Privacy policy — dtails time participants

Last updated: 3 November 2026

Publisher: dtails ApS   Rådmandsgade 45 A, 1   2200 København N, Denmark   Privacy contact: hello@dtails.dk

This policy explains how the dtails time participants Chrome extension and its companion dtails time Mac app handle participant information for reviewing and registering working time.

Purpose

The extension supplies participant context from Gmail and Gorgias to the Mac app, helping users identify the clients and tasks associated with their work. It is not used for advertising, profiling for unrelated purposes, or selling personal data.

Information collected by the extension

The extension operates on mail.google.com and account subdomains of gorgias.com. It captures participant metadata only when the page is visible, its tab is active, Chrome is focused, and the user has not been idle for two minutes. It does not run in incognito windows.

In Gmail, it captures available sender and recipient names and email addresses from open messages and drafts or replies, message or draft identifiers, and whether the context is reading or composing.

In Gorgias, on an open ticket, it captures the ticket identifier, customer names and email addresses in the customer sidebar's Email fields, and participants in the reply's From, To, Cc and Bcc fields.

Participants with a known email domain of dtails.dk are excluded, including their associated names. Names can be captured without an address when the site exposes only a name; their email domain is then unknown. Addresses are not inferred from names.

The extension does not collect message or ticket bodies, quoted content, subjects, attachments, internal notes, passwords, or text typed into message editors. It does not scan unrelated Gorgias customer fields, order widgets or other websites.

Participant changes are timestamped by the local app. Empty snapshots mark when a participant context ends. These records can therefore indicate when a user viewed a message or ticket or composed a reply.

Companion app activity recording

The Mac app has a separate activity recorder. When enabled, it records foreground app and window metadata, document paths and supported browser URLs, idle and sleep/lock events, and permitted click/Return target labels. Window titles can include email subjects even though the extension does not read subjects. Browser URL query strings and fragments are removed. Microphone-use detection records only whether the microphone is in use, not audio. An optional shell hook records commands and working directories when enabled.

Blocked applications are represented as private activity without their titles, document paths, URLs or action targets. The extension's native host also honours a blocked Chrome application. Recording requires the applicable macOS permissions and can be turned off in the app. The recorder does not take screenshots or record video, audio, or general typed text.

Local transfer and storage

The extension sends participant snapshots directly to the installed Mac app through Chrome Native Messaging. This is a local connection, not an internet upload. The native host checks the caller and validates the snapshot format.

Participant records are stored in daily gmail-YYYY-MM-DD.jsonl files, including Gorgias records identified by their source. The default log folder is:

~/Library/Application Support/dtails-time

Users can choose another folder in Settings. The separate activity recorder stores its own daily files in the same selected folder.

The extension retains the last forwarded snapshot and its tab identifier in Chrome's in-memory session storage to avoid duplicate writes and close contexts. This session copy is cleared when Chrome closes.

Participant log files are created with permissions restricted to the current macOS user. Local logs are not encrypted by the app. FileVault or equivalent disk encryption is recommended; device administrators and anyone with access to the user's account may be able to access the files. Users choosing a synced or shared folder should account for that service's access and storage settings.

The extension itself makes no network requests to dtails, OpenAI, ClickUp or any other server. It contains no analytics, advertising or remotely loaded executable code.

AI review and ClickUp

Local capture and AI processing are separate steps. When a user starts a review or chats with the assistant, the Mac app sends the conversation and relevant evidence to OpenAI using the API key configured by that user or their organisation. This evidence may include activity metadata and participant names and email addresses. Tool results selected for the review, including relevant ClickUp information, may also be included in the conversation sent to OpenAI.

OpenAI's processing, retention and available data controls depend on the API account and applicable agreement. See OpenAI's API data controls and privacy policy. An API key does not by itself guarantee zero data retention.

The user connects their own ClickUp account through OAuth. The app reads relevant tasks and existing time entries to support the review. New time entries require explicit approval of the proposed entries. Approved descriptions can contain client or participant context. ClickUp stores submitted information under the relevant workspace's controls and agreements. See ClickUp's privacy policy.

OpenAI keys are stored in macOS Keychain. ClickUp OAuth credentials are stored by Pi in the app's per-user application-support directory with restricted file permissions. They are not bundled in the extension or shared with other users by the app.

The software does not automatically upload logs to a dtails collection server. Organisational access through a managed device, shared log folder, or shared ClickUp workspace depends on that organisation's access controls.

Use and disclosure restrictions

We do not sell personal data or use or transfer it for advertising, determining creditworthiness, lending, or purposes unrelated to reviewing and registering working time. Transfers to OpenAI and ClickUp serve that stated purpose, as described above. Other disclosures may occur where required by applicable law.

Information collected through the extension is used and transferred in accordance with the Chrome Web Store User Data Policy, including its Limited Use requirements.

Retention and deletion

• Local logs: remain until deleted by the user; there is no automatic expiry. Uninstalling the app or extension does not delete existing logs. Use Settings → Log folder → Open to locate them. Delete gmail-*.jsonl to remove participant records, and the relevant activity files if those should also be removed. Copies in backups or synced folders must be handled separately.
• Stop collection: disable or remove the extension at chrome://extensions. Turn off the activity recorder separately in the Mac app. Stopping collection does not erase existing data.
• Credentials: remove the OpenAI key and sign out of ClickUp in Settings. Removing a credential does not delete logs or information already processed by a service.
• OpenAI: retention and deletion are governed by the API account's agreement and data controls. Contact the account administrator or OpenAI for applicable deletion options.
• ClickUp: submitted time remains until removed under the workspace's permissions and retention rules. Contact the workspace administrator for access or deletion requests.

Organisational use and individual rights

Users and organisations must have an appropriate lawful basis and authority to process the participant information they access, including customer information in Gorgias. The extension is not a substitute for an organisation's employee notices, customer privacy notices, processing agreements or legal obligations. Where an organisation determines how the software is used, that organisation is responsible for its processing decisions and applicable retention settings.

Depending on applicable law, individuals may request access, correction, deletion, restriction, portability, or object to processing of their personal information. Contact hello@dtails.dk for requests concerning processing for which dtails ApS is responsible. For data controlled by another organisation or service account, we may direct you to the relevant controller or administrator. These rights are subject to applicable legal conditions and exceptions.

You may also lodge a complaint with the Danish Data Protection Agency, Datatilsynet, or your relevant supervisory authority. Third-party providers may process data outside Denmark or the EEA; applicable transfer arrangements depend on the service account's agreements and settings.

Changes and contact

Material changes to collection or use will be reflected in this policy and the extension's disclosures. The date above identifies the latest revision. Where required, additional notice or consent will be provided before new processing begins.

dtails ApS   Rådmandsgade 45 A, 1   2200 København N, Denmark   hello@dtails.dk