Privacy policy

Who is responsible

The controller for TopX (topxapp.com, mcp.topxapp.com) under the General Data Protection Regulation (GDPR) is:

Andreas Bucksteeg
[To confirm: postal address]
Email: [email protected]

In short

• TopX stores what you need to rank things with others: your name, your email address, your lists and your ballots.
• The other members of a list see your name and email address. The list's owners always see your ballot; the other members see it only if the list shows everyone's ballots.
• TopX uses no analytics, no advertising and no tracking cookies.
• Lists, ballots and their history (who changed what, and when) are kept without a time limit. When you delete your account, we erase your name and email address from all of it within 30 days.

What we process and why

Account and sign-in.

• Data: your name, email address and the ID of your login at our sign-in provider Ory, which also tells TopX whether your address is verified. Ory stores your sign-in methods (password, passkeys, one-time codes and links) and your sessions. If you sign in with Google, Google passes your name and email address to Ory.
• Purpose: to know who you are and to show your name to the people you rank with.
• Legal basis: Art. 6(1)(b) GDPR, performance of the contract (the terms of service).
• Kept: see "How long we keep data".

People you add.

• Data: you can add other people by name to share lists with them. Inviting someone by email creates a record with that email address and a name (given by the inviter, or the part of the address before the @), even if the invitation is never accepted.
• Purpose: to put people on a list before they sign in.
• Legal basis: Art. 6(1)(f) GDPR, the adding member's legitimate interest in a shared list.
• Kept: like an account (see "How long we keep data").

Lists, ballots and history.

• Data: the lists you create or join, your role on them, your rankings and scores, and a history entry for every change (who made it, when, and the state afterwards). Each accepted save is also stored as a receipt so a repeated request is not applied twice. Every creation, change, deletion and import of a list is recorded in an audit log with the list's name, description, items, members (with names and email addresses) and visibility settings before and after, your user ID and your browser's user agent.
• Purpose: to compute the group result, to show how it developed and to trace changes.
• Legal basis: Art. 6(1)(b) GDPR.
• Kept: lists, ballots, history and the audit log without a time limit. Deleting a list hides it but keeps its data. Receipts are kept until the administrator's retention period ends, or without a time limit if none is set.

Invitations and reminders.

• Data: the email address of the person invited, who invited them and to which list. The invitation email contains the inviter's name, the list's name and items, the names of its members and an optional personal message. The invitation link shows anyone who has it the inviter's name, the invitee's email address, the list's name and the first names of its members. Reminders ("nudges") contain the sender's first name and the list.
• Purpose: to invite people to a list and remind members to vote.
• Legal basis: Art. 6(1)(f) GDPR, the inviting member's and our legitimate interest in inviting people to a shared list.
• Kept: an invitation is valid for 7 days unless the inviter chooses another period (up to 30 days); the record stays afterwards. The inviter can cancel or delete it. Nudges are recorded with sender, recipient and time.

AI features.

• Data: when you ask TopX to generate a list, the category and your request text go to Anthropic. When you ask it to enhance a list, the list's description and all its items go there, including what other members entered. No names of members, email addresses or ballots are sent.
• Purpose: to suggest items and item details.
• Legal basis: Art. 6(1)(b) GDPR.
• Do not put personal data about others into requests, descriptions or items.

Export to Google Sheets.

• Data: when you export a list, you sign in to Google and allow TopX to create a spreadsheet in your Google Drive. The sheet contains the list, its items and the members' ballots, labelled with their names, as far as you are allowed to see them.
• The Google access token is used for that one export and not stored. The sheet is yours; Google's privacy policy applies to it.
• Legal basis: Art. 6(1)(b) GDPR, at your request.

Assistants (MCP).

• Data: when you connect an assistant such as Claude or ChatGPT at mcp.topxapp.com, we store the grant: your user ID, the assistant's name, the permissions you gave, when you gave them and your browser's user agent. Every tool call is logged with your user ID, the tool, the outcome and the duration. Before an assistant sends an email or a message, deletes something or takes an administrative action, TopX keeps a preview of the action (which can include an invitee's email address) for 10 minutes, and counts the emails and messages each person sends per hour for 2 hours.
• The assistant receives whatever its tools return, which can include list members' names and ballots you are allowed to see. Its provider's privacy policy applies from there.
• Kept: access tokens for 1 hour, refresh tokens for up to 365 days and 30 days without use. You can disconnect an assistant at any time under Account → AI assistants.
• Legal basis: Art. 6(1)(b) GDPR, at your request.

Operations and security.

• Data: server logs of warnings and errors, which can contain your email address, user ID, the page you requested and your browser's user agent, and the recipient's address of an email that failed to send. The assistants' server at mcp.topxapp.com logs every request at Cloudflare. The IP address is used for rate limiting at the assistants' sign-in. Notifications go to the operator's Telegram chat with list names, items and rank changes (no names of people). List summaries (daily, and when an administrator runs one) go to the same chat and are logged with the list's name and the summary text.
• Purpose: to run the service, find faults and prevent abuse.
• Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure and working service.
• Kept: Cloudflare keeps server logs for 3 days; Ory keeps its logs as set by Ory.

Who sees your data

• Members of your lists see your name and email address, and that you have voted. They see your ballot only if the list shows everyone's ballots.
• Owners of your lists always see your ballot, can change it and can export it with your name to Google Sheets.
• People you are connected with (you share a list, or one of you added the other) see your name and email address.
• Administrators of TopX can see all lists, ballots and accounts to run and support the service.
• Assistants you connect see what you can see.

Service providers

These companies process data on our behalf or receive it to provide a feature:

• Cloudflare, Inc.: hosting of the website and the assistants' server, key-value storage.
• Supabase, Inc.: the database and live updates (the live connection reaches Supabase directly from your browser and shows it your IP address). Region: Frankfurt, Germany.
• Ory Corp.: sign-in, accounts and sessions (auth.topxapp.com).
• Google: sign-in with Google, if you choose it, and the Google Sheets export.
• Resend, Inc.: sending invitation and reminder emails.
• Anthropic, PBC: the AI features.
• Telegram: the operator's notification chat.

Cloudflare, Supabase, Ory, Resend and Anthropic process data on our behalf under a data processing agreement (Art. 28 GDPR). Where a provider is based outside the EU, the transfer relies on the EU-US Data Privacy Framework if the provider is certified under it, and otherwise on the EU standard contractual clauses in its agreement. Telegram receives no names or email addresses of people.

How long we keep data

• Your account, your ballots and the history of your lists are kept until your account is deleted and erased.
• Deleting a list hides it; the list, its ballots, its history and its audit log entries stay stored.
• Save receipts are kept until the retention period set by the administrator ends, or without a time limit if none is set.
• You can delete your account in TopX (account menu, "Delete account"), or ask us at the contact above. You are signed out and can no longer sign in, and you get an email with the erasure date. After a waiting period of at most 30 days (currently 14), we erase the account: your name and email address are removed from your account, invitations and the audit log, your assistant connections are revoked, and your login at Ory is deleted. The lists' history, reminders and save receipts keep only an id that no longer leads to your name. Your ballots stay in the group results of shared lists, without your name, so the results of the other members do not change. Until the erasure, write to us to keep your account.

Cookies and browser storage

TopX sets no tracking or advertising cookies and uses no analytics. It uses only what the service needs, so no consent is asked for (§ 25(2) TDDDG):

• Ory's session cookie keeps you signed in.
• At mcp.topxapp.com a cookie (topx_mcp_flow) holds the sign-in of an assistant for up to 10 minutes.
• Your browser's local storage keeps an invitation link until you have accepted it, which invitations you dismissed, and your preferred ranking view.

The API documentation at /docs loads its viewer from unpkg.com, which sees your IP address.

Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To use them, write to the contact above.

You can complain to a data protection supervisory authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

Changes

We update this policy when TopX changes what it processes. The date at the top shows the current version. The terms of service are at /tos.