorded: anything you type into a text field or text area. This includes your direct message drafts and comment drafts.
• Visible in a replay: the rest of the interface, including the lead cards. That means Reddit usernames, subreddit names, post titles and post excerpts already shown on screen can appear in a recording. This content is public information from Reddit.

4. What we do not collect

• Your browsing history. The extension never reads which sites you visit. It holds the history permission for one reason only, explained in section 8.
• Your card details. Payment is handled entirely by our payment provider. We never see or store card numbers, and we do not receive your billing address.
• Health information. None, ever.
• Page content from sites you browse. The extension reads one page, the URL you typed in yourself, and no others.
• Your Reddit password or credentials. Sending happens through the session you are already signed into. We never ask for, see, or store your Reddit login.

5. Where data is stored

Data	Where it lives
Lead records, DM drafts, comment drafts, statuses, notes, outreach timestamps	IndexedDB in your own browser. Never uploaded.
Sign-in token, subscription flag, usage counters, cached product profile, scan progress	Chrome extension storage on your device.
Email, subscription status, usage counters	Upstash Redis, hosted in the United States.
Website text and Reddit post content during a scan	Processed in transit by our server on Vercel and by Anthropic. Not stored in a database by us.
Usage events, error reports, session replays	PostHog Cloud, United States region.

6. Who we share data with

We do not sell user data and we never transfer it to advertisers, data brokers or resellers. We use the following service providers, each of which receives only what it needs to do its job:

• Anthropic (Claude API). Receives your website text and the public Reddit post content, in order to build your product profile and score posts. Under Anthropic's commercial API terms this content is not used to train their models. Privacy policy.
• Google (Sign-In). Verifies your identity when you sign in. We receive your verified email address and account ID. Privacy policy.
• PostHog (product analytics, error tracking, session replay). Receives the events, error reports and replays described in sections 2.4 and 3. Privacy policy.
• Dodo Payments (payments and subscriptions). Receives your email address to create your checkout and collects your payment details directly. Dodo is the seller of record. Privacy policy.
• Vercel (hosting) and Upstash (Redis storage). Run our website and API.
• Reddit. The extension calls Reddit's public API to search for posts, and transmits the messages you choose to send. Your use of Reddit is governed by Reddit's privacy policy.

We may also disclose data if required by law, or where necessary to investigate abuse, fraud or a security incident. If ReddForce is ever acquired, we will ask for your consent before your data transfers to the new owner.

7. Limited Use disclosure

In practice this means we only use your data to provide and improve ReddForce's single purpose, which is finding and replying to relevant Reddit posts. We never use or transfer it for advertising, personalisation, profiling, credit decisions or lending, and no employee reads your data except where you have asked us to help you with a support issue, where it is necessary to investigate abuse or a security problem, or where the law requires it.

8. Permissions and why each one is needed

• storage. Keeps your sign-in token, plan status, usage counters, cached product profile and in-progress scan state on your device, so a scan survives you closing the popup.
• scripting. Used once per scan, to read the visible text of the single website URL you entered, in the background tab the extension opened for it. It is never injected into pages you are browsing.
• history. Used only to delete, never to read. After reading your website in a background tab, the extension removes that automatic visit from your browser history so a page you never chose to open does not appear there. The extension never reads or transmits your history.
• Access to reddit.com, www.reddit.com and old.reddit.com. To search Reddit's public API and to post the comment or message you wrote.
• Access to all sites. Required only because your product website could be on any domain, and Chrome has no way to grant access to "the one URL the user will type in later". The extension visits that single URL and no other.

9. Security

All data is transmitted over HTTPS using modern TLS. Your sign-in token is a signed JWT that expires after 30 days. Access to our production data stores is limited to the developer of ReddForce and protected by two-factor authentication. Data stored on your own device is protected by your browser's own storage isolation, which prevents websites and other extensions from reading it.

10. Data retention and how to delete your data

• Leads and drafts. Kept until you delete them. Open the CRM and use Clear CRM to remove all of them at once. Uninstalling the extension deletes everything it stored on your device.
• Account data on our servers. Your email, subscription status and usage counters are kept for as long as your account exists. Email hey@mohitnair.co from your signed-up address and we will delete them within 30 days.
• Website and Reddit content. Processed in memory during a scan and not written to a database by us.
• Analytics and session replays. Retained by PostHog under their standard retention period. Ask us and we will delete your analytics profile.
• Sign-in IP addresses. Automatically deleted after 60 seconds.

Depending on where you live you may have the right to access, correct, export or delete your personal data, or to object to how we process it. Email hey@mohitnair.co and we will action it.

11. Children's privacy

ReddForce is a business tool intended for adults. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has given us data, email us and we will delete it.

12. Changes to this policy

If we change how we handle your data we will update this page and the date at the top. Where the change is significant, we will also tell you inside the extension before it takes effect.

13. Contact

Questions, requests or complaints: hey@mohitnair.co. We answer every email.

---

ReddForce is an independent tool and is not affiliated with, endorsed by, or sponsored by Reddit, Inc., Google LLC, or Anthropic PBC.