Privacy Policy

Operator

AcornReply is operated by PerfSpot LLC, a Delaware limited liability company. This policy explains what we collect, why, and how to control it. You can reach us through our contact page.

What we collect

Account data (email, name, organization), inbound and outbound message content, customer-supplied contact-form data, and standard server logs (IP, user agent, timestamp). When a device is registered for push notifications, we also keep a push token and a short label for each device (for example “iPhone” or “Google Pixel 9”). When the AcornReply mobile apps register for push, they also send the device model, which we use to make that label, and an identifier that the device gives only to apps from us (on Android, the ANDROID_ID; on iPhone, Apple's identifier for vendor). We keep that identifier so we recognize the same device after you reinstall the app. We do not collect device fingerprints or set advertising cookies.

Sign-in providers

You can sign in with Google. We request the minimum profile scopes (openid, email, and profile) to identify you and provision your account. We do not request access to your Gmail, Calendar, Drive, Contacts, or any other Google API.

Google API Services User Data Policy: Limited Use

AcornReply's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Google user data to provide or improve user-facing features that are prominent in AcornReply's user experience (signing you in, identifying your account, displaying your name and avatar in the app).
• We do not transfer Google user data to third parties except as necessary to provide or improve those user-facing features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
• We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
• We do not allow humans to read Google user data unless we have your affirmative agreement for specific messages, doing so is necessary for security purposes (such as investigating abuse), to comply with applicable law, or our use is limited to internal operations and the data (including derivations) has been aggregated and de-identified.
• We do not sell Google user data, and we do not use it to train generalised or third-party machine-learning models.

Revoking Google access

You can revoke AcornReply's access to your Google account at any time:

• Visit your Google Account permissions page, find AcornReply, and choose “Remove access”.
• Or visit your AcornReply account settings to disconnect Google sign-in or delete your account.

Sign in with Apple

In the AcornReply iPhone app you can also sign in with Apple. Apple sends us three things:

• A user identifier that Apple creates for AcornReply. We use it to recognize you the next time you sign in with Apple.
• An email address. If you choose “Hide My Email”, it is a private relay address that Apple forwards to your real inbox. We use it as your account email.
• Your name, the first time you sign in, if you choose to share it. We use it as the name on your account.

We also keep a token Apple issues for your sign-in, and we use it only to tell Apple to end the connection when you delete your AcornReply account. We do not sell this data, share it for advertising, or use it to train AI models. You can stop using Sign in with Apple for AcornReply from your Apple Account settings (on your iPhone: Settings, your name, Sign in with Apple, or at account.apple.com), or delete your AcornReply account.

Push notifications

On iPhone, on Android 13 and later, and in the browser, push notifications are off until you allow them on that device. Older Android versions allow notifications when the app is installed, so there the app registers for push when you first sign in. When a device is registered, we store a push token for it: from Apple for the iPhone app, from Google's Firebase Cloud Messaging for the Android app, or from your browser for the web app. A notification carries a short summary, such as the customer's name and the message subject, and is delivered through the push service of Apple, Google, or your browser's maker. You can turn notifications off in AcornReply or in your device settings. Device tokens are deleted when you delete your account.

What we share

We share data only with service providers that help us run AcornReply: Postmark (email delivery), Cloudflare Turnstile (bot protection on public contact forms), Neon (database hosting), Railway (application hosting), Cloudflare R2 (storage for attachments and images), Sentry (error monitoring for our servers and web app), Anthropic / OpenAI (AI drafting), Apple (Sign in with Apple and push notification delivery), and Google (Google sign-in, and push notification delivery to the Android app through Firebase Cloud Messaging). Each processor receives only what it needs and is bound by data protection terms. We do not sell or rent your data. We do not use your message content to train third-party AI models beyond the single inference call required to draft the reply you requested.

Cookies

We use a single first-party session cookie issued by our own auth service. We do not use third-party analytics, tracking, or advertising cookies.

Your choices

You can export your data on request and delete your account from settings at any time. Deletion removes conversations, customers, drafts, and your voice profile from our database within 30 days; backups are overwritten on a rolling 30-day cycle.

Email communications

When you create an account, you'll receive transactional emails (sign-in links, account changes, billing, material service changes) and occasional product updates about AcornReply. You can opt out of product updates at any time using the unsubscribe link in any email or from your account settings. Transactional emails are required to use the service and cannot be opted out of while your account is active. We do not share your email address with third parties for their own marketing.

Data retention

Conversation data is retained for as long as your account is active. Deleted accounts and their conversation history are purged within 30 days.

Children's data

AcornReply is not intended for anyone under 13 (or 16 in the EU). We do not knowingly collect data from children.

Where we operate

AcornReply runs on infrastructure in the United States. By using the service you acknowledge your data is processed in the US.

Changes to this policy

We will post material changes to this page and update the effective date at the top. For significant changes affecting how Google user data is used, we will notify affected users by email before the change takes effect.

Contact

Privacy questions or data-subject requests: please use our contact page.