This Privacy Policy explains how Hoursmith collects, uses, and protects data when you use the product to track time, manage clients and projects, send invoices, and collect payments.
What we collect
- Account data: your email, name, organization name, and timezone.
- Workspace content: clients, projects, tasks, time entries, and invoices you create. We store this so the product can show it back to you.
- Billing and payment data: Stripe handles subscription billing for your Hoursmith plan, and Stripe Connect handles online invoice payments into your connected Stripe account. We store Stripe identifiers, plan status, invoice payment status, and webhook event ids. We never see or store card numbers, CVCs, or bank-account credentials.
- Operational logs: server logs (request paths, status codes, error traces) and email-send records.
- Abuse-prevention metadata: when an endpoint uses an IP-based rate limit, the caller address is immediately converted to a keyed one-way identifier. General limits keep only that identifier in bounded process memory. Extension token/API and private-file upload limits keep one compact fixed-window counter in PostgreSQL so every application replica shares the same budget. The limiter does not retain the raw address. An expired database counter is normally removed by the next bounded hourly maintenance run.
- Browser-extension data: if you install an Hoursmith browser extension, it receives the account, membership, workspace, timer, task, expense, invoice-summary, and activity data that your existing Hoursmith role permits. It also creates a revocable browser-device grant and uses short-lived access and rotating refresh credentials. The extension does not ask you to create or paste an API token.
- Page context you choose to capture: only after you press "Use this page" or invoke the Hoursmith context-menu action, the extension reads the active page's title, sanitized HTTP(S) URL, sanitized HTTP(S) favicon URL, and up to 8,000 characters of selected plain text. You can review and edit the preview before saving it to Hoursmith.
- Receipts you choose to upload: the extension can request permission for one exact storage host after you select an expense-receipt image or PDF. Denying that optional permission does not block timers, tasks, or other core extension features.
- Support chat: when Intercom is configured, marketing visitors can start an anonymous chat and signed-in users can contact support from inside the app. For signed-in chat we send Intercom your account email, name, opaque user id, workspace name/id, role, plan, and whether the workspace has priority-support routing. Intercom stores the messages and Messenger metadata needed to run that support conversation.
- Product analytics: when configured, and only after you allow analytics in the site banner, we send a small set of named events to PostHog — page views, CTA clicks, plan selections, and coarse collection-query usage. Collection-query events contain only the collection type, number of active filter dimensions, approved sort key, and mobile/tablet/desktop class. They never contain search text, selected filter values, record IDs, names, amounts, or dates. The full event list is in our public source code at
src/lib/analytics/events.ts. We never send your email, name, phone, address, or any password / token. After you sign in we identify your session by your account's opaque UUID — not your email. Page views contain a pathname only: query strings are stripped, and authorization, recovery, invitation, public-invoice, and client-portal routes are excluded. Users with the "Do Not Track" signal enabled are excluded automatically.
Connected AI apps
If you choose to connect Hoursmith to ChatGPT, OpenAI receives the tool results needed for your requests from the selected workspace. These can include account and workspace labels, clients, projects, tasks, time, expenses, invoices, members, and permitted private payout summaries. Your current role, project access, plan, and approved read-only or read/write permissions remain authoritative. Passwords, token secrets are not returned by these tools. Configured invoice bank/payment snapshots and private receiving-method details are omitted; user-entered notes may still contain personal data. OpenAI handles the data it receives under its own policies; disconnecting cannot retract results already shared.
We store the selected membership, scopes, hashed authorization and refresh credentials, expiry and revocation metadata, and bounded encrypted refresh-recovery material. Hosted writes retain a grant-scoped requestId, payload hash, and confirmed response for duplicate recovery. An unknown outcome remains reserved and is never automatically executed again. Expired or revoked grants cannot authorize access. OAuth and MCP requests use compact PostgreSQL rate-limit counters; logs omit credentials, request payloads, and returned records.
Authorization codes expire after five minutes, access tokens after 15 minutes, and refresh tokens after 30 days; a successful refresh renews the connection for 30 days. Encrypted successor recovery is usable for only 30 seconds and is normally removed by the next hourly maintenance run. Unexchanged authorizations are eligible for removal one day after the code expires. Unused refresh credentials are eligible for removal seven days after expiry; refresh credentials belonging to expired or revoked connections are eligible seven days after the connection expires or is revoked. Used refresh-token hashes and all write receipts, including unknown outcomes, remain while the connection remains active to prevent reuse and duplicate changes. Connection records and their write receipts are eligible for removal 90 days after expiry or revocation. They are removed sooner if the associated membership is removed. Cleanup uses bounded hourly maintenance, so a backlog can delay physical deletion without restoring access or extending the recovery window.
Changing task assignees through this connection can send the existing task-assignment notifications. According to each recipient's notification preferences, their configured email provider or linked Telegram account can receive the actor name, task name, workspace name, and task link. Recipients control these optional channels in their account notification settings.
Use Account → Security → Connected apps to revoke a connection. This immediately invalidates its access and refresh credentials and does not delete saved workspace content. Review proposed changes and explicitly confirm destructive actions before authorizing them.
What we don't collect
- Card numbers, CVCs, or expiry dates. Stripe handles all payment data.
- The extension does not capture full pages, screenshots, form fields, passwords, cookies, ongoing browsing history, background tabs, or page context without an explicit capture gesture. The current-page URL and title chosen through that gesture are disclosed as Web history in the Chrome Web Store questionnaire. The extension has no history API or always-running content script.
- The extension does not run advertising trackers or product analytics, and does not provide AI, BYOK, MCP, arbitrary external-tool, or client-portal access.
- We don't sell your data or share your workspace content for advertising.
How we use it
We use the data above only to operate the product — show you your workspace, send invoices on your behalf, process your subscription, reconcile invoice payments, protect the service from abuse, and respond to support requests.
Browser-extension storage and retention
Chrome local storage holds the opaque device id, approved workspace credentials, selected workspace, interface preferences (including up to ten recent searches), a bounded cache for at most three device grants, and ordered offline timer/note commands. Cached and queued data is keyed by the approved grant so it cannot be inherited by a different account that later connects to the same workspace in the same browser profile. Chrome does not sync this storage through your Chrome account.
A page-capture preview is held separately in Chrome session storage. The extension rejects it after one hour and clears it when the relevant connection is disconnected. If you save the preview, the resulting task, time entry, or expense becomes ordinary workspace content and follows that record's retention and deletion rules.
To prevent a duplicate if a save succeeds but both network responses are lost, Chrome local storage also holds at most 20 mutation-recovery markers for no more than 24 hours. A marker contains the approved grant and workspace, operation, request id, timestamp, and a SHA-256 fingerprint; it does not contain task, expense, client, project, or time-entry form content. A definitive response or grant removal deletes the marker.
Receipt retry recovery uses a separate set of at most 20 Chrome-local markers for no more than 24 hours. Each contains the approved grant and workspace, opaque committed file id, timestamp, and a SHA-256 fingerprint derived from the receipt type, byte count, and file contents. It never stores receipt bytes or the filename. A confirmed expense response or grant removal deletes the marker.
Pending, failed, or unattached receipt uploads are normally reclaimed after the server's 24-hour cleanup grace period. A receipt attached to a saved expense follows workspace file-retention, permission, deletion, and invoice-lock rules.
An extension consent grant that is never exchanged is normally removed one day after its code expires. Command idempotency records are retained for 35 days, obsolete refresh-token rows for seven days after expiry or revocation, and expired or revoked device grants for 90 days. The workspace activity record of a device authorization or security event follows the workspace's normal audit retention.
Your data, your call
You can, at any time:
- Export: download a JSON copy of every workspace row from
/settings → Download all data. - Delete: close your workspace from
/settings → Delete organization. We immediately cancel your Stripe subscription, clear stored email-provider credentials, and soft-delete the workspace data so it no longer appears in the product. Hard deletion of retained rows is handled by support request. - Disconnect an extension device: use the extension options or Account → Security. This revokes that browser grant and removes its credentials, cache, offline commands, mutation and receipt recovery markers, and pending capture from Chrome. It does not delete saved workspace content. General interface preferences, recent searches, and the opaque device id remain until you clear the extension's storage or uninstall it. Revoked security/audit records can be retained on the server, but cannot authorize access.
Subprocessors
- Stripe — payment processing.
- Your email provider — when you bring your own SMTP / SES / Resend credentials, that provider receives the outbound message.
- Telegram — if you link your Telegram account and enable a notification channel, Telegram receives the notification content and destination chat identifier needed to deliver it. You can change notification preferences or disconnect the account.
- PostHog — product analytics (when configured). Event properties exclude email, name, phone, address, and password / token fields by construction. Session recording is disabled. We use localStorage rather than third-party cookies. Analytics starts only after you allow it in the site banner; you can opt out by declining there or by enabling "Do Not Track" in your browser.
- Intercom — support chat and Messenger delivery (when configured). Marketing chat can be anonymous. Signed-in chat is authenticated with Intercom Messenger Security so users cannot impersonate another account.
- Hosting, database, and private object storage — the cloud providers used to run Hoursmith and store workspace files such as user-selected receipts. Their sub-processor lists apply.
Security
Detailed practices are in /security. Tap that link before asking for a security questionnaire.
Contact
Email hi@hoursmith.app with any privacy question or request.