Privacy Policy

The extension reads subreddit rules, your own Reddit account data, and the drafts you are writing — all from the Reddit session you are already signed into — and keeps them in your browser’s local storage (IndexedDB and chrome.storage). Your post history and the rule summaries we cache are stored there and are never uploaded to us. You can delete them at any time by clearing the extension’s storage.

The extension makes exactly three kinds of request to Reddit, all of them carrying your own session cookie and reading only pages that session is already served: a subreddit’s public information, its published rules, and your own account summary. It makes no anonymous or logged-out requests to Reddit at all, and it never touches Reddit’s developer API.

PostGuard has two AI features, and each one only runs when you explicitly press its button. What is sent depends on which one you use:

• Reply drafts. The Reddit post’s title, a truncated excerpt of its body, up to six truncated comments from the thread, and the short note you typed about what you want to say.
• AI rule review. The title and body of the post you are writing, the domains of any links in it, its flair, the subreddit’s published rules, and coarse account context: an account-age bucket (for example “31-90 days”), a karma bucket (for example “1k-10k”), and how many of your submissions to that subreddit in the last 30 days were self-promotional, as small counts. Your Reddit username is never sent.

Our backend forwards this to our AI inference provider (OpenRouter) and returns the result to the extension. We do not use your content to train models, and we do not store or log it; it exists only for the duration of the request.

You do not need an account for the pre-flight checks or the account panel. An account is only required for the AI features and for billing. If you sign up, we store your email, name (if provided), and authentication records via our own independent authentication system. Session cookies are host-only to postguard.xeviora.com and are not shared with other Xeviora sites.

If you sign in with Google or GitHub, we receive only the basic profile information needed to create your account (email and name).

AI usage is metered in credits. We keep an append-only ledger of credit grants and usage tied to your account.

Payments are processed by our reseller and Merchant of Record, Paddle.com (“Paddle”). Paddle collects and processes your payment and billing information (such as name, email, billing address, country and payment details) as an independent data controller, in order to process your order, calculate taxes, prevent fraud and meet its legal obligations. We never receive or store your full card details. We receive limited order information from Paddle (such as your email, country, plan and transaction status) to provide the service. See Paddle’s Privacy Notice, and our Refund Policy for how refunds work.

PostGuard never asks for your Reddit password and does not use Reddit’s login APIs or its developer API. It works alongside the Reddit session already in your browser, reads the same data that session is served, and never posts, votes, comments, follows, messages, or deletes anything on your behalf, and it does not type into the page for you. AI drafts are shown in the extension with a copy button; you paste, edit and press the button yourself. PostGuard is an independent tool and is not affiliated with, endorsed by, or sponsored by Reddit, Inc.; Reddit and the Reddit logo are trademarks of Reddit, Inc.

The website uses Google Analytics 4 to count page views and a handful of product events: clicks on “Add to Chrome”, starting and returning from checkout, newsletter sign-ups, signing in or creating an account, and page-speed measurements. We use it to see which pages actually lead people to install the extension. Nothing you write or read on Reddit is ever sent to it — no usernames, subreddits, titles, drafts or links. Event data is limited to the page path on our own site and the domain of any outside link you click.

The extension itself contains no analytics of any kind. Nothing you do in the side panel is measured, counted or reported.

Advertising storage, advertising user data and ad personalisation are switched off globally through Google Consent Mode v2 — we do not advertise and we do not build remarketing audiences. Analytics storage is denied by default in the EEA, the United Kingdom and Switzerland: visitors from those regions are measured without cookies (Google calls these “cookieless pings”), which is why this site shows no cookie banner. Elsewhere, Google Analytics sets its usual first-party _ga cookies to tell repeat visits apart. IP addresses are anonymised and are not available to us. Any tracker blocker will stop all of this, and the site and the extension keep working normally.

Google Ireland Limited acts as our processor for this data; see Google’s privacy policy. Our legal basis is legitimate interest in understanding how the site performs, and in the regions listed above the measurement is cookieless.

• We do not sell your data.
• We do not track your browsing across the web.
• We do not use analytics or advertising trackers inside the extension.
• We do not use advertising or remarketing trackers anywhere, website included.
• We do not store the Reddit posts, comments or subreddits you read.
• We do not act on your behalf on Reddit or any other third-party site.
• We do not send any anonymous or logged-out request to Reddit.

Local data lives only in your browser; uninstalling the extension or clearing its storage removes it. To delete your account and associated AI/billing records, contact us at the address below and we will remove them, subject to legal and accounting retention requirements.

Questions about this policy? Email privacy@xeviora.com.