Information we collect
We collect only the information required to run TOPkit and keep your workspace in sync:
- Account details. When you sign up we use Supabase Auth and related profile records to store your email, password hash, full name, username, job position, and optional eTermin identifiers so we can authenticate you and provide profile-dependent features.
- Extension content. Items you create or modify with TOPkit, including personal texts, formatting snippets, shared Operator Group texts, Operator Group records, Operator Group membership data, automation metadata, and uploaded automation JSON files, are encrypted in transit and stored through our service infrastructure to make them available across devices and collaborators.
- Operational diagnostics. Website, API, database, and provider environments may create limited request, status, timestamp, and error logs to operate and secure the service. The code in this repository does not directly integrate a behavioural-analytics SDK.
- Local extension state. We store limited extension state in browser storage, such as session details, cached text libraries, user metadata, theme preferences, game state, and whether injected Quick Assist is visible. Incident Copilot also keeps the latest completed analysis, including the incident number and completion timestamp, so you can resume the most recent workflow.
- TOPdesk page context you submit. Features such as incident analysis and TOPdesk helpers may read the active TOPdesk page after you start the workflow. This can include incident numbers, request text, images embedded in the customer Request, action entries, customer contact details visible on the page, and other visible page text needed to produce the requested result. Request images are fetched in the authenticated page context and transmitted for the requested AI workflow. Backend and provider retention depends on the deployed service configuration described below.
- TOPbot conversations. When you chat with TOPbot on the website, your messages and the earlier turns of that conversation are sent through the TOPkit website to the TOPbot Supabase Edge Function and Ebbot to produce an answer. Completed conversations, their titles and compact source references are saved in your browser’s storage for this website, not on TOPkit’s servers.
- Feedback you send. When you submit feedback from TOPkit, we collect the title, message, and your account email as the reply-to address so we can review and respond.
- Product activity. We store the release notes you have seen or confirmed and, when you submit a game score, your user ID, username, game, score, and achievement time. Leaderboard usernames and scores are visible to other signed-in TOPkit users through the leaderboard.
- One-time password links. When you create a link, the generated or user-supplied password, a random link token, and creation, expiry, and consumption information are sent to the TOPkit website and stored through Supabase. The link expires after seven days and can reveal the password once. Anyone who receives the link can attempt that reveal.
- Booking-link details. When you generate an eTermin link, TOPkit places the incident number, brief description, customer name, email, company, selected service, and your eTermin calendar ID in the booking URL. You can review these details before generating the link. TOPkit saves the generated URL as an internal action on the same incident, invisible to the caller, using your TOPdesk operator session.
- Website session cookie. Signing in to the website sets a necessary HttpOnly, SameSite=Lax cookie named
topkit-session(Secure in production) for up to 30 days. Password recovery uses the same cookie and clears it after a successful password update. Signing out clears it. A preference cookie is not used: your theme and TOPbot personality choices are kept in this site’s local storage. - Signing in from the extension. If you choose “Continue as …”, the extension passes its current access token to this website once. The website verifies it with Supabase Auth and creates a separate website session for the same account. The extension’s refresh token is never shared, and the website does not store the extension’s token.
- Bulk update workspaces. Your TOPdesk environment, operator username, application password, query, matching changes or incidents and run results remain in browser tab memory. Requests send credentials directly to the TOPdesk environment you enter over HTTPS. Updates run only after you review and confirm the selected records and patch. TOPkit does not persist this information or send it to its APIs or Supabase. Downloading a run log saves the query, update plan and results on your device. IncidentPUT CSV imports are read locally in your browser. Cleanup previews read the selected incident data directly from TOPdesk; confirmed cleanup operations may replace or delete selected content in that environment.
The extension also requests the following permissions, as declared in its manifest:
- activeTab / tabs / scripting: Allows TOPkit to read or update the page you are working on after you launch a workflow.
- storage: Stores limited local extension state such as session data, cached text libraries, user metadata, display preferences, and injected Quick Assist visibility.
- contextMenus: Adds right-click shortcuts that trigger TOPkit tools.
- webNavigation: Keeps extension state aligned as you move between pages and helps TOPkit reapply page-level tooling when navigation changes.
- clipboardRead / clipboardWrite: Lets you copy or paste data through TOPkit at your request.
- notifications: Sends you extension alerts when tasks finish or require attention.
- declarativeNetRequestWithHostAccess / webRequest / webRequestBlocking: Changes the Referer header only for YouTube embed frames initiated by TOPkit so tutorial and help videos can load consistently. Chrome uses a declarative rule; Firefox uses the equivalent blocking web-request listener.
- host permissions: TOPkit currently requests host access broadly so its content script and injected support tools can run where you invoke them. This permission is not used to collect unrelated browsing history, and page interaction only occurs when a TOPkit feature is activated or needs to restore its extension UI.
How we use data
We process the information above to provide and secure TOPkit, authenticate accounts, synchronize content, operate collaboration and leaderboard features, respond to feedback, create booking and one-time-password links, diagnose failures, and improve service reliability. Clipboard, scripting, notification actions, Quick Assist interactions, and chatbot popup flows run after you initiate them or when the extension restores a UI state you previously enabled.
Incident analysis sends the TOPdesk page context described above, including any images embedded in the submitted customer Request, to TOPkit backend services and its configured AI processing provider so an AI-assisted classification, priority, summary, categorization, or follow-up answer can be returned. Automation search sends your search query to TOPkit backend services, and automation uploads store the JSON and descriptive metadata you submit. Feedback is sent to TOPkit’s web API and Resend for email delivery to the TOPkit support inbox.
When you open TOPbot, the extension loads the Ebbot client from OVH-hosted assets and the interaction is processed to provide the chat. Tutorial cards and help dialogs may request thumbnails or embedded video content from YouTube. Opening an eTermin URL sends the booking-link fields described above to eTermin. These providers may receive ordinary connection information such as your IP address and browser headers when their content or service is requested.
We do not collect or store your browsing history. TOPkit registers a content script broadly so it can keep editable targets, injected assistance, and extension overlays available where supported, but that does not mean we ingest the contents of every page you visit. On topkit.dev itself, the content script only answers the website’s requests described under “Signing in from the extension”.
Retention
Browser storage keeps the latest Incident Copilot analysis until it is replaced, you explicitly sign out through TOPkit, uninstall the extension, or clear extension storage. A session that expires or is revoked without an explicit TOPkit sign-out may leave those latest local records on the device. Website TOPbot conversations stay in this site’s browser storage until you delete them in the sidebar or clear site data.
Account and workspace content is retained while the account or shared workspace needs it, unless an item is deleted or an account-deletion request is completed. Feedback is retained in the support mailbox and Resend delivery systems as needed to handle and document the request. Automation search does not store new raw queries in its search log, and model response storage is disabled in TOPkit’s requests. Short-lived abuse-prevention counters use authenticated user IDs or keyed IP digests. Other operational logs follow the active hosting and service-provider retention configuration.
One-time-password links cannot reveal a password after the first successful reveal or the seven-day expiry. After that point the link no longer shows the password, but the stored password and the link metadata (used to tell consumed links from expired ones) may remain in the TOPkit database until they are removed under its retention configuration. Backup and provider retention may delay final physical removal.
Your control
You can remove individual items inside the extension, including personal texts, team content you control, and uploaded automations where the interface allows it. You can also sign out to clear the active session on that browser. Uninstalling the extension clears local browser caches, but it does not delete server-side account, team, or automation records.
To delete your TOPkit account and permanently remove the data stored on our servers, email support@topkit.dev. We currently process account deletions manually and will identify account-owned records, shared records that must be reassigned or retained, storage objects, and provider-held records that are within our control. We will explain any information that must be retained or cannot be removed immediately.
You may also ask to access, correct, or export your personal information. Where applicable law provides additional rights, you may ask us to restrict or object to processing or lodge a complaint with your local data-protection authority. We may need to verify your identity before acting on a request.
Security
TOPkit uses encrypted HTTPS connections for production and remote-service requests; local development may use loopback HTTP. Privileged Supabase credentials stay in server-side environments, and extension sessions use browser extension storage. Website sessions use HttpOnly cookies that page scripts cannot read. No internet-connected system can be guaranteed completely secure.
Extension logic runs within browser extension boundaries. Broad host access and Firefox’s store-declared website/browsing activity categories reflect that content scripts can run on supported pages and observe page interaction needed for TOPkit tools. The current code does not transmit a general browsing-history feed, but it can read and transmit the active TOPdesk context when you invoke the features described above.
Changes to this policy
We may update this privacy policy from time to time. Significant changes will be reflected here, along with a new last-updated date.
Questions or concerns
TOPkit is responsible for the processing described in this policy. If you need clarification, current processor details, or want to exercise a privacy right, email support@topkit.dev and we’ll help review the relevant handling or deletion path.