USER Privacy Notice

Last Updated: August 27, 2026

The 60-second version

We read your public posts about the Product. That is the whole mechanism: you post publicly, we check the post mechanically, and a reward follows.
We never read your DMs, and we never score what you say. No sentiment analysis, no tone, no opinion — a critical post earns exactly what a positive post earns.
The Product gets your identifier and the amount you earned, plus a reference to the post that earned it. Not your DMs, not an analysis of your views.
You can unbind your platform account at any time by emailing privacy@earnesty.app. New posts stop being recognized; rewards already delivered stay yours inside the Product.
We never pay you money, and you never pay us anything. What you earn is the Product’s own in-product value, whatever form it takes — no cash value, not redeemable for money, not transferable, not a gift card.

The rest of this notice is the detail behind those five points.

This notice explains what Earnesty collects about you, why, and what you can do about it. It is written for you — an individual using a software product that runs its free tier on Earnesty. It is not the privacy policy for the product you use; that product has its own. It is also separate from our Privacy Policy for business customers, because for most of what is described here we decide on our own what to collect and why, and we owe you a direct explanation rather than a footnote in someone else’s.

1. Who We Are and Why You’re Seeing This

Earnesty is operated by Know Reply Inc. (“Know Reply”, “we”, “us”), a Delaware corporation.

You are seeing this notice because you use a software product — we call it the Product — that runs its earned tier on Earnesty. Instead of paying money to refill your usage credits, you post publicly about the Product and we verify that post. When it checks out, we tell the Product to grant you credits — or whatever your Product gives you instead: tokens, an extra seat, a free month.

To do that, we have to look at public posts and keep a record of what we found. That is what this notice is about.

Whatever the Product grants you is its own in-product value, not money. That is true of credits and of every other form a reward can take. We never issue it, it has no cash value, it is not redeemable for money, it is not transferable to anyone else, and it is not a gift card or any other stored-value instrument. You never pay us anything.

Your relationship with us is set out in the Participation Agreement.

2. What We Collect

We collect the following about you:

Your public platform handle and platform account ID. When your first Qualifying Post binds your social account to your enrollment, we store the platform name (for example, X), the platform’s stable identifier for your account, and your public handle. This is how we know a later post is yours without you having to include your Claim Code again.
Your Qualifying Posts. For each Qualifying Post, we store the platform’s post ID, the public URL, the time the post was published, and the time we verified it.
How many separate accounts replied to your post. Five days after your post’s own timestamp — not five days after we verified it — we read the post once. That single reading checks that it is still public and still carries the disclosure tag, and counts how many separate accounts replied to it. Then the reply bonus is paid, and the post is finished. We do not read it again after that, and we no longer read it day after day for a week. To count separate accounts we have to look at who replied, and we keep only the number. We do not store a list of the people who replied to you, and we never build one. Ten replies from one account count as one; a hundred replies from one account still count as one. Your earnings do not depend on when we get around to looking: your Claim’s base value is fixed at your post’s timestamp, and the reply bonus settles five days after the post whatever day Verification happened on.
The Product’s identifier for you. The Product tells us which of its users you are, using its own identifier. To us this string is usually opaque — it is typically an internal ID, not your name or email.
Your Claim, reward, and enrollment history. Your Claim Code, the Claim’s value and terms at the moment it was issued, what a post earned and when, credit-grant records and whether delivery to the Product succeeded, your enrollment status, and audit-log entries recording Verification events.
Whether a platform disclosure label was present. Where a platform offers its own paid-partnership label, we record whether we saw one. It is encouraged but never required.
Technical logs when you visit your status page. IP address, browser and device type, referring URL, and pages viewed, for security, abuse prevention, and troubleshooting.

3. What We Do Not Collect

No private messages. We never read your DMs.
No non-public posts. We only ever look at posts that were public at the time we looked. If a post is protected, private, or restricted, Verification simply fails.
No email address unless you give us one. We do not need one to run the earned tier, and the Product does not pass us yours.
No payment information from you. You never pay us, so we never ask for a card, a bank account, or a billing address.
No sentiment analysis. We do not read your posts for tone, mood, positivity, or opinion, and we never will. A critical post earns exactly what a positive post earns. Our checks are mechanical: is the post public, is it yours, is the Product mentioned, is the disclosure tag near the start, has this post been credited before.
No list of who replied to you. Counting how many separate accounts replied means looking at who they were, in the moment we count. We keep the number and nothing else. The people who reply to you never enrolled with us, and we do not turn them into records.
No engagement targets. We reward the disclosed act of posting. We do not buy, sell, or guarantee reach, followers, likes, or reviews, and nothing you earn depends on how a post performs beyond the reply bonus described above, which is capped at a maximum the Product sets.

4. Where It Comes From

From the Product. Your enrollment, the Product’s own identifier for you, and confirmation that credits were granted.
From you. Your posts, your Claim Code when you include it, and anything you send us — for example, pasting a post URL or pressing “check now” on your status page.
From the Supported Platform’s public API. A Supported Platform is a social platform Earnesty can verify posts on — X today, with others expected. We read post content, post metadata, your public handle and author ID, and — at the one settlement reading, five days after your post — the replies to your post, so we can count how many separate accounts sent them. We keep the count, not the repliers. We only ever request what the platform makes publicly available.

5. Why We’re Allowed To

Where the GDPR or UK GDPR applies to you, our legal bases are:

Performance of a contract. Most of this processing is simply how we deliver what the Participation Agreement promises: we cannot verify a post or tell the Product to credit you without reading the post and keeping a record of it.
Legitimate interests — Verification and fraud prevention. We check that one platform account maps to one enrolled user, that a post is credited only once, and that rewards are not obtained by impersonation or automation.
Legitimate interests — proof of disclosure compliance. Honestly stated: rewarded posts are paid endorsements under FTC rules, and if anyone ever asks whether the disclosure tag was actually there, we need to be able to show the post ID, the timestamp, and the terms in force — so we keep that minimal record even after the rest is gone.

Where a legitimate interest is the basis, you can object — see section 9.

6. Our Role, Plainly

There are two of us handling your data, and we do different jobs.

The Product is the controller for its own account with you and its own identifier for you. It decides who is enrolled, what a credit is worth inside its product, and what else it does with your account. For that identifier and for delivering the credit grant, we act as its processor — we act on its instructions.
We are an independent controller for the platform data we gather ourselves — querying a Supported Platform’s public API, verifying posts, retaining disclosure-compliance evidence, and running fraud and abuse detection. Nobody instructs us to do that; we decide it, so we answer for it. That is why you are reading our notice and not only the Product’s.

If you want your account with the Product deleted, ask the Product. If you want the platform data we hold deleted, ask us.

The Product. It has to know which of its users to credit and how much, so it receives your identifier, the amount, and a reference to the post that earned it. It also sees your public handle and the public URL of your Qualifying Posts on its own dashboard.
Our service providers. Google Cloud Platform hosts everything we run. Resend sends our transactional email. Stripe handles the Product’s payments to us, never yours. Supported Platform APIs are where we read your public posts. And where the Product asks for an insight run over its own posts, Google’s Gemini on Vertex AI produces it — your post content is not used to train any AI model, and nothing about an insight run touches whether your post qualifies, what it earns, or your eligibility.
Legal obligations. We may disclose information where we are required to by law, or where it is necessary to investigate fraud, abuse, or a threat to someone’s safety.

We do not sell your personal information, and we have not sold it in the preceding twelve months. We do not share it for cross-context behavioral advertising, as those terms are used in the California Consumer Privacy Act as amended by the CPRA. We do not use it for advertising at all.

8. How Long We Keep It

While you’re enrolled. We keep your platform binding, Claim history, and post records for as long as you are enrolled in the Product’s earned tier.
When you delete a post or make it non-public. We remove the retained post content and engagement figures. If this happens before the post settles, there is no reply bonus for it — at settlement the post must still be public and still carry the disclosure tag. This is both our own policy and an obligation the platforms impose on us: content deleted on the platform must be deleted downstream.
What survives that. Only the minimal settlement record needed to evidence a reward that already happened — the post ID, the timestamp, the value granted, and the terms snapshot in force at the time. It is what proves a completed transaction and satisfies disclosure-compliance recordkeeping. It does not include the text of your post. We keep it for five years from the date the reward was granted, then delete it.
Technical logs. Retained for security and troubleshooting, then deleted or aggregated. Aggregated, non-identifying analytics may be kept for up to 24 months.

9. Your Rights

Depending on where you live, you have some or all of these rights:

Access — a copy of the personal data we hold about you.
Deletion — deletion of your personal data, subject to the minimal settlement record described in section 8 and any other legal exception.
Correction — correction of anything inaccurate.
Portability — your data in a structured, commonly used, machine-readable format.
Objection — to processing based on our legitimate interests.
Restriction — to have processing limited while a question is resolved.

Two practical ones that matter more than the rest:

Unbinding your platform account. There is an Unbind control on your status page — one click, no email, no waiting on us. It removes the link between your social account and your enrollment. You can also email privacy@earnesty.app if you would rather. New posts from that account will stop being recognized, and any post still waiting to settle will not settle. Rewards already delivered stay in your Product account — they are the Product’s to manage, not ours.
Leaving the program. Enrollment belongs to the Product, so ask the Product to remove you from its earned tier. You can also simply stop posting; nothing happens, nothing expires against you, and you keep whatever credits you have already earned.

We respond to requests within 30 days. Contact privacy@earnesty.app. If you are in the EEA or the UK, you also have the right to complain to your local data protection authority.

We will not treat you differently for exercising any of these rights.

10. Security

We protect your information with encryption in transit (TLS 1.2 or higher) and at rest (AES-256), role-based access controls, multi-factor authentication for administrative access, least-privilege access, network segmentation, and regular vulnerability scanning. Know Reply is pursuing SOC 2 Type II certification. No system is perfectly secure, but these are the controls we hold ourselves to.

11. Children

Earnesty is not intended for use by anyone under 18, and we do not knowingly collect personal information from anyone under 18. Earning through Earnesty means accepting something of value for a public endorsement, so the floor is 18 rather than the lower age that would suffice for privacy alone. If we learn that we have collected personal information from someone under 18, we will delete it promptly. If you believe a child’s information is in our hands, email privacy@earnesty.app.

12. International Transfers

We are based in the United States and your information is processed there. If you are in the European Economic Area, the United Kingdom, or Switzerland, this means your data is transferred outside your country. Where that happens, we rely on the Standard Contractual Clauses approved by the European Commission (and the UK Addendum where applicable), along with the security measures described in section 10.

13. Changes to This Notice

If we change this notice, we will post the updated version and change the “Last Updated” date at the top. If a change materially affects what we collect about you or why, we will make sure it is visible on your status page rather than quietly swapping the page.

Contact Us

Questions about this notice, or a request about your data: privacy@earnesty.app.

General questions about Earnesty: hello@earnesty.app.

Know Reply Inc., a Delaware corporation. Know Reply Inc., 8 The Green, Suite B, Dover, Delaware 19901, USA.