Privacy Policy

Welcome to TimeTracker. We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how TimeTracker ("we," "us," or "our") collects, uses, discloses, and safeguards your information when you use our website at timetracker.in, our web app, and the TimeTracker mobile app for iPhone and Android (collectively, the "Services").

Please read this policy carefully. By accessing or using our Services, you acknowledge that you have read, understood, and agree to the collection and use of your information as described in this Privacy Policy. If you do not agree with any terms of this policy, please do not use our Services.

We collect several types of information from and about users of our Services, including:

• Account Data: When you register for an account, we collect personal details such as your name, email address, job title, company name, billing address, and payment information (processed via secure third-party gateways).
• Time-Tracking & Timesheet Data: Our Services are designed to help you track time, manage project budgets, and build timesheets. We collect hours tracked, task descriptions, project names, client allocations, and custom labels that you or your team members enter.
• Financial & Rate Data: To calculate profitability and compile invoices, you may input labor rates, billable rates, and project budget thresholds. We treat this financial intelligence with strict confidentiality.
• Integration Data: If you connect your Google Calendar, we read the events you choose so you can turn them into time entries. We read nothing else in your Google account, and we never use that data for ads or sell it. You can disconnect the calendar at any time from your settings, and we stop reading it straight away.
• Usage & Technical Data: We automatically collect information about how you interact with our website and application, including IP addresses, browser types, operating systems, referring URLs, device identifiers, and page viewing statistics.
• Location Data, only if your workspace turns location rules on:If your workspace uses location rules and you clock in from a web browser, we read your position at that moment, with your browser's permission, together with the IP address our servers see. We use it to decide whether that one punch is allowed, and we keep the result so an admin can review it. We do not read your location at any other time, we do not build a route history, and if you say no to the browser prompt we simply cannot approve a punch that needs it. The iPhone and Android app never asks for your location and never sends it.
• Mobile App Data: When you use the iPhone or Android app we also handle a push notification token so we can send you alerts, your device model, operating system version and language so the app renders correctly, and a copy of your own time entries stored on the phone so the app works with no signal. If you attach a receipt to an expense, the photo you pick is uploaded and stored with that expense. The app has no advertising SDK, no analytics SDK, and does not track you across other apps or websites.

The TimeTracker app for iPhone and Android asks for a small number of permissions. Each one is optional, each one is asked for only at the moment you use the feature, and the app keeps working if you say no. You can change your mind at any time in your phone settings, under iOS Settings then TimeTracker, or Android Settings then Apps then TimeTracker.

• Camera: Used only when you photograph a receipt to attach it to an expense claim. The photo is uploaded to that expense and nowhere else. We do not open the camera in the background.
• Photo library: Used only when you pick a saved receipt image to attach to an expense. We receive the single image you choose. We cannot see the rest of your library.
• Notifications: Used to send reminders and approval alerts, for example a reminder that your timer is still running. We use OneSignal to deliver them, which means OneSignal holds a device token for your phone. You can turn notifications off in your phone settings and keep using the app.
• Location: The app does not ask for it and does not send it, in the foreground or the background. There is no location permission prompt and no route history. Our notification provider ships an optional location feature and we keep it switched off, which is why iOS may still show a location description in the app listing. Location rules are checked only on browser clock-ins, as explained in section 2.
• Microphone, contacts, calendar on the phone, and health data: Never requested and never accessed.

We use the information we collect for various business and commercial purposes, including to:

• Provide, maintain, personalize, and improve the features and functionality of our Services.
• Calculate project margins, track budget milestones, and generate automatic client invoices based on your logged hours.
• Process payments, verify accounts, and manage subscriptions.
• Send administrative notifications, such as timesheet lock reminders, budget threshold alerts, and billing notices.
• Respond to support requests, gather feedback, and troubleshoot technical issues.
• Monitor and analyze usage patterns, detect security threats, and prevent fraudulent or abusive activities.
• Deliver product announcements, newsletters, and marketing communications (you can opt out at any time).

We do not sell, trade, or rent your personal information to third parties. We may share your information under the following circumstances:

• Client Portal Sharing: Our Services enable you to share specific, approved timesheet data, invoice records, and project progress with your clients. You have full, granular control over what data is shared.
• Service Providers: We share data with a short list of vendors who run parts of the Services for us. They are Clerk (sign-in and passwords), Convex (our database and file storage, which holds your time entries and receipt images), Paddle (payments and invoicing), OneSignal (push notifications to the mobile app), Sentry (crash and error reports), and Resend with Amazon SES (email delivery). Each of them may only use your data to do that job for us. Each is bound by contract to protect your data to the same standard set out in this policy, and none of them may sell it, share it for advertising, or use it for their own purposes.
• Team Admins: If your account belongs to a workspace managed by your employer or project contractor, your timesheets, rates, and logged hours are visible to workspace administrators.
• Legal Requirements: We may disclose information if required to do so by law, court order, or government regulation, or to protect the safety, rights, or property of TimeTracker, our users, or the public.

We do not sell your personal data, and we do not share it with advertising networks or data brokers. We do not use your time entries, receipts or client names to train advertising models or to profile you.

We implement robust administrative, technical, and physical security measures to safeguard your account info, financial sheets, and logged timesheets. Data is encrypted in transit using SSL/TLS and at rest using industry-standard AES encryption keys.

However, please note that no transmission of data over the internet or system storage can be guaranteed to be 100% secure. We encourage you to use unique, strong passwords and contact us immediately if you suspect any compromise of your account credentials.

Depending on your location, you may have specific rights regarding your personal information under the General Data Protection Regulation (GDPR) in Europe, or the California Consumer Privacy Act (CCPA) in the United States. These rights include:

• Right to Access: The right to request copies of the personal data we hold about you.
• Right to Rectification: The right to request that we correct any inaccurate or incomplete information.
• Right to Erasure: The right to request that we erase your personal data under certain conditions (the "right to be forgotten").
• Right to Restrict Processing: The right to request that we limit how we process your timesheet or account details.
• Right to Data Portability: The right to request that we transfer your collected data to another organization, or directly to you, in a structured format.

To exercise any of these rights, please contact our Data Protection Officer at privacy@timetracker.in. We will respond to your request within the legally mandated timeframes.

You can delete your account and your data yourself. You do not need to email us and you do not need to ask permission.

• From the mobile app: open the More tab, tap Delete account, type the confirmation phrase the screen shows you, and confirm.
• In a browser: sign in to the web app, open Settings, then the Profile tab, and use the Delete account card at the bottom.

Deletion happens straight away and it is final. We do not freeze or disable the account instead, there is no grace period, and support cannot bring it back. Your profile, your sign-in details, your personal settings and any workspace you chose to destroy during the flow all go with it.

Some things stay. A workspace you share with other people keeps its own business records, so time entries, timesheet approvals and invoices remain with that workspace, credited to "Deleted user" instead of your name. We also keep a small closure note with no name, email or photo in it, so the account cannot be silently reused. And we keep records the law requires us to hold, such as paid invoices for tax. The full breakdown of what goes and what stays is on our delete your account page.

You can also withdraw consent without closing your account. Turn off notifications in your phone settings, disconnect Google Calendar in your settings, unsubscribe from marketing email using the link in any message, or ask us for a copy or a deletion of specific data at privacy@timetracker.in.

If your account belongs to a workspace run by your employer, your employer controls that workspace's records. Deleting your account removes your personal profile, and we will tell you if your employer must act on the remaining work records.

We retain your personal data and time logs only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with our legal and tax obligations, resolve disputes, and enforce our agreements.

If you close your account or if your workspace is deleted, we delete or anonymise your data on the timeline set out in section 8, unless the law requires us to keep a record such as a tax invoice.

TimeTracker is a tool for work. It is not built for children and it is not directed at them. You must be at least 16 years old to create an account, or older if the law where you live sets a higher age for working or for agreeing to terms on your own.

We do not knowingly collect data from children. If you believe a child has given us personal data, write to privacy@timetracker.in and we will delete it.

We use cookies, web beacons, and similar tracking technologies to store your preferences, maintain active session status, and collect analytics about website traffic. You can adjust your browser settings to refuse cookies, but some parts of our platform may not function properly as a result.

The mobile app does not use cookies and does not carry any advertising or cross-app tracking technology. We do not ask for permission to track you across other companies' apps and websites, because we never do it.

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

For material changes, we will provide a more prominent notice (for example, by sending an email notification or displaying an alert banner in the user dashboard) before the changes become effective.

If you have any questions or concerns about this Privacy Policy or our privacy practices, please contact us:

• Email: privacy@timetracker.in
• Phone: +91 8147080980
• Company: Lemaistre Lab Technologies LLP, Bengaluru, Karnataka, India
• GSTIN: 29AAMFL2616H1Z5