USER Privacy Notice

Last Updated: October 1, 2026

The 60-second version

We read your public posts about the Product. That is the whole mechanism: you post publicly, we check the post mechanically, and a reward follows.
We never read your DMs, and what you say never changes what you earn. A critical post earns exactly what a positive post earns.
The Product gets your identifier and the amount you earned, plus a reference to the post that earned it. Not your DMs, not an analysis of your views.
You can unbind your platform account at any time by emailing privacy@earnesty.app. New posts stop being recognized; rewards already delivered stay yours inside the Product.
We never pay you money, and you never pay us anything. What you earn is the Product’s own in-product value, whatever form it takes — no cash value, not redeemable for money, not transferable, not a gift card.

The rest of this notice is the detail behind those five points.

This notice explains what Earnesty collects about you, why, and what you can do about it. It is written for you — an individual using a software product that runs its free tier on Earnesty. It is not the privacy policy for the product you use; that product has its own. It is also separate from our Privacy Policy for business customers, because for most of what is described here we decide on our own what to collect and why, and we owe you a direct explanation rather than a footnote in someone else’s.

1. Who We Are and Why You’re Seeing This

Earnesty is operated by Know Reply Inc. (“Know Reply”, “we”, “us”), a Delaware corporation.

You are seeing this notice because you use a software product — we call it the Product — that runs its earned tier on Earnesty. Instead of paying money to refill your usage credits, you post publicly about the Product and we verify that post. When it checks out, we tell the Product to grant you credits — or whatever your Product gives you instead: tokens, an extra seat, a free month.

To do that, we have to look at public posts and keep a record of what we found. That is what this notice is about.

Whatever the Product grants you is its own in-product value, not money. That is true of credits and of every other form a reward can take. We never issue it, it has no cash value, it is not redeemable for money, it is not transferable to anyone else, and it is not a gift card or any other stored-value instrument. You never pay us anything.

Your relationship with us is set out in the Participation Agreement.

2. What We Collect

We collect the following about you:

Your public platform handle and platform account ID. When your first Qualifying Post binds your social account to your enrollment, we store the platform name (for example, X), the platform’s stable identifier for your account, and your public handle. This is how we know a later post is yours without you having to include your Claim Code again.
Your Qualifying Posts. For each Qualifying Post, we store the platform’s post ID, the public URL, the time the post was published, and the time we verified it.
Your post’s public performance counts. At the review due five days after publication, we check that the post is public and retains its required text disclosure. We read the public counts of views, likes, replies, reposts, quotes and bookmarks on your post. We never record who interacted. An optional bonus compares these counts with other recent posts in the Product’s program, within the maximum and limits shown on your rewards page. The review runs on a daily sweep, subject to platform availability and retries.
An optional account display name. The Product may send a person, team or workspace name to make its owner dashboard recognizable. It can update or clear this name; Earnesty does not require a legal name or email address for enrollment.
The Product’s identifier for you. The Product tells us which of its users you are, using its own identifier. To us this string is usually opaque — it is typically an internal ID, not your name or email.
Your Claim, reward, and enrollment history. Your Claim Code, the applicable terms at the post’s timestamp and the acceptance record, what a post earned and when, credit-grant records and whether delivery to the Product succeeded, your enrollment status, and audit-log entries recording Verification events.
Whether a platform disclosure label was present. Where a platform offers its own paid-partnership label, we record whether we saw one. It is not required for your post to qualify, and we record an unavailable result as unknown, not as off.
Technical logs when you visit your status page. IP address, browser and device type, referring URL, and pages viewed, for security, abuse prevention, and troubleshooting.

3. What We Do Not Collect

No private messages. We never read your DMs.
No non-public posts. We only ever look at posts that were public at the time we looked. If a post is protected, private, or restricted, Verification simply fails.
No email address unless you give us one. We do not need one to run the earned tier, and the Product does not pass us yours.
No payment information from you. You never pay us, so we never ask for a card, a bank account, or a billing address.
What you say never affects your reward. A critical post earns exactly what a positive post earns. The Product may get insight from us into how people talk about it — themes, questions and sentiment across posts and their public replies — but that analysis is in aggregate and is never part of whether your post qualifies or what it earns. Our checks for a reward are mechanical: is the post public, is it yours, does the approved disclosure name the Product, is it in the placement required by the Product’s market, is the required native label on, has this post been credited before.
No identities of people who interact with your post. We do not keep who replied, liked or reposted, and we never tell the Product who they are. We use the public counts on your post, and the text of public replies only for the aggregate insight above.
No engagement targets. We reward the disclosed act of posting. We do not buy, sell, or guarantee reach, followers, likes, or reviews, and nothing you earn depends on how a post performs beyond the performance bonus described above, which is capped at a maximum the Product sets.

4. Where It Comes From

From the Product. Your enrollment, the Product’s own identifier for you, an optional account display name, and confirmation that credits were granted.
From you. Your posts, your Claim Code when you include it, and anything you send us — for example, pasting a post URL or pressing “check now” on your status page.
From the Supported Platform’s public API. We read public post content and metadata, your public handle and author ID, disclosure evidence, and the public engagement counts on your post. We never use replies or their authors to calculate a bonus; public replies are read only for the Product’s aggregate insight.

5. Why We’re Allowed To

Where the GDPR or UK GDPR applies to you, our legal bases are:

Performance of a contract. Most of this processing is simply how we deliver what the Participation Agreement promises: we cannot verify a post or tell the Product to credit you without reading the post and keeping a record of it.
Legitimate interests — Verification and fraud prevention. We check that one platform account maps to one enrolled user, that a post is credited only once, and that rewards are not obtained by impersonation or automation.
Legitimate interests — proof of disclosure compliance. Honestly stated: rewarded posts are paid endorsements under FTC rules, and if anyone ever asks whether the text disclosure was actually there, we need to be able to show the post ID, the timestamp, and the terms in force — so we keep that minimal record even after the rest is gone.

Where a legitimate interest is the basis, you can object — see section 9.

6. Our Role, Plainly

There are two of us handling your data, and we do different jobs.

The Product is the controller for its own account with you and its own identifier for you. It decides who is enrolled, what a credit is worth inside its product, and what else it does with your account. For that identifier and for delivering the credit grant, we act as its processor — we act on its instructions.
We are an independent controller for the platform data we gather ourselves — querying a Supported Platform’s public API, verifying posts, retaining disclosure-compliance evidence, and running fraud and abuse detection. Nobody instructs us to do that; we decide it, so we answer for it. That is why you are reading our notice and not only the Product’s.

If you want your account with the Product deleted, ask the Product. If you want the platform data we hold deleted, ask us.

The Product. It has to know which of its users to credit and how much, so it receives your identifier, the amount, and a reference to the post that earned it. It also sees your public handle and the public URL of your Qualifying Posts on its own dashboard.
Our service providers. Google Cloud Platform hosts everything we run. Resend sends our transactional email. Stripe handles the Product’s payments to us, never yours. Supported Platform APIs are where we read your public posts. And where the Product asks for an insight run over its own posts, Google’s Gemini on Vertex AI produces it — your post content is not used to train any AI model, and nothing about an insight run touches whether your post qualifies, what it earns, or your eligibility.
Legal obligations. We may disclose information where we are required to by law, or where it is necessary to investigate fraud, abuse, or a threat to someone’s safety.

We do not sell your personal information, and we have not sold it in the preceding twelve months. We do not share it for cross-context behavioral advertising, as those terms are used in the California Consumer Privacy Act as amended by the CPRA. We do not use it for advertising at all.

8. How Long We Keep It

While you’re enrolled. We keep your platform binding, Claim history, and post records for as long as you are enrolled in the Product’s earned tier.
When you delete a post or make it non-public. We remove the retained post content and engagement figures. If this happens before the post settles, there is no performance bonus for it — at review the post must remain public with both required disclosures, or its base grant is also revoked under the Program Rules. Deletion after the completed review does not reverse the settled Reward. This is both our own policy and an obligation the platforms impose on us: content deleted on the platform must be deleted downstream.
What survives that. Only the minimal settlement record needed to evidence a reward that already happened — the post ID, the timestamp, the value granted, and the terms snapshot in force at the time. It is what proves a completed transaction and satisfies disclosure-compliance recordkeeping. It does not include the text of your post. We keep it for five years from the date the reward was granted, then delete it.
Technical logs. Retained for security and troubleshooting, then deleted or aggregated. Aggregated, non-identifying analytics may be kept for up to 24 months.

9. Your Rights

Depending on where you live, you have some or all of these rights:

Access — a copy of the personal data we hold about you.
Deletion — deletion of your personal data, subject to the minimal settlement record described in section 8 and any other legal exception.
Correction — correction of anything inaccurate.
Portability — your data in a structured, commonly used, machine-readable format.
Objection — to processing based on our legitimate interests.
Restriction — to have processing limited while a question is resolved.

Two practical ones that matter more than the rest:

Unbinding your platform account. There is an Unbind control on your status page — one click, no email, no waiting on us. It removes the link between your social account and your enrollment. You can also email privacy@earnesty.app if you would rather. New posts from that account will stop being recognized, and any post still waiting to settle will not settle. Rewards already delivered stay in your Product account — they are the Product’s to manage, not ours.
Leaving the program. Enrollment belongs to the Product, so ask the Product to remove you from its earned tier. You can also simply stop posting; nothing happens, nothing expires against you, and you keep whatever credits you have already earned.

We respond to requests within 30 days. Contact privacy@earnesty.app. If you are in the EEA or the UK, you also have the right to complain to your local data protection authority.

We will not treat you differently for exercising any of these rights.

10. Security

We protect your information with encryption in transit (TLS 1.2 or higher) and at rest (AES-256), role-based access controls, multi-factor authentication for administrative access, least-privilege access, network segmentation, and regular vulnerability scanning. Know Reply is pursuing SOC 2 Type II certification. No system is perfectly secure, but these are the controls we hold ourselves to.

11. Children

Earnesty is not intended for use by anyone under 18, and we do not knowingly collect personal information from anyone under 18. Earning through Earnesty means accepting something of value for a public endorsement, so the floor is 18 rather than the lower age that would suffice for privacy alone. If we learn that we have collected personal information from someone under 18, we will delete it promptly. If you believe a child’s information is in our hands, email privacy@earnesty.app.

12. International Transfers

We are based in the United States and your information is processed there. If you are in the European Economic Area, the United Kingdom, or Switzerland, this means your data is transferred outside your country. Where that happens, we rely on the Standard Contractual Clauses approved by the European Commission (and the UK Addendum where applicable), along with the security measures described in section 10.

13. Changes to This Notice

If we change this notice, we will post the updated version and change the “Last Updated” date at the top. If a change materially affects what we collect about you or why, we will make sure it is visible on your status page rather than quietly swapping the page.

Contact Us

Questions about this notice, or a request about your data: privacy@earnesty.app.

General questions about Earnesty: hello@earnesty.app.

Know Reply Inc., a Delaware corporation. Know Reply Inc., 8 The Green, Suite B, Dover, Delaware 19901, USA.