Privacy Policy

Reply Hearth is operated by BioRust Studios, LLC (“we”, “us”). It reads the reviews your business receives, drafts owner replies in your business’s voice and, only when you choose, posts them for you.

This policy covers two kinds of information:

• Your account information (your email, settings and billing details).
• Review and reply content from the apps you connect.

Reply Hearth is an independent service and is not affiliated with, sponsored or endorsed by Google or Apple.

Account information

• Your email address and the date you created your account.
• Your password, which is handled by our authentication provider. We never see or store it in readable form.

Settings you enter

• The names of the apps you connect, your voice instructions, and the facts and policies you give us for replies.
• Your reply settings, including which star ratings may post automatically.
• Consent records detailing who took an action, when it took place, and what action was taken, along with the IP address and browser used.

Content from the platforms you connect

• Review text, star rating, the reviewer’s public display name, and review dates.
• Any existing owner reply and its status.

Content we create with you

• Draft replies, the replies you approve or edit, and the replies we post.
• An audit log of actions in your workspace, such as “draft approved” or “reply posted automatically”.

Technical information

Server logs with request times and error details, used to keep the service running and secure. Our logs never contain review text, access tokens or keys.

Usage information

We use Google Analytics for Firebase to see how the site and dashboard are used: the pages you open, the buttons you press and whether an action such as posting a reply succeeded, along with your browser and device type and approximate location. It sets cookies in your browser and, when you are signed in, ties this to your account’s internal ID. We never send it review or reply text, reviewer names, your email address, or the names of your workspaces or apps.

Google Play

You link Google Play with a credential you own: either a service-account key from your own Google Cloud project, which you invite in Play Console, or by signing in with Google. We use it only to read reviews and post replies for the apps you add to Reply Hearth, and for nothing else. We never ask for financial, release or publishing permissions. You can remove our access in Play Console under Users and permissions.

Google Play only shares the last 7 days of reviews through its reviews API. To bring in older reviews, you can add the Cloud Storage URI of your Play Console reports, which we read with the credential you linked; it needs the read-only “View app information and download bulk reports” account permission. Google grants that for your whole developer account; we read only the review reports of the apps you add, never financial data, and never the other reports. Imported reviews are kept the same way as synced ones.

Signing in with Google (OAuth)

When you link Google Play by signing in with Google, you grant Reply Hearth access with these permissions (OAuth scopes):

• androidpublisher, to read your apps’ reviews and reply to them;
• playdeveloperreporting, to list the apps your Google account can reach, so you can choose which to add;
• devstorage.read_only, to read your Play Console review reports when you import older reviews;
• the basic openid and email, to record which Google account authorized the link.

We request no other Google permissions. We never ask for access to Gmail, Drive, Contacts or Calendar.

What we read

• The names of the apps your Google account can reach in Play Console.
• Reviews of the apps you add and any existing developer replies.
• The review reports of the apps you add, only if you import older reviews. Never financial data or any other report.
• The email address of the Google account you signed in with.

What we write

• Replies to reviews: posting or updating a reply that you approved, or that your recorded automatic-reply settings allow.

We don’t change your store listing, releases, prices or any other part of Play Console.

How we limit our use

Reply Hearth’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the features you see in Reply Hearth.
• We never sell it, and never use it for advertising.
• We never use it to train or fine-tune AI models, ours or anyone else’s.
• We never combine one customer’s reviews with another’s, for benchmarks or for any other purpose.
• People at BioRust Studios, LLC don’t read it, except with your permission (for example, when you ask for support), for security investigations, or where the law requires.

Your Google access token

The token Google gives us is encrypted and stays on our servers. It is never sent to your browser or shown to anyone. You can revoke our access at any time by disconnecting in Reply Hearth, or from your Google Account’s third-party access page.

App Store

You give us an App Store Connect API key (the issuer ID, key ID and private key file). We check it, then encrypt the private key. It is never shown again, returned to any browser or written to logs. We use it only to read customer reviews and post responses for the apps you add. When you disconnect, we destroy our copy. Apple doesn’t let us revoke the key for you, so we’ll remind you to revoke it in App Store Connect.

• To show your reviews and draft replies in your business’s voice.
• To run safety checks on every draft and hold reviews that need a person to read them, with the reason shown.
• To post the replies you approve, or that your automatic-reply settings allow.
• To keep the consent records and audit log that show who approved what, and when.
• To send account and security emails, such as verification and password resets.
• To keep the service secure, prevent abuse and fix problems.
• To understand how the product is used, so we can improve it.

We do not use your data or your reviews to train or fine-tune AI models, ours or anyone else’s.

We keep the information below until you delete your account. Information in a workspace you share with others is kept until that workspace is deleted, since its other members still use it. Disconnecting or removing an app deletes its reviews and drafts straight away.

When you delete a workspace or your account, we delete the information above within 30 days, usually the same day, except records the law requires us to keep.

We do not sell or share any user data, except with the service providers below, which process information only on our behalf and under contract to run the service.

Replies you approve are published on the platform where the review was left, which is the point of the service.

• Information is encrypted in transit (TLS) and at rest.
• Google access tokens, Google Play service-account keys and App Store keys are encrypted and are only ever used on our servers.
• Only verified members of your workspace can see its reviews, drafts and history. Browsers can read that data but never change it directly; every change goes through our servers and is checked.
• Every posted reply is recorded in your audit log.

Disconnecting an account

Disconnecting a Google Play account you linked by signing in revokes our Google access token. Disconnecting a Google Play service-account key or an App Store key destroys our copy of it; you can also remove or revoke it in Play Console or App Store Connect.

Deleting a workspace

A workspace owner can delete a workspace in Workspace settings. This cancels the workspace’s plan, disconnects every linked account and revokes its credentials, then permanently deletes the workspace’s reviews, drafts, reply history, consent records, audit log, settings and pending invites, for every member.

Deleting your account

You can delete your account in Account settings. Any workspace you’re the only member of is deleted as described above. You leave any workspace you share with others; if you’re its only owner, make someone else an owner or delete it first. Any plan you pay for is cancelled, and then your account and its settings are permanently deleted.

Replies that were already posted stay on Google Play or the App Store. You can remove them there.

Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to how we use it. Most of this you can do yourself in Account settings. For anything else, contact us and we’ll respond within 30 days.

Reply Hearth is a business tool and isn’t meant for anyone under 18. We don’t knowingly collect information from children.

If we make a material change to this policy, the date will be updated.

Questions about this policy or your information: bioruststudios+replyhearth@gmail.com. See also our Terms of Service.