Privacy Policy

Operator and contact

TopTrack is operated by Konstantin Zotov, based in Spain. For support or privacy requests, email support@toptrack.app.

Scope

This notice covers the TopTrack website, macOS app and our hosted authorization service. If you choose a custom authorization server, its operator also handles authorization data under its own privacy practices. Your Jira organization and Atlassian separately control the information held in Jira.

Tracking history on your Mac

The app reads TopTracker’s local activity log and database to identify sessions, descriptions, issue keys, project identifiers and timestamps. Descriptions can contain personal or confidential information. Session history and submission receipts are stored in the app’s local Application Support folder. Preferences are stored on your Mac, and Jira access and refresh tokens are stored in macOS Keychain.

The app does not capture screenshots, record keystrokes or upload your session history to our authorization service. Exported history is saved to the destination you choose; you control any subsequent sharing.

Jira connection and worklogs

When you connect, your browser opens Atlassian’s consent screen. Our authorization service exchanges the authorization code with Atlassian and returns tokens to the app. It also processes refresh tokens when renewing access. Your Atlassian password is entered on Atlassian’s website, not in TopTrack.

Pending authorization transactions are kept in server memory for up to ten minutes and removed when redeemed or expired. The broker does not persist user tokens to a database. The service necessarily receives connection information, including an IP address; its in-memory rate-limit records use one-minute windows. These temporary records are cleaned during subsequent requests or when the service restarts.

The Mac app requests your authorized sites, account identity and issue worklogs directly from Atlassian to compare recorded time. Worklog API responses can include other authors’ information; the app filters comparisons to your account. When you confirm posting, it sends issue keys, durations, start times and optional comments to Jira. A private Jira worklog property identifies TopTrack submissions without adding marker text to comments; older worklogs can still contain the legacy marker.

Software updates

The direct-download app can check for new versions. A check requests the update feed at toptrack.app/releases over HTTPS, and our web server processes the same technical request information as any website visit: IP address, requested URL, timestamp, browser information and response status. The request carries the app’s version and no tracking history, Jira data, account identity or system profile. Checks run only when you choose Check for Updates in Settings → About, or automatically once you have agreed to that when the app first asks; you can turn automatic checks off there at any time. Installing an update downloads the new version from toptrack.app and verifies its signature before replacing the app. The Mac App Store build contains no update checker and is updated by the App Store.

Website visits and support

Our web server processes technical request information such as IP address, requested URL, timestamp, browser information and response status to deliver and protect the website. Website access logs are rotated daily with 14 rotated files retained; backups or legally necessary incident records may have different retention. These logs are separate from the authorization service, where nginx access logging is disabled.

The website stores your color-mode preference in browser storage. Visit statistics are optional and described in the next section; the app contains no analytics of any kind. If you email us, we process your email address, message and any attachments to respond. Please avoid sending passwords, tokens or unredacted workplace data.

Cookies and analytics

The website asks, on your first visit, whether it may keep anonymous statistics about how it is used. If you allow it, we use Google Analytics 4, provided by Google Ireland Limited, to see which pages are read, how visitors arrive (search engine, link or typed address) and whether the download is clicked. Until you allow it, the Google Analytics script is not loaded and no analytics cookie exists. Declining is remembered in the same way as allowing, so you are asked once.

With your consent, Google Analytics sets the _ga cookie and one _ga_* cookie for this site, which hold a random identifier for up to two years and are used to tell returning browsers from new ones. Google receives the pages visited, the referring site, the time, browser and device type, an approximate location derived from your IP address, and technical request information; Google truncates IP addresses before storing them and we have not enabled Google Signals, advertising features or data sharing for Google’s own purposes. Reports are aggregated and we retain event-level data at Google for two months. Google processes this information as our service provider under its Ads Data Processing Terms, which include the EU standard contractual clauses for processing outside the European Economic Area.

Your choice is stored in a first-party cookie named toptrack_consent for six months. You can change it at any time with Cookie settings in the footer of every page: withdrawing consent removes the analytics cookies from your browser and stops further collection, though it does not delete statistics already aggregated. You can also block or delete cookies in your browser; the site works without them.

Purposes and legal bases

We process information to provide the connection and support you request, operate and protect the service, and comply with applicable legal obligations. Where GDPR applies, the relevant bases are performance of our agreement with you, legitimate interests in reliable and secure operation and responding to requests, and legal obligations. Visit statistics rely on your consent, given through the cookie notice and withdrawable at any time.

Service providers and international processing

Infrastructure providers process information needed to host and deliver the website and authorization service. Cloudflare provides domain DNS. Google provides the optional visit statistics described above, and only with your consent. Atlassian processes authorization and Jira data under its own terms and privacy policy. If you enable the optional currency conversion, the app requests exchange rates from Frankfurter (api.frankfurter.dev), which receives the currency pair and ordinary connection information such as an IP address, but never amounts, hours, task content or credentials; conversion is off by default. Email providers process messages you send to support. Provider processing locations can differ from your own location; applicable transfer safeguards must be considered where required by law.

We do not sell your session history or use it for advertising. Information may be disclosed when legally required or necessary to protect the service and its users.

Retention and deletion

Local history and submission receipts remain on your Mac until you remove them; uninstalling the application alone may leave this data behind. Direct builds use ~/Library/Application Support/TopTrack; Mac App Store builds use the app's sandbox container. Disconnecting removes the app’s local Jira credentials, but does not delete history or revoke Atlassian’s grant. You can revoke that grant in your Atlassian account’s connected-app settings.

Jira worklogs remain in Jira until changed or removed there, subject to your organization’s permissions and retention rules. Removing TopTrack data does not remove Jira worklogs. Keep submission receipts while reconciling work, because deleting them can remove duplicate-submission safeguards.

Support messages are retained for handling the request and any necessary follow-up or legal obligations. Contact us for help removing information we hold. Do not send your full local database to make a deletion request.

Your rights

Depending on applicable law, you may request access, correction, deletion, restriction or portability of information we hold, object to processing based on legitimate interests, and withdraw consent where processing relies on it. Consent to visit statistics is withdrawn with Cookie settings in the footer. You may also complain to the Spanish Data Protection Agency (AEPD) or another competent data-protection authority. We normally respond to GDPR rights requests within one month, with any lawful extension explained to you. We may need proportionate information to verify a request. We cannot remotely erase data on your Mac or your organization’s Jira instance.

Changes and questions

We will update this page when the service’s data practices change and identify the revision date above. Material changes will be communicated appropriately. See Support for connection and data-handling help.