Privacy Policy

Data controller

The data controller is Yao Elom ESSAN, sole proprietor (micro-enterprise), who operates the TimeTrack brand (SIREN 533 607 271, headquarters SIRET 533 607 271 00020, APE code 70.22Z), 41 rue Berger, 75001 Paris, France. Contact: contact@simpletimetrack.com

1. Data collection

TimeTrack collects the following data to provide its services:

• Identity data (name, email, hashed password)
• Connection data (IP address, access logs)
• Time entry data (timesheets, projects, hours worked)
• Billing data (subscriptions, payments via Stripe)

2. Use of data

Your data is used to:

• Provide and improve our services
• Manage your account and subscriptions
• Process payments and generate invoices
• Send you important notifications
• Comply with our legal obligations

3. Data protection

We implement appropriate security measures to protect your data:

• Password encryption (bcrypt)
• Two-factor authentication (2FA) available
• Secure connections (HTTPS)
• Restricted data access (multi-tenant)
• Regular backups

4. Data sharing

We do not sell your data. We may share your data with:

• Stripe: For payment processing (PCI-DSS compliant)
• Resend: For transactional emails
• Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA: application hosting
• Prisma: For database management
• Sector benchmarks (opt-in): anonymized aggregated metrics — never identifiable firm data, k-anonymity ≥ 5 firms per segment

All our providers are GDPR compliant and sign confidentiality agreements.

5. Your rights

In accordance with the GDPR, you have the following rights:

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure of your data
• Right to data portability
• Right to object to processing
• Right to restriction of processing

To exercise these rights, contact us at: contact@simpletimetrack.com

6. Google user data

If you choose to connect Google Calendar from Settings → Calendar, TimeTrack requests Google OAuth access (read-only) to power optional timesheet suggestions. Connecting is optional; the rest of TimeTrack works without it.

• Google Calendar, read-only (https://www.googleapis.com/auth/calendar.readonly): TimeTrack calls the Google Calendar API (events.list on your primary calendar) for a rolling window of the past 7 days through the end of today. For each event it may keep only the event ID, title, start time, end time and duration. It skips cancelled events, all-day events, events shorter than 15 minutes or longer than 12 hours, and personal-looking titles (for example lunch, vacation, OOO). It does not read attendees, descriptions, locations or attachments, and it never creates, edits or deletes calendar events.
• Your Google account email (https://www.googleapis.com/auth/userinfo.email): requested once after connect, only to display which Google account is linked in Settings (for example “Connected as name@company.com”).

What we store. Encrypted OAuth access and refresh tokens (AES-GCM at rest), the connected account email, and calendar suggestion records (event ID, date, title, duration, optional suggested project, status). Suggestions appear on your timesheet for you to review. If you apply a suggestion, TimeTrack creates or updates a normal timesheet entry in your account (date, hours, project, description = event title). Nothing is written back to Google Calendar.

How we use it. Only to provide the calendar-suggestion feature you turned on for your own account. We do not sell Google user data, do not use it for advertising, do not share it with other apps for advertising or unrelated purposes, and do not use it to train generalized AI or machine-learning models. Google user data is processed by the sub-processors that host and run the service (Vercel, Prisma/PostgreSQL) only for that purpose, or when required by law. Our staff do not read your calendar data unless you ask for support and give consent, it is needed for security, or the law requires it.

Retention and deletion. When you disconnect Google Calendar in Settings → Calendar, or revoke TimeTrack’s access at myaccount.google.com/permissions, TimeTrack best-effort revokes the Google OAuth token and deletes the stored encrypted tokens, the connected account email, and all calendar suggestion records for Google (including pending, dismissed and applied suggestion metadata). Timesheet entries you already applied remain in your account as your own data and are no longer linked to Google Calendar. You can also request deletion by writing to contact@simpletimetrack.com.

Limited Use. TimeTrack's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Data retention

Your data is retained for the duration of your subscription and up to 3 years after account closure, in accordance with our legal and accounting obligations. This retention rule does not apply to Google OAuth tokens or Google Calendar data (including calendar suggestion records derived from Google events): those are deleted when you disconnect Google Calendar or revoke access, as described in section 6.

8. Cookies

We use session cookies to maintain your authentication. These cookies are essential for the application to function and are not used for tracking purposes.

9. Modifications

We reserve the right to modify this privacy policy. Any changes will be communicated by email and published on this page.

10. Contact

For any questions regarding this privacy policy, contact us at: contact@simpletimetrack.com