Privacy Policy

If you create or link an OnTopOfIt account, we collect and store:

• Your email address;
• A hashed record of any sign-in code we send you;
• A hashed record of the resulting session token;
• An identifier for each device linked to your account;
• The display name you have assigned to each linked device; and
• Timestamps indicating when a device was linked and when it was last seen online.

An account is required for paid plans, the mobile companion application, and cross-device features.

The plaintext sign-in code exists only transiently, including in the email sent to you and during a short server-side processing period, as described in Section 6.

An account may have up to two linked devices at a time.

Payments are processed by Stripe, Inc.

OnTopOfIt does not receive or store your payment-card number or other raw payment credentials. Stripe processes those payment credentials directly.

In connection with your OnTopOfIt account, we receive and store:

• A Stripe customer identifier;
• Your subscription status, such as active, canceled, or past due;
• Your current billing period;
• Whether you hold a One-Time Unlock, independent of any subscription; and
• Basic invoice metadata, such as amount, date, and plan, needed to reconcile your account and subscription status.

Your Anthropic, OpenAI, and/or OpenRouter Admin or Provisioning API key is stored only on your device in encrypted operating-system credential storage.

Requests to your AI provider’s usage, cost, or key-management APIs are made directly from your device and are not routed through or logged by servers operated by OnTopOfIt.

Your detailed usage history, including individual model calls, token counts, and timestamps, is stored only in a local database on your device and is not transmitted to OnTopOfIt.

Accordingly, OnTopOfIt does not receive or store your AI provider API key or your detailed AI usage history.

If you are a Premium subscriber, the desktop application sends certain information derived from your local usage data to our cloud infrastructure on a recurring basis.

This information is used to provide features including off-device alerts and Remote Cutoff.

The information may include:

The information described in this section is limited to the information necessary to provide the applicable Premium features. The underlying API key and detailed usage history described in Section 2.3 are not transmitted to OnTopOfIt.

A tracked API key’s display name is supplied by you or by a teammate through Anthropic’s, OpenAI’s, or OpenRouter’s own dashboard. It is not generated by OnTopOfIt.

Because a key display name may contain a client name, project name, or other identifying text, we do not assume that such names are non-sensitive.

If you are a Premium subscriber, a tracked key’s display name may be displayed on your linked mobile device and stored on our servers as described in Section 2.4.

We recommend that you avoid including sensitive or unnecessary personal information in API key names.

Our cloud infrastructure providers may generate standard technical request logs that include information such as your IP address and basic request metadata at the network level.

As of the date of this Privacy Policy, the OnTopOfIt desktop and mobile applications do not use third-party analytics, advertising, or crash-reporting SDKs.

Role: Account database, cloud functions, and push notifications.

Information processed: Account, subscription, device, and Premium-derived information described in Sections 2.1, 2.2, and 2.4.

Our cloud infrastructure is hosted in the United States, including the Google Cloud us-central1 region.

Role: Payment processing.

Information processed: Payment credentials are handled directly by Stripe. OnTopOfIt receives only the account and billing metadata described in Section 2.2.

Role: Transactional email delivery, including delivery of sign-in codes.

Information processed: Your email address and the sign-in code required for authentication during the applicable processing period.

The sign-in code itself is single-use, permitted a maximum of five incorrect attempts, and expires 10 minutes after it is sent. It is used only for the authentication process and is not retained as a permanent account record.

The underlying email delivery record (used to send the code to you) is automatically deleted after approximately one week, separately from the code’s own much shorter validity period above.

A resolved Remote Cutoff command record, including a command that was executed, failed, or expired, is automatically deleted after 30 days.

A command that remains pending is retained until it is resolved or superseded.

Account records and linked-device information are retained while your account exists.

The latest spend and risk summary for each provider is also retained while your account exists.

You may delete this information by deleting your account through the self-service account-management functionality described in Section 8, or by contacting us as described in Section 9.

Certain information may need to be retained for longer where reasonably necessary for purposes such as security, fraud prevention, tax and accounting requirements, resolving disputes, enforcing our agreements, or complying with legal obligations.

If a linked device is lost, sold, replaced, or is otherwise no longer under your control, you may remove its access through the device-management functionality provided by the Service.

The desktop application’s Settings allow you to view linked devices and remove a device following the applicable confirmation process. The mobile companion application also provides device-management functionality.

When a device is removed, it can no longer authenticate to the account, receive applicable alerts, or be reached for Remote Cutoff through the account.

A removed device must complete the sign-in process again to reconnect.

You may permanently delete your OnTopOfIt account through the account-management functionality in the desktop application’s Settings.

Deleting your account:

• Cancels any active Premium subscription;
• Removes access for linked devices; and
• Initiates deletion of your account data from our servers, subject to the retention requirements described in Section 6.

If you cannot access either of your linked devices, contact us. We may ask you to verify your identity before assisting with account or device management.