Decster CRM is under active development. This policy reflects the extension's current functionality — creating an account and connecting your Skool account, plus management tools such as member tagging, sales pipelines, member notes, team collaboration (multiple teams with member permissions), team tasks and reminders, a notifications inbox, community automations, and an optional in-page direct-messaging client (Custom Chat) — and will be updated as new features ship. Material changes will be posted here with a new "Last updated" date.
Single Purpose
Decster CRM has a single purpose: to help Skool community creators manage and grow their own community from inside Skool. To do that, the extension lets a creator create a Decster account (which automatically and securely links their own Skool account to Decster) and then use management tools inside their community — such as tagging and organizing members, and setting up community automations. The extension is for community owners, coaches, and admins — it is not a tool for community members/students.
Who We Are
Decster ("we," "our," or "us") operates the Decster CRM Chrome extension and the Decster platform at decster.ai. This policy explains what data the extension handles, why, how it is protected, who it is shared with, and the choices you have. Decster is independent and is not affiliated with or endorsed by Skool.
Information We Collect
1. Account & identity
- Email address — you enter it in the extension and verify it with a one-time code (OTP). It identifies your Decster account.
- Skool profile — your Skool user ID, first and last name, username/handle, and profile picture. These are retrieved by the Decster backend from Skool using your connected session (see below) so we can link your Skool identity to your Decster account.
2. Skool authentication token (sensitive)
- When you create your Decster account, the extension automatically reads your Skool
auth_token cookie from your logged-in skool.com session in the background. This happens as part of registration, after you accept the consent control — there is no separate "connect" step. - This token lets Decster act within your own Skool community on your behalf (e.g. reading your community data and, as features roll out, running the CRM tools you enable). The extension never uses the token to access other people's accounts or communities.
- We treat this token as sensitive data and protect it as described in "How Your Skool Token Is Protected."
3. Community member data (management features)
- When you use management features such as member tagging, the extension reads publicly visible member details from your own Skool community pages — a member's Skool user ID, display name, username/handle, and profile picture — so it can show and organize your tags next to the right people.
- When you assign or change a tag, the extension sends that member's identifier and the display details above to the Decster backend so your tags are saved to your account and stay in sync. This data is only ever about members of communities you own or administer.
- Community automations you configure (for example, an action when someone joins) are run by the Decster backend on your behalf within your own community, using your connected Skool session.
- Scheduled posts. When you schedule a post to your own community, the content you compose (title, body, links), any media you attach (images, files, or videos), your poll options, and the chosen category are saved to the Decster backend and published to your community at the scheduled time. GIFs are referenced by their public URL. This content is stored only until it is published (for recurring posts, for as long as the schedule is active), and is only ever posted to communities you own or administer.
4. On-page interface & local storage
- The extension injects its own interface elements (such as tag badges) directly onto Skool pages you visit, so management tools appear in context. It only injects into
skool.com and only modifies the page visually on your own screen. - The extension stores small amounts of state in your browser (via
chrome.storage) such as your login session, your tags, and UI preferences, so the extension works between page loads and across browser restarts. - The extension also reads your own first name and profile picture from the current Skool page to show a personalized greeting in its panel. This is used only for display and is not a separate transmission.
5. Team collaboration, tasks & notes
- You can create teams and invite other creators (by email) to help manage your community, granting them specific permissions. For invited teammates we store their Decster identity (name, profile picture) and the permissions you assign so the team features work.
- You can create tasks and reminders for yourself or your teammates. Task content you enter (title, description, links, due date, reminder times, and who it is assigned to) is saved to the Decster backend so it syncs across your team and can trigger reminders.
- You can add private notes about members of your own community. Note content is saved to the Decster backend and visible only within your team.
- This data is only ever about you, your invited teammates, and members of communities you own or administer.
6. Notifications & alerts
- To deliver task reminders and other in-product alerts in real time, the extension keeps a secure, authenticated connection to Decster's notifications service (via Supabase Realtime) that receives only your own notification records. It may show these as a desktop notification and play a short chime.
- This connection is scoped by your login to your own account's notifications only — it never receives other users' data.
7. Custom Chat (direct messages)
- Optional and off by default. Custom Chat is a convenience feature you can turn on that replaces Skool's built-in chat button with Decster's own in-page messaging interface. It runs only when you enable it, and you can turn it off at any time.
- Your messages stay between you and Skool. When enabled, the extension reads and sends your own Skool direct messages by talking directly to Skool using your existing logged-in skool.com session — the same conversations, with the same people, as Skool's native chat. Your messages and their content are exchanged directly with Skool and are not stored on, or routed through, Decster's servers.
- Real-time updates. To show new messages live, the extension listens to Skool's own real-time connection for your chat; it does not open its own connection to any third party for this.
- GIF search. If you search for a GIF in the composer, your search text is sent to Giphy to return matching GIFs; selecting one attaches that GIF's public URL to your message. Nothing beyond your search terms is sent to Giphy.
- Voice messages & transcription. If you record a voice message and choose to transcribe it, the audio is sent to the Decster backend to generate a text transcript that is placed in your message box.
- This feature does not read, store, or log your Skool
auth_token, and it only ever accesses your own conversations.
We do not collect your Skool password (you never enter it), we do not track your browsing history, and we do not read pages outside skool.com.
Browser Permissions & Why We Need Them
- cookies — to read your Skool
auth_token from your logged-in skool.com session so we can connect your Skool account and operate Decster CRM on your behalf. - storage — to keep your login session, your tags, and preferences locally in the browser.
- scripting — to inject Decster CRM's interface elements (such as member tag badges and the optional Custom Chat messaging interface) onto Skool pages so tools appear in context.
- sidePanel — to show the Decster CRM workspace in the browser side panel.
- notifications — to show desktop notifications for your task reminders and other in-product alerts.
- offscreen — to run a background connection that receives your real-time notifications (and plays a short alert chime) even when the side panel is closed.
- alarms — to keep that notification connection alive and your session token refreshed on a periodic schedule (Chrome MV3 background workers are short-lived).
- Host access to
*.skool.com — to read your session/identity, read your own community's member details for management features, render the Decster CRM interface inside Skool, and (when you enable Custom Chat) send and receive your own Skool direct messages. - Host access to Supabase (
*.supabase.co) — to send and verify your email one-time code (authentication). - Host access to the Decster API (
decster.ai) — to create your account and exchange data with Decster.
How We Use Your Information
- Create and secure your account — verify your email and create your Decster profile and free trial.
- Link your Skool account — automatically connect your Skool identity to your Decster account when you register.
- Operate Decster CRM — use your connected Skool session to provide the CRM features you use within your own community, including tagging and organizing members, running the community automations you set up, and (if you enable Custom Chat) sending and receiving your own Skool direct messages.
- Support and security — diagnose issues, prevent abuse, and keep the service reliable.
We do not sell your data, and we do not use it for advertising.
How Your Skool Token Is Protected
- Read only in the background — the token is read by the extension's background worker and is never written to logs or exposed to web pages.
- Encrypted before it leaves your browser — the token is sealed with Decster's public key (libsodium sealed box) so only Decster's server can open it.
- Sent only over HTTPS — all transmission to Decster is over a secure connection.
- Encrypted at rest — on Decster's servers the token is stored using AES-256-GCM encryption.
- Never shared with third parties and never used to access anything other than your own connected Skool community.
Data Sharing & Third-Party Services
We share data only with service providers needed to run the extension, and only as required to deliver its functionality:
- Supabase — authentication (email one-time code), secure data storage, and the real-time channel that delivers your own in-app notifications.
- Skool — using your connected session, Decster reads data from your own Skool community on your behalf, and (when you enable Custom Chat) sends and receives your own direct messages directly with Skool. We act as you, within your own community.
- Giphy — GIF search in the optional Custom Chat feature. When you search for a GIF, your search terms are sent to Giphy to return matching results.
- Speech-to-text provider — if you transcribe a voice message, the audio is processed by a third-party speech-to-text provider on Decster's behalf to produce the transcript.
- Decster platform (decster.ai) — our own backend and database.
We do not sell or rent your personal information, and we do not transfer it to third parties for their own purposes. We may disclose information if required by law or to protect the safety, rights, or property of Decster, our users, or the public.
Limited Use of Data
Our use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically: we only collect and use the data described above to provide and improve Decster CRM's user-facing features; we do not sell this data; we do not use or transfer it for serving ads; and we do not use or transfer it for any purpose unrelated to the extension's single purpose, except as necessary to provide the service, comply with the law, or with your consent.
Data Retention & Security
- Account data is kept while your account is active and deleted (or anonymized) on request or within a reasonable period after account deletion.
- Your Skool token is kept while your Decster account exists and is removed when you delete your account.
- We apply encryption in transit (HTTPS) and at rest (AES-256-GCM for sensitive tokens), access controls, and least-privilege permissions. No system is perfectly secure, but we work to protect your data with industry-standard measures.
Your Consent
During registration, before your account is created and your Skool session is read, the extension presents a clear consent control that you must actively accept. If you decline, no account is created and your Skool token is not collected. You can stop using and uninstall the extension at any time.
Your Rights & Choices
- Access — request a copy of the data we hold about you.
- Correction — ask us to correct inaccurate information.
- Deletion — request deletion of your account and associated data.
- Withdraw consent & delete — uninstall the extension and request deletion of your account, which removes your stored Skool token and personal data.
To exercise any of these, email support@decster.ai.
GDPR & CCPA
If you are in the EU/UK, our legal bases for processing are: performance of a contract (to provide the service you request), your consent (to connect your Skool session), legitimate interests (to secure and improve the service), and legal obligations. You have the rights of access, rectification, erasure, restriction, portability, and objection.
If you are a California resident, you have the right to know what we collect, to access and delete your information, and not to be discriminated against for exercising these rights. We do not sell personal information.
Children's Privacy
Decster CRM is a business tool for community creators and is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect data from children.
Changes to This Policy
As Decster CRM evolves, we will update this policy and revise the "Last updated" date. Material changes will be made prominent. Continued use of the extension after an update means you accept the revised policy.
Terms of Use
By installing or using Decster CRM you agree to these terms. If you do not agree, do not use the extension.
- Eligibility. You must be a Skool community creator/admin authorized to manage the community you connect, and at least the age of majority in your jurisdiction.
- Your account & connection. You are responsible for your account and for the Skool community you connect. You authorize Decster to act within that community on your behalf via your connected session.
- Acceptable use. Use the extension only for managing your own community and in compliance with Skool's own terms and applicable law. Do not use it to access accounts or communities you do not own or administer, to abuse, spam, or harm others, or to reverse engineer or disrupt the service.
- Free trial & plans. New accounts may receive a time-limited free trial of premium features. Trial length and plan features may change for future signups; details are shown in-product.
- Relationship to Skool. Decster is independent and not affiliated with or endorsed by Skool. Your use of Skool remains governed by Skool's own terms.
- Service "as is." The extension is provided on an "as is" and "as available" basis during this development stage, without warranties of any kind. To the maximum extent permitted by law, Decster is not liable for indirect or consequential damages arising from use of the extension.
- Termination. You may stop using and uninstall the extension at any time. We may suspend or terminate access for violations of these terms or to protect the service.
- Changes. We may update these terms; continued use after an update constitutes acceptance.
Contact Us
Questions about this policy, the terms, or your data? Contact us at support@decster.ai.