Privacy Policy

Information we collect

We collect only what we need to run TopHat for you and your household:

• Account details — your email address, a securely hashed password (or your Google sign-in), and the display name, short name, and color you choose.
• Household content — the tasks, calendar events, notes, shopping lists, recipes, chores, and assistant messages you and your household members create.
• Google Calendar (optional) — if you choose to connect Google Calendar, we store the tokens needed to sync your events. We request read-only access to your calendar, and nothing else from your Google account.
• Notifications (optional) — if you turn on reminders, we store the push subscription your browser or device provides.
• Payments — when you subscribe to a paid plan, payment is processed by Stripe. We never see or store your full card details.
• Technical information — basic logs and device or browser details, used to keep the service secure and working.

How we use your information

We use your information to:

• Provide TopHat — store your household's data and keep it in sync across the members you invite.
• Power the assistant (Hattie) — generate the responses you ask for (see below).
• Send the notifications and reminders you opt into.
• Process subscriptions and prevent abuse.

We do not sell your personal information, and we do not use your household content to train AI models.

Google user data (Limited Use)

If you connect Google Calendar, TopHat's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements:

• We request read-only access to your Google Calendar, and nothing else from your Google account.
• We use that calendar data only to display your events inside your household's TopHat calendar.
• We do not transfer or sell this data, and we never use it for advertising.
• We do not let humans read your Google data, except with your explicit consent, where it's needed for security, or to comply with the law.
• You can disconnect Google at any time, which stops the sync and removes the stored access.

The assistant (Hattie)

When you message TopHat's assistant, the content of that conversation and the relevant task or calendar context is sent to our AI provider, Anthropic, to generate a response. It is used only to answer you — not to train models — and is handled under Anthropic's enterprise data terms.

Service providers

We rely on a small set of trusted providers to operate TopHat. Each receives only what it needs to do its job:

• Supabase — database, authentication, and file storage (hosted in Canada).
• Vercel — application hosting.
• Anthropic — the AI that powers the assistant.
• Google — only if you connect Google Calendar.
• Stripe — payment processing for paid plans.

How we share information

We share your information only within your household (members can see the content you share with them), with the service providers listed above, or when required by law. We never sell your data.

Where your data is stored

TopHat's primary database is hosted in Canada (Supabase, ca-central-1). Some providers, such as our hosting and AI provider, may process data in the United States. By using TopHat, you consent to this processing.

Keeping and deleting your data

We keep your information for as long as your account is active. You can delete content in the app at any time, and you can ask us to delete your account and associated personal data by emailing us. When the last member of a household leaves, that household's content is removed.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to withdraw consent. To exercise any of these, email us at scott@itsthemillers.ca and we will respond within a reasonable time.

Children and families

TopHat is built for families. Accounts are created and managed by adults, who are responsible for any information they enter about children in their household. We do not knowingly let children create their own accounts.

Security

We protect your information with encryption in transit, row-level database security that keeps each household's data separate, and access controls. No system is perfectly secure, but we work hard to keep yours safe.

Changes to this policy

We may update this policy as TopHat grows. When we do, we will revise the date above, and significant changes will be highlighted in the app.

Contact

Questions about this policy or your data? Email Scott at scott@itsthemillers.ca. TopHat is operated by Last Mountain Media Co., Imperial, Saskatchewan, Canada.