Privacy Policy

1. Account data

When you sign up we collect your email address. You sign in with a code or link we email you, or with your Google account. If you use Google, Google shares your name, email address, and profile picture with our sign-in provider (Supabase); Topped’s own records keep only your email. Our sign-in provider also records the IP address and browser of each sign-in to keep your account secure.

We email you about your account: sign-in codes, a notice when a connected account needs reconnecting or a scheduled post could not go out, and replies to your support messages. Invoices come from Polar (section 10). We also save your browser’s time zone, so scheduled posts go out at the times you picked.

When you send a message from Support, we email it to our support inbox together with your account email, your account’s ID, the page you were on, and your browser type, so we can reply. Support messages are not stored in our database; they stay in our support inbox for as long as we need them to help you.

2. Connected social accounts

If you connect a TikTok, Instagram, or YouTube account, we use each platform’s official OAuth flow. We never ask for or store your platform password.

The access tokens we receive are used only to:

• publish the posts you approve - or that an agent you connected approves for you (section 9) - to that account,
• read the counts and links of posts published through Topped, so your Scoreboard can show what each platform reported,
• on TikTok, read your account’s posting options (such as who can see your posts and how long a video can be) when you post, so Topped can show you TikTok’s own choices - we do not store them - and
• keep the token valid, refresh the account’s name and avatar, and revoke access when you disconnect.

Access tokens are stored encrypted at rest and are never written to logs. You can revoke access at any time by disconnecting the account inside Topped, or by revoking Topped’s access directly from the platform’s own app settings (TikTok, Instagram/Meta, or Google). Disconnecting stops all future publishing and metric reads for that account.

For each account you connect, this is everything we access, collect, and store:

• Profile identifiers - the account or channel ID, the handle or name shown on the account, and its avatar image - so Topped can show you which account a post is going to. We copy the avatar into our private storage because provider image links expire, and refresh this profile data about every 25 days while the account remains connected.
• OAuth tokens - the access and refresh tokens the platform issues (stored encrypted; see “How we protect your data” below).
• Published-post records - the platform’s ID and status for each post you publish through Topped.
• Engagement counts - view, like, comment, and share counts for posts published through Topped (YouTube reports no shares), used to show how a post performed on your Scoreboard.

We access nothing else from a connected account: no private messages, no follower or subscriber lists or counts, no contacts, no email addresses from the platform, and no posts you published outside Topped.

When you disconnect an account, Topped immediately stops using it, removes its stored profile information and engagement counts, and marks its stored avatar image for deletion. Your record of the posts you published stays in Topped, without the platform’s post ID. An encrypted OAuth token and the provider account identifiers needed to address the revocation request may be retained briefly only for that purpose; they are then deleted, with a maximum retry window of six days.

Agent chats stay, but what the Agent looked up in them, such as an account’s handle, a post’s link, and its counts, is cut from a chat once it is 30 days old, and from all your chats within an hour of any of your accounts being disconnected or removed. What you and the Agent wrote stays as written, even where it repeats a name or a number. Until a lookup is cut, continuing that chat sends it to OpenAI again.

If you remove Topped in Instagram’s or Facebook’s settings, Meta tells us, and we erase that account’s stored profile, tokens, and counts. We keep only the ID Instagram gives Topped for that account, so we can match a later deletion request from Meta. When Meta asks us to delete your data, we erase that ID and anything left within a day; if nothing matches yet, we keep checking for up to 7 days. After that, our record of the request keeps only the confirmation code Meta gave you, unless we cannot tell whether anything is left, in which case we check by hand first. The posts you published stay in Topped.

If you remove Topped in TikTok’s or Google’s settings instead, the platform doesn’t tell us. We find out the next time Topped uses or checks the account. From then on Topped can’t publish to it, and we email you to reconnect. If you don’t reconnect within 14 days, we delete what we stored for that account, as if you had disconnected it, and posts you scheduled to it go back to your Library. For YouTube we may delete it sooner, so that it is gone no later than 30 days after you revoked access. The same applies to an account that stops working for any other reason, such as a changed password. The posts you published stay in Topped.

YouTube. Topped uses YouTube API Services. For a connected YouTube account, the list above is exactly the YouTube API Data we access, collect, and store: your channel ID, handle or channel name, and avatar; the OAuth tokens Google issues; the video IDs of uploads made through Topped; and the view, like, and comment counts the YouTube Data API reports for them. If you connect a YouTube account you also agree to the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy. Topped’s use, storage, and sharing of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements: we use YouTube data only to publish the videos you approve, to show you how they performed, and to let the Agent help you: when it looks up your accounts, posts, or results, your channel name and your videos’ links, publish dates, and counts go to OpenAI as part of that chat, and again each time you continue it. An agent you connect yourself can read the same data on your behalf (section 9). We never use YouTube data for advertising, never sell it, and never use it to train AI models. You can revoke Topped’s access at any time in your Google security settings.

3. How we protect your data

The most sensitive data we hold is the OAuth access and refresh tokens for your connected social accounts, and we protect all of your data with the following mechanisms:

• Encryption in transit. All traffic between your browser and Topped, and between Topped and every platform API or service provider, is encrypted with TLS (HTTPS). Topped serves no unencrypted endpoints.
• Encryption at rest. OAuth tokens are encrypted at the application layer with AES-256-GCM (a unique random initialization vector per value) before they are written to the database, which itself sits on provider-managed disk encryption. The encryption key lives only in the deployment environment’s secret store - never in source code or the repository.
• Access controls. Tokens are decrypted only on our servers, when Topped has to call the platform for you: to publish, to read your counts and post links (daily, and when you refresh), to show TikTok’s posting options, to refresh the account’s profile, to keep the token valid, and to revoke it when you disconnect or delete your account. They are never sent to the browser, never written to logs or error reports, and no person views them in normal operation. Production access is restricted to Topped’s operator. Keys you create for your own agents are stored only as a one-way hash.
• Data minimization. We request only the platform permissions the features in this policy need, and use the data we receive only for those features.
• Revocation and deletion. Disconnecting an account inside Topped immediately makes it unusable and removes its stored profile and counts. Tokens are deleted after the provider revocation attempt (or the bounded retry period described above); you can also revoke access from the platform’s own settings at any time. Full account deletion and export are described in section 14.
• Incident response. If we become aware of a security breach affecting your personal data, we will notify affected users by email without undue delay and report to authorities where required by law.

4. How we use, process, and share your information

We use the information described in this policy only to provide Topped:

• publishing the posts you approve, or that an agent you connected approves, to the accounts you connected,
• showing how your posts performed on your Scoreboard,
• writing your post suggestions from your Product Profile, the post templates our team curates, and public posts from other creators,
• answering you in the Agent tab and in agents you connect,
• operating your account - sign-in, your plan, billing, support, security, and fixing errors, and
• understanding how Topped is used so we can improve it (section 11).

Processing happens on our servers (hosted by Vercel) and in our database (hosted by Supabase); background generation and publishing jobs run on Trigger.dev. These and our other service providers process data for us - the complete list is in section 12.

Sharing, internally: Topped is run by a single operator. Production access is restricted to that operator; there is no wider team with access to your data.

Sharing, externally: we never sell your information and never share it for advertising. It is shared with no external party other than (a) the service providers listed in section 12, only as needed for the features described in this policy; (b) the platforms and services you choose to use with Topped - TikTok, Instagram, YouTube, Google sign-in, Polar, and agents you connect; and (c) where disclosure is required by law. Information received from platform APIs - including YouTube API Data - goes to no one else, except OpenAI when you use the Agent (section 2) and agents you connect yourself (section 9), and is used only for the features described here.

5. Why we are allowed to use your data

• To provide the service you signed up for (our contract with you): your account, your Product Profile, writing and making posts, publishing, your Scoreboard, the Agent, billing, support, export, and deletion.
• Our legitimate interests, weighed against yours: keeping Topped secure, fixing errors, understanding how Topped is used without advertising or cross-site tracking, and showing public posts from other creators (section 8). You can object at any time (section 15).
• Legal obligations: tax and accounting records, which Polar keeps as merchant of record, and answering lawful requests.

Connecting a social account or an agent happens only when you choose to, and you can disconnect it at any time.

6. Content you provide

When you set up Topped, you share an App Store link or website, or describe your Product in your own words, and we store the Product Profile we build from it so we can write your posts. When you share a link, we read public listing or page content such as its name, description, and icon to help fill in that profile: an App Store listing through Apple’s public lookup, a website directly from our servers. You may also upload demo footage, photos, and sounds, type prompts in the Playground, and chat with the Agent. This content is stored to produce and edit your posts and is never sold or shared for advertising.

7. AI processing of your content

We use OpenAI’s models to read your link and write your Product Profile, plan posts, write captions and slide words, suggest Watchlist accounts, answer you in the Agent tab, and make images, and fal to make images and video with the model you pick (such as Seedream, Flux, Seedance, Pixverse and Kling).

What goes to them, and only as part of the task you started:

• your Product Profile, the description you typed, and the page text we read when you set up,
• the words of a post you ask Topped to rewrite, and how you asked,
• your Agent messages, what the Agent looks up for you (such as your Product, Library, posts, and their counts and links), and the prompts it writes for you,
• your Playground prompts,
• the words of the public posts your suggestions are based on, and
• a Playground picture, when you ask fal to turn it into a video.

Text requests to OpenAI are sent with its response storage turned off, and some carry your account’s random ID so OpenAI can detect abuse. Like every OpenAI API request, images included, they may be kept for up to 30 days for abuse monitoring, and OpenAI does not train its models on them. Posts start with TikTok’s and YouTube’s AI-generated label switched on, and you can switch it off before you post; Instagram offers apps no such label.

8. Public posts from other creators

Topped shows founders public posts from other creators: accounts you add to your Watchlist, accounts we suggest for it, and the posts our team picks as the starting points for post suggestions. For these accounts we collect, through ScrapeCreators, only what anyone can see on the platform: the handle, name, and profile photo; the posts’ words, pictures, and video; when they were posted; and the platform’s own view, like, comment, and share counts. We keep copies of profile photos, thumbnails, and some videos so they keep loading. To suggest accounts, we ask OpenAI for products that compete with yours, based on your Product Profile, and search TikTok and Instagram for them; for suggested accounts we also store their follower and post counts. Our team uses OpenAI to read the pictures of the posts we pick as starting points.

We do this because learning from what works for others is what Topped is for (our legitimate interest), and we never collect private data from these accounts. Some of these posts also appear on our website. If you are one of these creators and want your account or a post removed from Topped, email support@topped.ai and we will remove it.

9. Agents you connect

If you connect your own AI agent to Topped - with a key, or by signing it in with your Topped account - it can do what you can do in Topped: read your Product, posts, Library, and results; make, approve, schedule, and post posts; cancel or move scheduled posts; upload, make, and delete media; edit your Product and Watchlist; disconnect accounts; and spend your plan’s allowances - with no extra step inside Topped. What it reads goes to that agent and whoever runs it, under their terms, not ours. We store your keys only as a one-way hash, and you can revoke a key or a signed-in agent at any time in Settings.

10. Payments

Billing is handled by Polar, our merchant of record. Checkout is a redirect to Polar’s own hosted checkout page, where Polar collects and processes your payment details directly; Topped never sees or stores your card number. Polar acts as the seller for tax and compliance purposes and handles payment data under its own privacy policy.

11. Analytics, error tracking, and cookies

We use PostHog to understand how Topped is used. On our public pages it counts visits without cookies or browser storage. In the app it records which pages you visit and when a visit ends, and the actions you take (for example approving a post or making an image), tied to your account’s random ID, not your name or email. We also send PostHog summary facts from our own records: your plan; when you signed up, finished setup, and first paid; where you came from; how much of your allowances you have been given, bought, and used; how many posts you have made, passed on, saved, and published, by whom (you, the Agent, or an agent you connected) and on which platforms; which platforms you have connected; how many uploads, Playground images and videos, Watchlist accounts, agents, and Agent chats you have; what your AI use cost us; and the public handles people watch. When an account is deleted, PostHog also receives the anonymous tally described in section 14. PostHog never receives the words or media you create, your email address, or your platform access tokens. Like any website, it receives your IP address and browser details, and uses the IP address to estimate your rough location. PostHog stores this data in the United States.

The website you came from (its address only) and any campaign tags on your sign-up link are kept with your account.

We use Sentry to capture crashes and errors so we can fix them. Sentry receives the error, the page, and your browser type, and for some errors your account’s random ID. When an error happens in your browser, Sentry also keeps a recording of the screen from up to a minute before it and for the rest of that visit (at most an hour), with all text, typing, and media hidden. It also measures how fast a sample of pages load. Neither PostHog nor Sentry receives your payment details.

Topped uses cookies to keep you signed in, to protect the step where you connect a social account, and to remember the last Format you used in Creator. Your browser also stores a few settings and unfinished work on your device, such as light or dark mode, the Product you last opened, and a post you are still making in Creator. We do not use advertising cookies, analytics cookies, or cross-site trackers. When you play a YouTube post in your Watchlist, it plays in YouTube’s privacy-enhanced player, which connects your browser to Google.

12. Service providers

These service providers process data for us, only to run the features described in this policy:

• Vercel - application hosting
• Supabase - database, sign-in, and file storage, hosted in AWS us-east-1
• Trigger.dev - background jobs for generation and publishing
• Resend - email delivery: sign-in codes, account notices, and your Support messages
• Sentry - error tracking
• PostHog - product analytics
• OpenAI - AI models for your Product Profile, post planning, captions, the Agent, and images
• fal - AI image and video generation (Seedream, Flux, Seedance, Pixverse, Kling), and the music we make for Topped’s own sounds
• ScrapeCreators - public posts and profiles of other creators (section 8)

These companies receive data when you choose to use them with Topped, and handle it under their own terms and privacy policies:

• Polar - payments and billing, as merchant of record (Polar processes your payment details directly; Topped never stores your card number)
• TikTok - Content Posting API, only if you connect a TikTok account, to publish posts you approve and read their metrics
• Meta / Instagram - Instagram API, only if you connect an Instagram account, to publish posts you approve and read their metrics
• Google - YouTube Data API, only if you connect a YouTube account, and Google sign-in, only if you use it
• Apple - the App Store’s public lookup, when you give us an App Store link (only the app’s ID and store country are sent)

Planned, not yet active - on our roadmap but not yet processing any of your data; we will update this policy before turning it on:

• Cloudflare - media storage (R2). Media is stored via Supabase Storage today.

13. Where your data is processed

Topped is run from Israel. Our database is hosted in the United States (AWS us-east-1, through Supabase), and most of our service providers process data in the United States. If you are in the EU, the UK, or another country with data-transfer rules, your data is transferred to the United States; we rely on the European Commission’s Standard Contractual Clauses (with the UK addendum) or the EU-U.S. Data Privacy Framework, as each provider offers them.

14. Data retention, deletion, and export

We keep your account data for as long as your account exists. If you cancel a paid plan, it runs to the end of the period you paid for, and then your account moves to the free tier rather than being deleted, so your history and Scoreboard are preserved. Some things are removed sooner: drafts you start in Creator or with an agent and never approve are deleted after 7 days, interrupted uploads are cleared within a day, and a connected account that stops working is removed if you don’t reconnect it within 14 days (sooner for YouTube; section 2), and what the Agent looked up in a chat is cut after 30 days (section 2).

Export. Settings › Account › Export everything downloads what we hold about you - your Product, posts, generated and uploaded media, sounds, Scoreboard history, Agent chats, Watchlist, connected accounts (never their tokens), agent keys, and your plan and usage history - as one archive, at any time. Its download link works for an hour, and we delete the archive from our storage within about two hours. Invoices are in Polar’s customer portal.

Deletion. You can delete your account yourself in Settings › Account. Deleting it:

• ends your plan at once, with no refund for the time left;
• disconnects your TikTok, Instagram, and YouTube accounts and deletes their stored tokens. We ask TikTok and Google to revoke Topped’s access; Instagram offers no way to do that from our side, so you can also remove Topped in each platform’s own settings;
• permanently deletes your Product, your posts and media, everything in your Library, your Scoreboard history, your Agent chats, your agent keys, and your sign-in, and deletes your record in our analytics tool (PostHog) with its events.

Your account and its data are gone within minutes, or within about three hours if an upload was in progress, and a last sweep a day later removes anything that was still being made at that moment; PostHog removes the events in its next weekly cleanup.

A few copies outlast it for a limited time:

• Polar, our merchant of record, keeps anonymized orders and invoices it must keep by law;
• our database backups keep a copy for up to 14 days;
• our background-job provider keeps its record of the jobs it ran for you, which can include text you typed into them (such as a Playground prompt), until that record expires;
• our email provider keeps a 30-day log of the emails we send, including your Support messages, which also stay in our support inbox;
• logs at our hosting and error-tracking providers carry only your account’s random identifier, never your email.

We also keep a record that a deleted account existed, under a random ID with no personal details, and an anonymous tally of the month it joined, the month it left, and its last plan, which our analytics tool also receives. Public posts we collected for Watchlists are shared across Topped, are not linked to you, and are not deleted with your account (section 8). If you can’t sign in, email support@topped.ai and we will delete your account for you.

This is our walk-away promise: you can always leave with your data, and you are never locked in.

15. Your rights

Wherever you live, you can ask us to access, correct, delete, or export your personal data, to restrict how we use it, or to stop a use based on our legitimate interests, including product analytics. Much of this you can do yourself in Settings; for the rest, email support@topped.ai. We reply within one month, and may ask you to confirm the request from your account email before we change anything.

If you are in the EU or the UK, you can also complain to your local data protection authority; in Israel, to the Privacy Protection Authority. Topped makes no decisions about you based only on automated processing that have legal or similarly significant effects.

16. Children

Topped is for adults: you must be at least 18 to use it (see our Terms of Service), and we do not knowingly collect data from anyone younger. If you think a child has given us data, email us and we will delete it.

17. Changes to this policy

We may update this policy as Topped changes. Material changes will be posted here with an updated date, and where required we will notify you by email.

18. Contact

Topped is operated at topped.ai by Lior Cohen, sole proprietor. For any privacy question, deletion or export request, email support@topped.ai.