Privacy Policy

Version 1.0 · Last updated 2026-09-06 · 简体中文版

Agents Butler helps you clear out the files that AI tools leave behind on a Windows PC. This policy explains what the app processes on your computer, what leaves it, what we keep on our servers, for how long, and how you can control it. In one line: the contents of your files stay on your PC, and data reaches us only through features you switch on or use yourself.

1. Scope and who we are

  • Operator (controller / personal information handler): TOPPING INC. LIMITED (brand: TPOAD, “we”, “us”).
  • Address: RM18, 27/F, Ho King Comm CTR, 2-16 Fa Yuen St, Mongkok, Kowloon, Hong Kong. Contact: contact@tpoad.com.
  • This policy covers the Agents Butler Windows desktop app, this website, and the community available in the app and on the web (together, the “Service”).
  • The Service is offered worldwide and is currently in invite-only testing. We do not use mobile-number identity verification.

2. What stays on your PC

The following is created and stored only on your computer. It is not uploaded and we cannot access it:

  • Everything the scanner reads: file names, paths, sizes, timestamps, and the small amount of file content needed to judge an item (for example the working-directory field inside a session log). Scanning is read-only.
  • The quarantine folder (a local isolation directory) with its copies and batch manifests, and compressed archives with their manifests. Both sit on the same drive as the original files.
  • Your local protection list, scan and project-audit history, and the recovery index.
  • Your settings: language, appearance, quarantine retention period, cache limits and every feature toggle.
  • Unsent community drafts and the pending-message queue. On Windows they are encrypted with the operating system’s data protection interface (DPAPI); in the web client they are held in an encrypted browser vault. They are not uploaded.

Deleting the app’s data folder or uninstalling the app removes this data with it.

3. What the app sends

3.1 Version reminder (read-only, can be turned off)

On start-up the app reads latest.json from this site to compare version numbers for the app and the rules bundle. The request carries no account identifier; our server only records what any HTTP request produces (IP address, time, request path, client identifier). The app does not download or install updates automatically — it shows a notice and you decide whether to visit the download page. You can turn the version reminder off in Settings.

3.2 Anonymised fingerprints and labels (off by default; you have to tick “send”)

For large directories that no rule recognises, the app builds an anonymised fingerprint locally. It is sent to us only after you tick the “send” option or click “ask the model”. A fingerprint contains only:

  • a path pattern in which private names such as your user name and project names are replaced by placeholders;
  • directory size and file count;
  • a count of file extensions;
  • dates (newest / oldest file, to the day);
  • naming features (whether markers such as cache, tmp, log, backup or version numbers appear);
  • and the “useful / not useful / not sure” label you gave that directory.

A fingerprint never contains file contents, your user name, your machine name, original project names, sample file names or full absolute paths.

Purpose: improving the public cleaning-rules library (one vote per fingerprint per account or installation) and, when you click “ask the model”, returning a suggestion. Model assistance is forwarded by our server to a model provider — Anthropic or OpenAI (only one is enabled at a time by configuration; the provider currently in use is shown in the app, and the feature shows as unavailable when none is configured). Those providers receive the same anonymised fingerprint and nothing else. Each user gets 20 free requests per day. Model output is a suggestion only and never pre-selects an item.

If you turn sending off, labels stay on your PC. Fingerprints already sent are not linked to any further data, and you may ask us to delete them.

3.3 No analytics, no trackers

The app and this website contain no third-party analytics, advertising or tracking scripts, and no tracking cookies. Download counts come from our own server logs.

4. Community account and messages

  • Sign-in: an e-mail address with a one-time code. Code e-mails are delivered by the e-mail provider Resend from the tpoad.com domain. Codes are single-use and short-lived; our server logs record neither the codes nor session tokens.
  • What we store on our servers: your e-mail address, display name, avatar style and language preference; the messages you send in channels, groups and direct chats; friend and block relationships; bookmarks; reports you file or that are filed about you; read positions; and the sign-in and session records needed for security.
  • Sessions: a sign-in token is valid for 30 days. You can sign out of the current device or of all devices at any time.
  • Drafts: unsent drafts and the pending queue are encrypted on your device and are not uploaded (see section 2).
  • Transport and readability: traffic runs over HTTPS. Our server can read message content in order to deliver messages, handle reports and protect the service, so we do not describe the Service as end-to-end encrypted.
  • Not enabled at present: third-party sign-in (Google / GitHub / Apple), message translation and file attachments. If we enable any of them we will update this policy first and tell you about the data flow and provider involved before it goes live.

5. Purposes and legal bases

  • Providing the community you asked for (account, messages, groups, friends, bookmarks): necessary to perform our contract with you (GDPR Art. 6(1)(b); PIPL Art. 13(1)(2)).
  • Version reminder, server and security logs, anti-spam and rate limiting: our legitimate interest in operating and securing the Service (GDPR Art. 6(1)(f)), balanced by data minimisation and short retention.
  • Sending anonymised fingerprints and model assistance: your consent (GDPR Art. 6(1)(a); PIPL Art. 13(1)(1)). You can withdraw it at any time in Settings; withdrawal does not affect processing carried out beforehand.
  • Handling reports, enforcement and appeals: performance of our contract and our legitimate interest in protecting other users and the community, together with compliance with applicable law.
  • Under the Hong Kong Personal Data (Privacy) Ordinance we follow the Data Protection Principles: we collect only data directly related to the purposes above and do not use it for a new, incompatible purpose without your consent unless the law allows it.

6. Retention periods

  • Data on your PC: controlled by you. Quarantined copies are kept for 30 days by default; the app reminds you 3 days before expiry; once an item has expired and that reminder has been displayed in the app for 3 full days, the app releases the quarantined copy. You can switch automatic release off in Settings and keep reminders only. Released copies can no longer be restored by the app.
  • Server access and security logs: 30 days.
  • Community account data (e-mail, display name, avatar style, language): until you delete your account.
  • Community messages: until you delete the message or your account. Deletion removes them from our database and we cannot restore them afterwards; copies others have received or saved themselves are outside our control.
  • Reports and enforcement records: kept for as long as necessary after a case closes, normally no longer than 12 months, for appeals, repeat-offence assessment and security. After you delete your account only an anonymised trace that does not point to you remains.
  • Anonymised fingerprints and your labels: labels are kept while your account or installation identifier exists and are deleted or de-identified when you delete your account; aggregated fingerprint verdicts carry no link to any user and are kept for as long as the rules library needs them.
  • Code e-mails: we do not separately store the code; delivery records are held by the e-mail provider under its own retention policy.
  • Database backups: kept 14 days for disaster recovery, then overwritten. Deletion requests take effect in backups within that rotation cycle.

7. Processors we use

We do not sell personal information, do not use it for advertising, and do not share it with third parties other than those below. Each provider processes data on our instructions under contractual confidentiality and security obligations:

  • UCloud — server and database hosting · processed in Hong Kong · covers all server-side data.
  • Resend — delivery of sign-in code e-mails · processed in the United States · covers your e-mail address and the content of that message.
  • Anthropic or OpenAI (one of them, as configured) — classification of anonymised fingerprints · processed in the United States · covers the fingerprint described in section 3.2, with no file contents and no identifying data. This feature is off by default.

We may also disclose the minimum necessary information where the law requires it, where a court or law-enforcement authority makes a lawful request, or where it is necessary to protect someone’s vital interests. Where the law allows, we will tell you first.

8. Where data is stored and cross-border transfers

Our servers are located in Hong Kong. When you use the community, model assistance or the version reminder, the related data is stored and processed in Hong Kong.

For users in mainland China: your personal information is provided outside mainland China (to Hong Kong). As required by Art. 39 of the Personal Information Protection Law — overseas recipient: TOPPING INC. LIMITED; contact: contact@tpoad.com; purpose: providing the community and improving the public rules library; method: storage on servers in Hong Kong and use as described in this policy; categories of personal information: see sections 3 and 4; you may exercise your rights of access, copy, correction, supplementation and deletion against the overseas recipient through the e-mail address above. We ask for your separate consent when you first use the community or switch sending on. If you do not consent you can simply not use these online features; local scanning and cleaning in the desktop app are unaffected.

For users in the EEA and the UK: Hong Kong is not covered by a European Commission adequacy decision. For transfers involving our processors we rely on Standard Contractual Clauses and the other safeguards set out in Art. 46 GDPR, supported by encryption in transit and data minimisation. Write to us for a description of those safeguards.

Model assistance: if you switch it on, anonymised fingerprints are transferred to a model provider in the United States. They contain no file contents, user name, machine name or project name.

9. Your rights and how to exercise them

Subject to applicable law you have the right to access and obtain a copy of your data, to have it corrected or completed, to have it deleted, to restrict or object to processing, to data portability (export), to withdraw consent, and not to be subject to a decision based solely on automated processing — we take no automated decisions that produce legal or similarly significant effects. You may also ask us to explain how we handle your personal information.

How to exercise them:

  • Directly in the app or the web community: turn sending off, sign out of all devices, delete messages, delete your account.
  • For anything else (access, correction, export, restriction, objection): e-mail contact@tpoad.com.
  • We reply within 30 days of receiving a request. If a request is complex and we need longer, we will tell you why within that period. To verify identity we normally ask you to write from your registered e-mail address; we do not collect identity documents for this purpose.
  • Where a user has died, close relatives may exercise the relevant rights for their own lawful and legitimate interests through the same address.

Complaints: users in the EEA and the UK may complain to their local supervisory authority; users in Hong Kong may complain to the Privacy Commissioner for Personal Data; users in mainland China may complain to the authority responsible for personal information protection. We would also welcome the chance to resolve the matter with you first.

10. Minors

  • The community is for users aged 16 and over. Where the law of your country sets a lower age of consent for information society services (not below 13), users who have reached that age but are under 16 need the consent of a parent or guardian.
  • For users in mainland China: we do not offer the community to minors under the age of 14.
  • We do not verify age and do not knowingly collect personal information from minors. If we find such an account, or a guardian tells us about one, we delete the account and its data. Guardians can write to contact@tpoad.com to access or delete it.
  • Local scanning and cleaning in the desktop app require no account and collect no personal information.

11. Security

We apply technical and organisational measures proportionate to the risk: HTTPS/TLS across the site; the application service listens only on the server’s loopback interface behind a reverse proxy; the database and cache are not exposed to the public internet; keys live only in server environment variables and are never committed to the code repository, written to logs or shown in the interface; codes and session tokens are not logged; administrative access follows least privilege and admin actions are recorded in an audit trail; the database is backed up daily and kept for a limited period.

No internet service can rule out every risk. If a personal data breach occurs that is likely to affect your rights, we will notify you and the relevant authorities as applicable law requires.

12. Changes and contact

We publish changes on this page and update the version number and the “last updated” date. For material changes — a new purpose, a new processor, or a broader set of data — we will announce them in the app and in the community and allow a reasonable notice period before they take effect. Where the law requires your consent, we will ask for it separately.

Contact: TOPPING INC. LIMITED (brand: TPOAD) · RM18, 27/F, Ho King Comm CTR, 2-16 Fa Yuen St, Mongkok, Kowloon, Hong Kong · contact@tpoad.com. See also our Terms of Use.