01Who you are dealing with
SentryReply is a creator product studio run by Rali, its founder.
Every question about this page goes to [email protected]. One person reads everything. There is no support queue and no data-protection department to route you through.
02What this site collects
| What | Answer |
|---|---|
| Creator applications, when you send one | yes |
| First-party visit measurement, without cookies | yes |
| Product analytics with masked session recordings (PostHog, EU hosting) | yes, with consent where the law requires it |
| Meta pixel, to measure and improve our own ads | yes, with consent where the law requires it |
| Selling data to anyone | never |
| Reading anyone's social accounts without being asked | never |
03Creator applications
When you send the form on /apply, this is exactly what is stored: your name, your email address, the URL of your creator profile, your primary platform, your niche, the audience size range you picked, your preferred contact method, the optional note, the consent sentence you ticked and the submission time, the page and selected service, recognized first-touch source and ad labels if available, your browser's user agent string, and the country derived from your connection. A contact destination and a calculator scenario are included in the note only when you supply or choose to include them on the form.
Purpose. To review your application and reply to you. Nothing else is done with it. It is not added to any mailing list.
Where it goes. A Pages Function on Cloudflare receives the form and forwards it to our own n8n instance, on a server we rent from Hetzner in Germany, where it is written to a private table. Cloudflare keeps per-IP and global counters to limit requests. These counters hold no form content and expire within about an hour. They reduce abuse; they do not guarantee that automated submissions are blocked.
Retention. Deleted on request, at any time. If no partnership follows, the application is deleted within 12 months.
No automated decision. A person reads every application and decides. No score, no filter, no model decides for us.
Signing an agreement
When you sign a creator agreement, we keep your typed name, email, date and time, IP address, browser, country, and document fingerprint, together with the agreement and your confirmations that you consent to electronic signing, intend to sign, and are authorised to sign for the Creator named in the agreement. When a French version is offered for Quebec, we also keep both versions and their fingerprints, your choice of binding language, and a record that the French version was offered first. These are evidence of your signature, kept for as long as the agreement and its legal claims last. They pass through Cloudflare to our private n8n table at Hetzner in Germany. A copy of the signed agreement is emailed to you.
04Visit measurement
Our first-party measurement script helps us understand which ads bring people to the studio, which pages help, and where people stop or encounter a problem. It sends batches to our own n8n server at Hetzner in Germany, after a mouse, touch or keyboard interaction. A gesture is a measurement filter, not consent.
What it sends. Page paths without queries, the landing page, a random tab session identifier and page-view identifiers, event times, active seconds, maximum scroll depth, sections reached, fixed labels for clicks and service choices, and a count of JavaScript errors. It includes a broad viewport category (mobile, tablet or desktop), time zone, browser language, and the first referring domain, never the full referring URL. It retains recognized first-touch source, medium, campaign and ad labels for navigation within the tab. Other campaign labels are grouped as "other".
Interactions. We measure menu use, niche page reading, demo video playback milestones, outbound links by destination domain, and clicks to Calendly. A Calendly click does not tell us whether you booked. We also record your answer to the cookie banner (accepted, declined or not shown) with a two-letter country code, so we can check that analytics and the pixel only load when they should. On the application form we record field names completed or showing an error, fixed error codes, the selected service, whether the application consent box is checked, submission outcomes and the last field touched before leaving an unfinished form. The checkbox covers the application; it is not consent to advertising measurement.
What is excluded. Analytics does not receive names, email addresses, profile links, Instagram handles, typed form answers, exact calculator assumptions, calculated earnings, error messages or stack traces. This first-party script sets no cookies and sends nothing to Meta. Session storage is scoped to the tab; browsers may restore it when restoring a tab or copy it when duplicating one.
Server processing and retention. Requests necessarily reach our server with an IP address. Event rows store neither the IP address, nor a hash of it, nor the full browser user agent. Session identifiers are pseudonymous, not a guarantee of anonymity. Event rows are deleted within 12 months of collection. Hosting and security logs are separate from the event table.
Product analytics (PostHog). To understand how visitors use the site, we use PostHog, hosted in the European Union. It records page views, clicks, scrolling and anonymous session recordings of the page so we can see where the experience is unclear. Every form field is masked in recordings: what you type is never captured. PostHog sets a first-party cookie or local storage identifier, receives your IP address through our own domain, and the project is configured to drop it. Recordings are kept for 30 days.
Meta pixel. To measure which of our Facebook and Instagram ads bring visitors and applications, and to show our ads again to people who visited, we use the Meta pixel. It sends Meta the page visited, clicks on the apply and call buttons, and the fact that an application was sent, with the chosen service. It never sends your name, email or form answers. Meta may link this to your Meta account under Meta's privacy policy and uses cookies to do so.
Consent. Visitors from the United Kingdom, the European Union, the EEA and Switzerland see a choice first: PostHog and the Meta pixel only load after "Accept". Elsewhere they load by default. Anyone can decline them on this browser or make the choice again. Do Not Track and Global Privacy Control turn them off as well.
How to opt out. We respect Do Not Track and Global Privacy Control when enabled in your browser. You can also turn off measurement for this tab. That choice uses session storage and lasts for this tab's session. If your browser blocks session storage, use its privacy signals or block requests to n8n.sentryreply.com for an opt-out across pages. The site continues to work. You can contact [email protected] about records you would like removed.
05Product pages and Whop
Product pages on this site may link to a checkout hosted by Whop. Payment happens there, not here: Whop handles your card, your billing details and your account under its own privacy policy, at whop.com/privacy.
From Whop we receive the order data needed to deliver and support the product: what was bought, when, and the email address to deliver it to and answer you from. We do not receive card numbers.
06Earnings calculator
The calculator on /calculator computes its scenarios in your browser. Measurement records which assumption control you change and a broad range or fixed choice, not the exact number or calculated result. It records when a lookup is requested, whether it succeeds, is unavailable for that account type, or fails, and whether you view results or click through to apply. The handle is never sent to the analytics collector.
If you ask for an Instagram lookup, your handle is sent to Meta's official Instagram API (Business Discovery). Only the public result (username, display name and follower count) is cached on our server for up to 24 hours, or 6 hours for a failed lookup, to limit requests. Per-IP rate-limit counters expire within about an hour. Nothing from the lookup is linked to the visitor. Only Creator and Business accounts can be read this way; otherwise you can enter your followers yourself. A handle entered on the home page is passed to the calculator in its URL.
Calculator amounts are not included in application links. If you choose to include a scenario, its assumptions and modeled amount are placed in this tab's session storage when you click an application link. The form reads and removes that stored copy; unused copies are ignored after an hour. You can review, edit, exclude or remove the visible scenario before sending it as part of your application note. An older link containing an amount displays it for review with inclusion off by default, and removes it from the current URL. These flows are separate from analytics.
07Video and fonts
Everything on this site is served from sentryreply.com. Fonts are self-hosted. Videos are plain files on our own domain, with no embedded player from YouTube, Vimeo or anyone else. No third-party font or video host ever sees your visit.
08Your rights
You can ask for access to what is held about you, have it corrected, have it deleted, or receive a copy in a portable format. One email to [email protected] is enough. There is no form and no fee, and we answer within 30 days, in practice much sooner.
Residents of the European Union, the United Kingdom and California may have additional rights under their local law. We honour all of them regardless of where you live.
09Changes
This policy is dated. The date at the top is the date of record, and updates are noted alongside it. In effect 9 September 2026. Updated 3 October 2026.