Last updated
Privacy policy
This page explains what Recaply collects when you use recaply.co, why, who helps us handle it and how long we keep it. Recaply is run by Graplify, LLC. We collect as little as we can, we never see your card number, and we do not sell your data.
What we collect
What we keep, and why.
Your account
When you create an account, we keep your email address, your name if you give one, and your password as a salted PBKDF2 hash. A hash cannot be turned back into the password. We also keep whether you have confirmed your email and when the account was made.
We use these to sign you in, to send your password links and payment notes, and to keep what you bought in one place.
If you add a profile photo in your Dashboard, we keep it at 256 pixels on our image host, at an address only your Dashboard and the site’s menu link to. Remove photo deletes it, and so does deleting your account.
Signing in with Google
If you sign in with Google, Google sends us your email address, your name, your Google account ID and the address of your Google profile picture, and confirms that the email is yours. We ask Google for nothing more. We use the ID only to match the sign-in to your account, and the picture’s address only if you choose Use my Google photo.
Purchases
Payments go through Stripe. You type your card details on Stripe’s page, not ours, so we never see or store your card number.
From Stripe we keep what you bought, the amount and currency, the date, the email you paid with, and Stripe’s IDs for you as a customer, for the payment and for any subscription. We use them to open what you paid for, to list your purchases on your Dashboard, and for refunds, disputes and our accounts.
We also note when you first open what you bought (a premium prompt’s or skill’s text, or a skill’s download), as a record of use that helps us answer a dispute.
Votes, ratings and saved items
When you upvote a tool, skill or prompt, or rate a tool, we store the vote or the stars with your account, so each account counts once. Others see only the totals and the average.
When you are signed in, what you save, your progress through a tutorial and the kits you download are kept with your account, so your Dashboard shows them on any device. Signed out, the prompts and jobs you save and your tutorial progress stay in your browser (see Cookies and storage below), and the first time you sign in there, they are copied to your account.
Tool submissions
When you submit a tool, we keep its name, link, category and price model, any line, note or logo you send, and your email address. We do not keep your network address with it. To limit how many one connection can send in a day, we count a keyed hash of the address and delete the count after that day. If you pay, we also keep Stripe’s IDs for the payment and the amount.
We use this to review and list your tool, to run the waitlist and to email you about it.
Advertising briefs
The brief form on our Advertise page emails your name, your email, the link you want to promote, the place and week you pick, and your note to our inbox. The site does not store the brief. We send you a short note to say we have it, and we keep the thread in our mailbox.
Newsletters
When you subscribe, we send your email address, the newsletters you picked and the page you signed up on to beehiiv, which runs our three newsletters. beehiiv sends the welcome email and each issue, and every issue has a link to unsubscribe. Once you unsubscribe, our site never adds that address back.
Emails
We send account emails (to confirm your email or reset your password), notes about payments and emails about listings from listing@notify.recaply.co, through Cloudflare Email Service. Replies go to listing@recaply.co. Email you send us is kept in our mailbox, which Google Workspace hosts.
Cookies and storage
The cookies we use.
Our cookies
We set cookies only when you sign in, never just because you visit a page.
__Host-rcl keeps you signed in. It holds a random code, and we store only a hash of it. It lasts 30 days, renews while you use the site, and is deleted when you sign out.
__Host-rcl-g lasts 10 minutes while you sign in with Google. It holds the codes that check Google’s answer is meant for you, and the page to return to.
Our editors’ admin area, which only they can open, uses its own sign-in cookies. Readers never get them.
Cookies from others
Cloudflare, which runs our site, may set its own security cookies, such as __cf_bm or cf_clearance, when it checks that a visitor is not a bot. Stripe sets its own cookies on its checkout and billing pages, and a maker’s site sets its own when you follow a link to it.
We use no advertising or tracking cookies.
Storage in your browser
Some things are kept only in your browser’s own storage: your light or dark theme, the prompts and jobs you save, the agent you prefer on skill and MCP pages, your progress through a tutorial, your tool submission reference, and small notes such as a card you closed. They stay on your device. Clearing this site’s data in your browser removes them.
Counting and security
How we count visits and stop abuse.
Counting visits
We use Cloudflare Web Analytics to count visits. It sets no cookies and does not follow you across other sites.
On recaply.co we also use PostHog to count visits, page views and time on the site, and to measure how fast pages load and respond. It runs through our own address and sets no cookies or browser storage. For each page you open and leave, it gets the page’s address (we drop its query string, except campaign tags and the page number), the page you came from, your browser, device type, language, time zone and screen size, your country, which we work out from your network address, and how long the page took to show and to respond to you (Core Web Vitals). To tell visits apart, PostHog makes a hash of your network address and browser with a key it changes every day, and it keeps neither the address nor the hash key. It never sees your account, and it does not run on your Dashboard or on pages with an email link’s code. If your browser sends Do Not Track or Global Privacy Control, it does not run at all.
We also count views of tool and prompt pages, saves of prompts, and clicks on a tool’s Visit link, which we keep as a total for each tool and month to show its maker. To count each connection once a day, we use a hash of your network address and the date, and we clear it out after that day.
Bot checks
On sign-up, on every sign-in, and on the Submit a tool and Advertise forms, we may ask Cloudflare Turnstile to check that a person is filling in the form. To do that, Turnstile reads your network address and details from your browser.
Before we open an account or add a newsletter sign-up, we also look up whether the email’s domain can receive mail. That lookup sends only the part after the @.
Limits
To stop abuse, we count sign-ups, sign-ins, password resets and checkouts by a keyed hash of the network address (for IPv6, of the network rather than the device), and wrong passwords by a keyed hash of the email. We delete these counts after a day.
The limits on our forms count a hash of the network address or the email, one day at a time. Cloudflare also limits how many pages one address can load in a minute.
Logs
Like any web host, Cloudflare sees your network address and browser details with each request. Our server logs record errors and basic details of requests, and Cloudflare keeps them for up to 7 days.
When a browser reports that our security policy blocked something, we log one report in ten, with the page address only.
Who handles it
The services we use.
- CloudflareHosts the site, its databases, images and backups. Sends our emails, checks for bots and counts visits.
- StripeTakes payments and keeps card details. Runs the billing page where you change your card, see invoices or cancel.
- beehiivRuns our three newsletters and their sites, keeps the subscriber list, and serves the issue covers on our Newsletters page.
- GoogleSigns you in, if you choose Google. Hosts our mailbox at recaply.co.
- PostHogCounts visits, page views and time on the site, and measures page speed, without cookies, in the United States.
Each of them handles your data under its own privacy policy and its terms with us. We share your data with no one else, unless the law requires it or we sell or merge the business, and then this policy keeps applying to it. We do not sell your data or use it for ads.
When you follow a link to a tool, its maker can see that you came from recaply.co. Links marked as paid, or as earning us a commission, may carry the maker’s referral code.
How long
How long we keep it.
- Your account, votes and ratingsUntil you delete your account in your <a href="/dashboard/settings">Dashboard’s Settings</a>. If the email is never confirmed, the account is deleted 30 days after sign-up, unless it has a purchase, access or a vote.
- PurchasesPaid, refunded and disputed purchases are kept for our tax and accounting records, also after you close your account, with no account named. Checkouts that were never paid are deleted after 7 days, and our log of the payment events Stripe sent us after 90 days.
- Sign-ins and email linksA sign-in ends at most 30 days after you last use the site, and is then deleted. A confirm link works for 3 days and a reset link for 1 hour. We delete them once used or expired, except the confirm links of an account that is not confirmed yet, which we keep to limit how many we send. They go with the account after 30 days.
- Attempt counts and form limitsKept for about a day, then deleted.
- Tool submissionsKept as the record of your listing. A submission that never went live and was never paid for (declined, lapsed, never confirmed, or sent but left unpaid) is deleted after 180 days. One that was paid for stays with our payment records. Ask us and we delete a submission that never went live sooner.
- Briefs and emailsIn our mailbox, until we no longer need them.
- LogsUp to 7 days.
- Visit countsPostHog keeps the page views we send it, with no name, email or network address, under its data retention terms.
- BackupsWe copy our databases every day and keep each copy for 90 days. Password hashes, sign-ins, email links and attempt counts are left out of the copies. A closed account can stay in a copy for up to 90 days. We keep its account ID, with no email, so that if we ever restore a copy, we delete the account again.
- Newslettersbeehiiv keeps your subscription until you unsubscribe.
Your rights
What you can ask us.
Your data
You can ask for a copy of the data we hold about you, ask us to correct or delete it, or ask us to stop using it. Write to hello@recaply.co from the email on your account, so we know the request is yours. We answer within 30 days.
You can close your account yourself, as set out below.
Closing your account
Use Delete account in your Dashboard’s Settings, and confirm it with your password, or by signing in with Google again. Closing cancels any plan that is still running at once, without waiting for the end of the period you paid for. It deletes the account with its sign-ins, upvotes, ratings, saves, tutorial progress, download history, photo and access. The purchase records we need for tax and accounting stay, with no account named.
A closed account can stay in our backups for up to 90 days, and is deleted again if we restore one.
Newsletters
Use the unsubscribe link at the bottom of any issue.
If you are in the EU or UK
We use your data to run your account and deliver what you buy (our contract with you), to keep payment records (a legal duty), to keep the site safe and count visits (our legitimate interests), and to send the newsletters you asked for (your consent, which you can take back any time). You can also complain to your data protection authority.
If you are in the US
We do not sell your personal information or share it for targeted advertising. Depending on your state, you may have the right to know, correct and delete the data we hold. Ask us as above.
The rest
Children, changes and how to reach us.
Children
Recaply is not meant for children. You must be 16 or older to create an account, and we do not knowingly collect data from anyone younger. If you think a child has given us data, tell us and we delete it.
Where your data is handled
Our providers handle data in the United States and other countries, so your data may be handled outside the country you live in.
Changes to this policy
When we change this policy, we update the date at the top. If a change affects how we use data we already hold, we email account holders before it takes effect.
Contact
Recaply is run by Graplify, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States. For privacy questions, or anything else, write to hello@recaply.co.