Security

What StarReply stores, who else processes it, and how to report a vulnerability.

Reporting a vulnerability

Email hello@kynth.studio. Include the URL, what you did, and what you saw. There is no bounty and no NDA to sign. We will confirm receipt, and we will tell you what we changed.

The same address, with a machine-readable expiry, is published at /.well-known/security.txt under RFC 9116.

Accounts

StarReply has user accounts. What is stored against one, and who else touches it, is below.

What is stored

  • Your account: the email address you sign in with, and the locations and review profiles you connect
  • The reviews the agent reads, the replies it drafts and every decision you make on them — approved, edited, killed — because that record is what makes the kill window provable rather than asserted
  • Your voice profile: what the agent learned about how you write, built from the replies you approved
  • Anonymous usage analytics — page views and clicks. Form inputs are masked in session recordings

Who else processes data

  • Supabase — authentication and the database holding your locations, reviews and reply history
  • Google Business Profile — where your reviews are read from and your approved replies are posted, under the access you granted
  • PostHog — anonymous product analytics, proxied through this domain
  • Vercel — serves this site and holds its access logs

Also true

  • The agent never posts a reply to a low-rated review on its own, in any mode. That branch runs before the mode is read, so it cannot be configured away.
  • An approved reply is STAGED, not sent. The publisher will not pick it up before the kill window has elapsed, so a killed reply was never published — not published and then deleted.
  • There is no password on this product. Sign-in is a link to your email address, so there is nothing to reuse or leak.
  • The paid plans are PRO at $39/month and CHAIN at $99/month; the free plan needs no card at all. There is no payment processor in the list above because this repo has no checkout route at all — a build gate re-checks that rather than believing it.

StarReply is built and run by Kynth Studios. The declarations on this page are part of this product's own configuration and are re-checked at every deploy against the repository they describe: a product that claims to have no accounts and ships an authentication route fails the build, and so does one that takes payment without naming its payment processor here.