Rehatch is built to need as little of your data as possible. The extension runs entirely in your browser, using your own OpenAI API key, with no Rehatch server sitting between your content and OpenAI — the one narrow exception (a device-deactivation relay that only ever sees a license key) is covered below. This page explains exactly what that means in practice.
The short version
Your screenshots, your OpenAI key, and the posts you generate go from your browser straight to OpenAI, and nowhere else. We (the makers of Rehatch) never receive, store, or have access to any of it. Everything the extension keeps — your business profiles, your API key, your saved posts — lives only in your own browser's local storage, on your own device.
What the extension stores, and where
- Your OpenAI API key — stored in your browser's local extension storage (
chrome.storage.local). It is sent only toapi.openai.comwhen you generate content. We never see it. - Your license key — stored the same way, and sent to Gumroad's License API to activate or confirm your license. Deactivating a device sends your license key to a single small Rehatch-run endpoint that relays it to Gumroad — see below.
- Business profiles (name, voice, audience, offers) that you set up — stored locally in your browser.
- Your Library — the original screenshots, generated images, and captions you've created — stored locally in your browser's IndexedDB. Nothing is uploaded anywhere for storage.
If you uninstall the extension or clear your browser's site data for it, this local data is deleted along with it. We have no copy of it — there is nothing for us to delete on our end, because we never had it.
What gets sent to OpenAI, and why
When you capture a post and generate an adaptation, your browser sends the screenshot and your business brief directly to OpenAI's API, using your own API key, to produce the rewritten caption and regenerated image. If you use the "Research my website" feature, the URL you provide is sent to OpenAI to research and summarize. In every case, this is a direct connection from your browser to OpenAI — it does not pass through any server we operate. Your use of OpenAI is subject to OpenAI's own privacy policy, since you're using your own OpenAI account.
What gets sent to Gumroad
Gumroad is our payment processor and license manager. When you purchase Rehatch, Gumroad collects your payment details directly — we never see or store your card information. To activate or revalidate your license, the extension sends your license key directly to Gumroad's public License API — this is a direct browser-to-Gumroad connection, not something that passes through a Rehatch server. See Gumroad's privacy policy for how they handle that.
The one thing we do run a server for
Deactivating a license on a device (freeing up that activation slot) requires a Gumroad seller credential that can't safely be embedded in extension code — anyone could extract it from the installed extension and use it. So that one action, and only that one action, routes through a small serverless function we run at rehatch.design/api/license-deactivate. It receives your license key, forwards it to Gumroad using that credential, and returns the result. It never receives your screenshots, captions, generated content, or your OpenAI key — those still go straight from your browser to OpenAI, as described above.
Facebook posting
The "Post for me" feature works by having the extension fill in the caption and image on Facebook's own post composer, on the Facebook tab you already have open. It does not read your Facebook messages, friends list, or any other data — it only interacts with the composer box, and it never submits the post for you; you always review and click Post yourself.
The website (rehatch.design)
This website is hosted on Vercel, which may log standard technical information (like IP address and browser type) as part of normal web hosting. We use two analytics tools on this marketing site, both of which set cookies:
- Google Analytics, to see aggregate traffic — how many people visit, which pages, roughly where from. See Google's privacy policy.
- The Meta (Facebook) pixel, so we can measure whether our ads actually bring people here and lead to a purchase. It tells Meta that a browser visited a page on rehatch.design, and Meta may match that to a Facebook or Instagram account. See Meta's privacy policy. You can limit this in your Facebook ad settings, and browser tracking protection or an ad blocker will stop it outright.
Both are confined to this marketing website. Neither one runs inside the Rehatch extension, and neither can see anything you capture, generate, or store in it — the extension ships no analytics of any kind. If you email us, your message is handled through our email provider (Resend) and forwarded to our inbox; we use your email address only to reply to you.
Children's privacy
Rehatch is intended for business use and is not directed at children. We do not knowingly collect data from anyone under 16.
Changes to this policy
If this policy changes, we'll update the date at the top of this page. Since the product's core design — no server, your own key — isn't changing, we don't expect this page to change often either.
Contact
Questions about this policy? Email hello@rehatch.design.