Reddit Integration Privacy Policy

1. Introduction & Integration Overview

ChatCoat, operated by Sami Ullah, provides a SaaS multi-platform social media campaign automation, scheduling, and community engagement platform.

This Reddit Integration Privacy Policy explains how ChatCoat plans and intends to handle, process, and protect Reddit user information once commercial API access is approved by Reddit, Inc. and the integration becomes available. This document supplements our general Privacy Policy and Reddit Terms of Service.

3. Planned Information Processing (When Available)

Because Reddit integration is currently pending API approval, ChatCoat does not currently process live Reddit data. Once the integration is officially approved and enabled, ChatCoat will process only the minimal information strictly required to deliver user-authorized features:

Authorized Messaging Data: ChatCoat will process direct messaging data only if, and strictly to the extent, permitted by Reddit's official API and explicitly authorized by the user for customer care or campaign workflows. ChatCoat does not access private browsing history, passwords, or personal off-platform activities.

4. Purpose of Processing Reddit Data

When made available, Reddit-related data will be processed solely for legitimate business purposes configured by the account owner:

• Account Identification: Establishing and maintaining your authorized connection and displaying your connected Reddit profile within your ChatCoat workspace.
• Publishing & Content Management: Transmitting scheduled posts, media attachments, and text updates to authorized subreddits or user profiles at your direction.
• Comment & Interaction Workflows: Retrieving comments and replies on your campaign submissions to display engagement metrics and execute user-defined response rules.
• Post Lifecycle Management: Managing post status and executing user-configured post management actions as permitted by Reddit API guidelines.
• Operational Reliability: Maintaining diagnostic logs to verify publication delivery, troubleshoot errors, and maintain platform security.

5. Data Security & OAuth Token Encryption

ChatCoat applies enterprise-grade technical and organizational safeguards to ensure all credentials and platform data remain secure:

• Authenticated Encryption at Rest: All OAuth access tokens, refresh tokens, and connection secrets are encrypted at rest in our secure database infrastructure using AES-256 authenticated encryption.
• Encryption in Transit: All communication between client browsers, ChatCoat servers, and Reddit API endpoints is encrypted using Transport Layer Security (TLS 1.3 / HTTPS).
• No Plaintext Token Logging: OAuth tokens and secret credentials are never printed in application logs or exposed to unauthorized parties.
• Multi-Tenant Isolation: Account records, connection tokens, and campaign data are strictly partitioned by organization ID to prevent cross-account exposure.

7. Granular Permissions & Least Privilege

In accordance with the principle of least privilege, ChatCoat will only request and use the specific Reddit API scopes and permissions necessary to perform the functionality requested by the user:

• ChatCoat does not request broad or unnecessary account permissions.
• Users are presented with an itemized permission screen during Reddit OAuth authorization to review the requested scopes before granting access.
• Permissions can be adjusted or revoked by the user at any time.

8. Disconnection, Data Retention & User Deletion Rights

You retain full ownership and control over your Reddit account connection and stored records:

• In-App Disconnection: When the integration is available, you can disconnect your Reddit account at any time with a single click from the ChatCoat Integrations page. Disconnecting immediately removes active connection records and purges all stored OAuth access and refresh tokens from our database.
• Direct Revocation via Reddit: You can independently revoke ChatCoat's authorization at any moment through your Reddit account preferences under authorized applications (https://www.reddit.com/prefs/apps).
• Complete Data Deletion: You have the right to request permanent deletion of your account and all associated platform records at any time. You can submit a deletion request via our Data Deletion Instructions Page or by emailing our compliance team at support@chatcoat.com. All associated records will be permanently erased within 30 days.

9. Updates to This Privacy Policy

We may update this Reddit Privacy Policy as necessary to reflect changes in our services, Reddit API terms, or legal requirements. Upon official API approval or significant capability updates, we will revise the effective date and status notice at the top of this page.