Privacy Policy

What the browser extension reads and sends

The Bossless browser extension reads two cookies that SoundBetter sets in your browser: your session cookie and your “remember me” cookie. Both are scoped to soundbetter.com only. They never touch any other site.

It sends those two cookies to the Bossless server on two occasions: when you click Connect, and again automatically whenever SoundBetter rotates the cookies while your browser is open. That second case is what keeps you connected without you having to reconnect by hand.

The extension reads nothing else: not the content of any page, not your browsing history, and nothing on any site other than soundbetter.com.

How your login is stored

Your SoundBetter login is encrypted with AES-256-GCM before it reaches the database. The encryption key is held in server configuration, never in the database itself. Anyone who got into the database alone would find only unreadable scrambled data, not your login.

Here is the part that matters most, stated plainly: the Bossless server can decrypt that login and use it to act on your behalf while you are away, for example checking your messages overnight. That is what lets the app keep working while you sleep. It is the honest core of the product, not a detail to bury.

What we keep from your SoundBetter conversations

Once you are connected, we scrape and keep:

• Your conversation messages, including their full text
• Client names and their SoundBetter user IDs
• Project titles, statuses, prices, currencies and dates
• Attachment filenames and links
• A history of status changes on each project

Gmail, if you connect it

Connecting Gmail is optional. If you do, Bossless asks for read-only access, Google’s gmail.readonly scope. It cannot send, modify or delete anything in your mailbox.

We do not keep email bodies. We extract and store only a few specific fields from relevant messages, for example a client’s name, a project title, or a payment amount.

The access tokens Google issues us are encrypted before storage, the same as your SoundBetter login.

Who else your data goes to

• Anthropic and Z.ai, two AI providers, receive conversation content so their models can analyse your sales patterns and draft replies.
• Your browser’s push notification service receives what it needs to deliver notifications to you.
• A proxy provider routes the requests Bossless makes to SoundBetter on your behalf.
• Supabase stores the database. Vercel hosts the app.

What we don’t do

• No analytics, no advertising trackers, no third-party error-tracking service, anywhere in the product.
• Message contents are never written to logs. An automated check runs on every build to catch this, and it fails the build if it finds one.
• Your data is isolated from every other user’s at the database level. One user cannot reach another user’s data.
• Bossless never sends a message on your behalf. You always click send yourself.

Deleting or exporting your data

There is currently no button in the app to delete or export your own data. We are saying this plainly rather than hiding it.

If you want your data deleted or exported, email dimemacau@gmail.com and we will handle it directly.

Contact

Questions about this policy or your data: dimemacau@gmail.com.