Privacy Policy · SohamReclaim

1. Who we are

SohamReclaim is a product of Soham Value Creation (India). The service helps you audit and clean up your social-media presence on platforms we support (currently X and Reddit). The companion browser extension, SohamReclaim — Execute, runs only in your browser and deletes posts you already marked for deletion.

Questions, general mail, or data requests: support@sohamreclaim.com.

2. What this policy covers

The website at sohamreclaim.com (landing, waitlist, scan flow, report, install guide).
The API at api.sohamreclaim.com (scan creation, archive processing, exports, payments webhook).
The SohamReclaim — Execute Chrome extension from the Chrome Web Store.

3. Data we collect

3.1 Waitlist and marketing email

If you join the waitlist, we store the email address you submit in our email provider (Resend), under a dedicated SohamReclaim audience. We use it only to notify you about product availability and related updates. You can unsubscribe via the link in any email, or by writing to support.

3.2 Scan email and report delivery

When you start a scan you provide an email address. We use it to:

authenticate you to your scan (email + scan id, no account);
email you when the report is ready;
match payment and export requests to the right scan.

We do not require a password or user account in V1. Anyone with both your scan id and that email can open the report until the scan expires.

3.3 Platform archive

You upload a platform archive (for example an X or Reddit data export). Where supported, extraction of the post corpus may run in your browser so only the post text and metadata needed for clustering are sent to our API. We store the working set in a private Google Cloud Storage bucket with encryption at rest (AES-256, provider-managed keys) and a short retention window (see §5).

We parse posts you authored (or comments, depending on platform). We discard pure retweets / pure reposts where the archive marks them as such. We do not request or store your platform password.

3.4 AI processing

Post text is sent to a large language model and embedding model hosted on Google Cloud Vertex AI (Gemini Flash Lite and text-embedding models) solely to cluster posts into themes and score them against the mode you chose. Contractual and product controls: your submissions are not used to train Google foundation models for other customers. We do not fine-tune a public model on your archive.

3.5 Decisions and exports

Cluster-level and per-post decisions (keep / review / delete) are stored with the scan so you can reopen the report and export CSV or PDF. Exports are available only to callers who supply the correct scan id and email.

3.6 Payments

Card and UPI checkout is handled by Razorpay. We receive payment status, amount, currency, and a payment id via webhook so we can unlock your scan. We do not store full card numbers. Razorpay’s own privacy policy governs the payment form. To choose INR or USD we look up the country of the connection address at the moment the scan is created. We store the currency on the scan, not the address.

3.7 Technical logs

Cloud Run and related infrastructure may retain request logs (timestamp, path, status, approximate region) for operations and abuse prevention. We do not run third-party product analytics (no Google Analytics, Meta Pixel, LinkedIn Insight, or Plausible) on sohamreclaim.com.

4. Browser extension (SohamReclaim — Execute)

The extension exists only to execute decisions you already made in a SohamReclaim report, inside your own signed-in browser session on X and/or Reddit.

4.1 Data the extension reads

Scan id and short-lived export key from the extension link you paste into the popup (stored in chrome.storage.local on your device; the key expires after 6 hours).
Per-post delete decisions via a single HTTPS GET to https://api.sohamreclaim.com/api/scans/:id/export.csv?key=— your own export, the same CSV the report offers.
On X: the page’s ct0 cookie value is read at delete time as a CSRF token and is never written to extension storage or sent to SohamReclaim.
On Reddit: the session’s modhash (from Reddit’s standard client APIs) is used the same way — session-local only.

4.2 What the extension sends where

To SohamReclaim: only the CSV (or health) request above. We do not receive delete success/failure telemetry, counts, or post bodies from the extension run.
To X / Reddit: per-post delete requests using the browser’s normal authenticated session (credentials: 'include'). Our servers are not in the delete path.

4.3 Local storage

Progress (plan, index, pause state, recent log) lives in chrome.storage.local on your machine. Reset in the popup clears it. We never receive a copy of that storage.

4.4 Permissions (why they exist)

storage — plan and progress across popup close.
alarms — pace long runs after MV3 service-worker idle.
tabs / scripting — find or open an x.com / reddit.com tab and inject the delete content script, including tabs open before install.
Host access to api.sohamreclaim.com, x.com / twitter.com, and Reddit origins — only for the CSV fetch and platform delete calls described above.

5. Retention and deletion

Scans, archives, reports, decisions: retained for 7 days from creation (or shorter if you ask us to purge sooner). A daily purge job removes expired rows and associated objects from object storage.
Waitlist contacts: until you unsubscribe or request deletion.
Payment records: retained as required for accounting, fraud, and tax (payment id, amount, scan linkage) — not the archive content.
Extension local storage: controlled only by you (Reset / uninstall).

6. Sharing and processors

We do not sell personal data. We use infrastructure processors:

Google Cloud — Cloud Run, Cloud SQL, GCS, Vertex AI (US us-central1 unless noted).
Resend — transactional and waitlist email.
Razorpay — payment processing.
Cloudflare — DNS and email routing for sohamreclaim.com (inbound mail to our support inbox).

Processors act on our instructions. Platform operators (X, Reddit) process delete requests you authorize through the extension under their own terms.

7. Security measures

TLS in transit for website, API, and extension HTTPS calls.
Encryption at rest for stored archives and database.
Scan access gated by email match (plus payment / bypass for creation).
No third-party marketing pixels or session-replay tools on the marketing site.
Extension never handles platform passwords; it uses the session you already established in the browser.

No system is perfectly secure. If you believe there has been a breach involving your data, email support@sohamreclaim.com immediately.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export personal data we hold, or to object to certain processing. For SohamReclaim:

Most scan data self-expires in 7 days; email support for an earlier purge.
Waitlist removal: unsubscribe link or email support with the address to remove.
Payment disputes: contact support and/or Razorpay as appropriate.

We will respond within a reasonable period (and within any statutory deadline that applies to us).

9. Children

SohamReclaim is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have, contact support and we will delete it.

10. International transfers

Infrastructure is primarily in the United States (Google Cloud us-central1). If you access the service from elsewhere, your data may be processed in the US and other locations where our processors operate. By using the service you understand that transfer.

11. Changes

We may update this policy as the product changes. Material changes will be reflected by updating the “Last updated” date above and, when appropriate, a notice on the site or by email. Continued use after an update constitutes acceptance of the revised policy for new processing.

12. Contact

Soham Value Creation · SohamReclaim
Privacy, support, and general mail: support@sohamreclaim.com