Privacy Policy
Last updated 2 September 2026.
What this service does with data
anomalia/leads reads public conversations on Reddit, Threads, X and LinkedIn, judges which ones a customer could genuinely contribute to, and writes a draft reply. It never posts anything: the customer copies the draft and publishes it from their own account.
Data about you, as a customer
- Your account. Email address, and a password hash if you did not sign in with GitHub. Handled by Supabase Auth; we never see your password.
- Your brand. The name, description and website you enter. The description is sent to a language model to work out which communities to watch.
- Your sources. The subreddits and searches configured for each brand.
- Usage. When a search ran, how many sources answered, how many failed and the last error, so an empty queue can be told apart from a broken one.
Data about people who did not sign up
To do its job the service stores parts of public posts written by people who are not our customers: the post's title, its link, a short excerpt, the platform, and the author's public handle. This is public content, collected to decide whether a reply would be useful and to write one for it.
It is deleted on a schedule, not kept indefinitely:
- 14 days — the excerpt derived from the post, which is the most sensitive part.
- 90 days — the whole record, for conversations nobody ever replied to.
- 12 months — what happened to a comment that was published (upvotes, replies, removal).
- 90 days — search telemetry.
The do-not-contact list
We keep one list of platform handles that must never be surfaced again. It is deliberately shared across every customer of the service, not per customer: someone who asked not to be contacted, or who has already been messaged once, is not offered to anyone else. Keeping that list is what makes the promise enforceable.
It stores only the platform and the public handle, plus why the entry exists. An entry is added when a person replies asking to be left alone, when a customer marks them as ignored, or when the phrase is detected in the thread. Every direct message draft carries an opt-out line, and replying “stop” adds the sender to the list.
Who else processes this data
- Supabase — database, authentication and hosting of your account data.
- Vercel — application hosting.
- OpenRouter — routes prompts to the language model that judges conversations and writes drafts.
- ScrapeCreators — collects the public posts from the platforms.
We do not sell data, and we do not use it to train models of our own.
Your rights
You can ask for a copy of your data, correct it, or have it deleted. Deleting your account removes your brands, sources and queue. Entries in the do-not-contact list are the one exception: removing them would undo somebody else's request not to be contacted, so they stay.
If you are the author of a post we stored and want it removed, write to us and we will delete it and add your handle to the do-not-contact list.