Who we are
Karmdit is a small family of Reddit tools - Cleaner, for cleaning up your account, and Growth, for participating well - built in Latvia, in the EU. The legal entity is SIA Great Success (reg. no. 50203008941), registered in Latvia.
For anything in this policy: privacy@karmdit.com. For data-protection-specific requests, you can reach our DPO at the same address with the subject line "DPO request".
What data we collect
We collect six buckets of data, and only what we need for each.
- Account data
- Your email address, your Reddit user ID and OAuth tokens (so we can act on your behalf), and your account creation date. That's it.
- Content data
- When you scan your account, we fetch and store the text of your posts and comments (title, body, subreddit, score, timestamp, permalink). We keep it so you can filter and search your history, see your audit and risk analysis, and export a copy before you delete anything. We store it only until you delete an item - once an item is removed, its text is wiped within 24 hours (see below). We never use it to train AI, and we never sell or share it.
- Growth brand data
- If you use Karmdit Growth, we store the brand profile you create (brand name, URL, description, goals, voice notes, keywords), your tracked subreddit list, the Reddit threads the feed surfaces to you, and the AI draft text generated for you. This is the data Growth needs to find relevant threads and draft replies; it stays until you delete the brand, the drafts, or your account. To generate a draft, your brand profile and the thread you are replying to are sent to Anthropic, our AI provider (see the note in "How we use it"). We never use any of it to train AI.
- Usage data
- The filters you've applied, the items you've removed, and an audit log of every Karmdit action so you can see what we did and roll back if needed.
- Billing data
- If you're on a paid plan, we store a Stripe customer ID and the metadata Stripe sends back (plan, billing country, last-four of card). We never see or store your card number.
- Support communications
- If you email us, we keep that email and our reply for 18 months so we can pick up where we left off if you write again.
How we use it
We use your data to do the thing you signed up for: clean your Reddit account, then prove that we did. Specifically:
- Providing the service. Reading your Reddit history, applying your filters, executing deletions, generating reports.
- Billing. Charging you (if you're on a paid plan), managing renewals, handling refunds.
- Security. Detecting unusual activity on your account and ours, blocking abuse.
- Legal compliance. Responding to lawful requests where required, keeping records we have to keep.
How long we keep it
Different data has different retention periods. Here's the full list.
| Data type | Kept for | Why |
|---|---|---|
| Reddit post content (not yet deleted) | Until you delete the item | Filtering, audit and risk analysis, export |
| Reddit post content (deleted) | Up to 24 hours after run, then wiped | To execute and verify the deletion |
| Growth brand profile (name, URL, description, goals, voice notes, keywords, tracked subreddits) | Until you delete the brand or your account | Powering your opportunity feed and drafts |
| Growth AI drafts | Until you delete them or your account | So you can edit, reuse, and post them yourself |
| Audit log entries | 90 days | So you can roll back; legal compliance |
| Account data | While your account is active | Running the service |
| Account data after deletion | 30 days, then purged | Recovery window |
| Billing records | 10 years | Latvian accounting law (Grāmatvedības likums) |
| Support emails | 18 months | Continuity of conversation |
Your rights (GDPR / CCPA)
Whether you're in the EU, the UK, California, or anywhere else, the same rights apply to your Karmdit data. We don't differentiate by jurisdiction - that's just simpler.
- Access
- Download everything we have on you. Settings → Privacy → Export all data. Comes back as a JSON bundle within an hour.
- Correction
- Wrong email or country in your account? Edit it in Settings, or write us if it's somewhere weird.
- Deletion
- Settings → Account → Delete account. Goes through a 30-day recovery window, then is gone for good.
- Portability
- The JSON export is machine-readable and structured. Take it to a competitor; we won't be sad. (We will be a little sad.)
- Objection
- If you don't want us using your data for something specific (e.g., aggregate product analytics), email privacy@karmdit.com and we'll honor it.
You also have the right to lodge a complaint with your local data protection authority. Ours is the Latvian Data State Inspectorate (Datu valsts inspekcija). If we've messed up, please tell us first - but you don't have to.
Security
We use industry-standard practices, which sounds boring because it's boring, which is the right register for security.
- Encryption at rest for the database (AES-256, Supabase-managed keys).
- Encryption in transit for everything (TLS 1.3, HSTS preloaded).
- Encrypted backups rotated daily, retained for 7 days.
- Access controls - only two engineers have production database access, and every query is logged and audited monthly.
- OAuth-only Reddit access - your Reddit password never reaches us.
- SOC 2 Type 2 audit - in progress, expected complete Q3 2026.
If you find a vulnerability, please email security@karmdit.com. We don't yet have a formal bug bounty but we will absolutely send you swag and credit.
Children
Karmdit is not for anyone under 16. We don't knowingly collect data from children. If you believe we have, please write to privacy@karmdit.com and we'll delete it within 72 hours.
Reddit's own age requirement is 13, but ours is higher because GDPR's "child" threshold is 16, and we'd rather match the higher bar globally than draw a line by jurisdiction.
International transfers
For now, all Karmdit infrastructure is hosted in the EU. Your data does not leave the EU. The only exception is when you yourself initiate an action that calls Reddit - those calls go to Reddit's US servers because that's where Reddit is - but no Karmdit-stored data is shipped to the US.
If we ever change this, we'll update this section and notify you 30 days before.
Changes to this policy
We update this policy when our practices change. For meaningful changes - anything affecting how we collect or share data - we'll notify you by email at least 30 days before they take effect.
Cosmetic changes, typo fixes, and clarifications don't trigger a notification. The "last updated" date at the top of the page always reflects the most recent change.
Contact
Anything privacy-related: privacy@karmdit.com. We aim to respond within two working days, and always within the legal limit (30 days for GDPR-eligible requests).
For legal service of process, our registered entity is SIA Great Success (reg. no. 50203008941), registered in Latvia. Email privacy@karmdit.com and we'll provide service details.