Privacy policy
Last updated: 25 October 2026
This policy tells you what data ReachArena ("we", "us") collects, why we collect it, who receives it, and how long we keep it. It applies to the website reacharena.com, the ReachArena app, and the ReachArena Chrome extension.
1. Data we collect
| Data | Where it comes from |
|---|---|
| Email, first name, last name, password (stored only as a one-way hash) | You, at signup, or Google when you use Google sign-in |
| Where you heard about us, your browser name, your time zone | You and your browser, at signup |
LinkedIn session cookies (the full set, stored encrypted; only li_at and JSESSIONID are used to act) | The Chrome extension, after you connect it |
| LinkedIn profile ID, name, headline, photo link, profile link | LinkedIn, read with your session |
| Your LinkedIn posts (link, text, date) and the likes and comments that ReachArena gave and received | LinkedIn, or you when you add a post link |
| Content Engine ideas, drafts, and schedules | You |
| Plan, subscription status, payment amounts, and invoice IDs. We never see or store your card number. | Dodo Payments |
| Extension version and the time it last contacted us | The Chrome extension |
| IP address (for rate limits), request logs | Your browser |
The extension reads your LinkedIn session cookies and sends them to ReachArena, which stores them encrypted. It does not read your browsing history, other websites, or your LinkedIn password.
2. Why we use it
- To run the service you signed up for: sign you in, connect LinkedIn, find your posts, plan and deliver engagement, publish scheduled posts, and show your dashboard. This is necessary for our contract with you.
- To use your LinkedIn account for the exchange on the Free Forever and Growth plans: like and comment on posts of other members. This is part of what those plans are, and you accept it at signup.
- To bill you through Dodo Payments, and to keep billing records that tax law requires.
- To send service emails: password reset, sync failures, failed payments, plan changes, and similar messages.
- To protect the service: rate limits, abuse checks, and security logs. This is our legitimate interest.
- To improve ReachArena: counts of how members found us and which browsers they use.
We do not sell your data, and we do not use it for advertising.
3. Who receives it
| Company | Why |
|---|---|
| Cloudflare | Hosting, database, and email sending |
| Dodo Payments | Payments, taxes, and invoices (merchant of record) |
| OpenAI | Writing Content Engine posts and AI comments. We send the idea or the post text and the commenter's name and headline. We do not send your cookies or email. |
| Google sign-in, only if you use it | |
| The actions that you allow ReachArena to do with your session | |
| A post detection provider (for example Apify or Mindcase), if we use one | Finding your new public posts. We send your public profile link only. |
Other members see the likes and comments that come from your LinkedIn account on LinkedIn, as for any LinkedIn activity. We also share data when the law requires it.
4. Security
- LinkedIn cookies are encrypted with AES-256-GCM before we store them. Only the background workers can decrypt them. The website never sends them back to a browser.
- We never write cookies, passwords, or tokens to logs.
- Passwords are stored as bcrypt hashes. Sessions use secure, HTTP-only cookies.
- Extension tokens are stored as hashes and you can revoke them in Settings.
5. How long we keep it
- Account and post data: while your account exists.
- LinkedIn cookies: until you disconnect LinkedIn or delete your account, then deleted at once.
- Website sessions: 7 days. Password reset links: 30 minutes. Pairing codes: 10 minutes.
- Billing records: as long as tax law requires, without your name or email after you delete your account.
- Logs: 30 days.
6. Your rights
Depending on where you live, you can ask to see, correct, export, or delete your data, or object to some uses. You can delete your account and your LinkedIn session yourself in Settings. For other requests, email support@reacharena.com. We answer within 30 days. You can also complain to the data protection authority in your country.
7. Cookies on our website
The website uses only necessary cookies: session_token keeps you signed in, and google_oauth_state protects Google sign-in for 10 minutes. We do not use advertising or tracking cookies.
8. International transfers
Our providers can process data in countries other than yours, including the United States. We use providers that protect data with standard contract terms or similar safeguards.
9. Children
ReachArena is not for people under 18. We do not knowingly collect data from children.
10. Changes
We can update this policy. We show the date of the newest version at the top, and we email you about important changes.
11. Contact
ReachArena · support@reacharena.com