Privacy Policy — Odoo.sh Submodule Updater

Chrome extension. Effective date: 9 August 2026 · Published by Systee s.r.o. · Contact: info@systee.cz

Odoo.sh Submodule Updater is a developer tool that adds a helper panel to Odoo.sh project pages. It sends no data to the extension's publisher and to no third-party service. It contains no analytics, no telemetry, no advertising and no tracking of any kind. All data it handles stays either in your own browser or on the deployment API server that you configure and your organization operates.

1. Scope

This policy covers the Chrome extension "Odoo.sh Submodule Updater" only. It does not cover Odoo.sh itself, Bitbucket, or the deployment API server you point the extension at — those are operated by other parties under their own policies.

2. What data the extension handles

2.1 Settings you enter

Stored locally in chrome.storage.local on your device:

• the URL of your deployment API endpoint;
• an Odoo API key used to authenticate to that endpoint — stored encrypted (AES-GCM, under a non-extractable key held in the browser's IndexedDB); the plaintext key is never written to storage and exists only in memory while a request is being made;
• your Bitbucket workspace name, an optional repository filter, a list of priority projects and the command template.

2.2 Data read from pages you visit

While you are on an Odoo.sh project page, the extension reads project and deployment metadata from Odoo.sh's own endpoints, using your existing Odoo.sh login session:

• project name/slug and technical name, branch names, stages and Odoo version;
• submodule names, last deployed commit SHA, source branch and build status, parsed from the branch's own deployment history;
• your Odoo.sh username and user id, as returned by Odoo.sh for the page you are on.

This is cached locally in chrome.storage.local (keys inventoryCache and projectRepoMap) so the panel does not have to re-fetch it on every navigation. The extension does not read page content beyond this, does not read other tabs, and runs only on URLs matching https://www.odoo.sh/project*.

2.3 Data sent when you start an update

Only when you explicitly click an update/install action does the extension send a request to the deployment API endpoint configured in its options. That request contains: the project name, the branch, the submodule, the target branch or tag, and — for the bulk-update authorization check — your Odoo.sh username. Your API key is sent as the request credential.

3. Who the data is shared with

There is no other recipient. No data is sent to the publisher of this extension, to any analytics or advertising provider, or to any other third party. No data is sold, rented or used for advertising, credit scoring or lending. No data is used to train any machine-learning model.

4. What happens on the deployment API server

The server you configure is operated by your own organization, and its handling of the request is governed by that organization. For the reference implementation used with this extension: each request is written to the server's application log with a request id, route, source IP address and the request payload, with secret-bearing fields (tokens, passwords, SSH key material) redacted before logging. The outcome of a streamed run is kept in server memory for roughly one hour so a client whose connection dropped can retrieve the final result, then discarded.

5. Storage location, retention and deletion

• All extension data is stored locally in your browser profile. There is no cloud sync of extension data and no server-side account.
• Cached project data is refreshed as you use the extension; entries older than 24 hours are re-fetched.
• You can delete everything at any time by removing the extension, or by clearing the extension's site data via chrome://extensions → Details → Site settings. Clearing the stored settings also destroys the encryption key used for the API key.

6. Permissions and why they are needed

• storage — to keep the settings and cache described in §2 between page loads.
• https://www.odoo.sh/project* — to inject the panel and read project data on the pages the extension exists to support.
• https://ci.systee.cz/*, http://localhost/*, http://127.0.0.1/* — to reach the deployment API endpoint you configure (a company-hosted server, or a local one during development).

The extension requests no other permissions. It contains no remotely hosted code: all its JavaScript ships inside the package, and network responses are parsed as data, never executed.

7. Limited Use

Use of data obtained through this extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used solely to provide the extension's single stated purpose — generating and running Odoo.sh submodule update commands — and for no other purpose.

8. Children

This is a developer tool intended for professional use. It is not directed at children and does not knowingly handle data of children.

9. Changes to this policy

If the extension's data handling changes, this page is updated and the effective date above is changed. Material changes are also reflected in the extension's Chrome Web Store listing.

10. Contact

Questions about this policy or about data handling: info@systee.cz, Systee s.r.o.

Odoo.sh Submodule Updater · this policy applies to extension version 1.45.0 and later.