Privacy Policy

1. Information we collect

Account information

• Your first name, last name and email address.
• If you register with email, a password, which we store only as a one-way hash. We also store a temporary code used to verify your email address.
• If you sign in with Google or GitHub, your account ID with that service, name, email address and profile picture URL (see section 3).

Activity data from the browser extension

When tracking is turned on, the extension records the domain of the active browser tab (for example, github.com), its category, and when you started and stopped using it. It does not record full URLs, page paths, query strings, page titles, page contents, form input, keystrokes or screenshots. Time is not counted while your device is idle.

Activity data from the desktop app

When tracking is turned on, the desktop app records the name of the applicationin the foreground (for example, "Visual Studio Code"), its category, and start and end times. The app reads window titles on your device only to help choose a category; window titles are not uploaded to our servers. The desktop app also syncs focus sessions (mode, status, start and end times, duration, and the associated app and category) and your app settings, such as focus durations and goals.

Data you create

Goals, custom category assignments for websites or apps, and preferences you save in the Service.

Technical data

The extension and desktop app report connection status, platform (e.g. Windows), browser name, app version and last sync time so you can see and control connected devices from your dashboard. Our hosting providers keep standard server logs (such as IP address, request time and user agent) for security and reliability.

The website uses browser storage (cookies and local storage) only to keep you signed in and to remember preferences such as light or dark theme. We do not use advertising or cross-site tracking cookies.

2. How we use information

• To create and secure your account and sign you in across the website, desktop app and extension.
• To show your timeline, analytics, goals and focus history.
• To send account emails, such as verification codes and password resets.
• To keep the Service working, secure and free of abuse, and to fix problems.
• To comply with legal obligations.

We do not sell, rent or trade your personal information, and we do not use your activity data for advertising or to build profiles for third parties.

3. Google and GitHub sign-in

If you choose "Sign in with Google", we request only the openid, email and profile scopes. We receive your Google account ID, name, email address, email verification status and profile picture URL, and we use them only to create your TimeLet account and sign you in. We do not request access to your Gmail, Drive, Calendar, contacts or any other Google data.

TimeLet's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to others except as needed to provide the Service, for security, or as required by law; we do not use it for advertising; and no human reads it unless you ask us to for support, it is needed for security, or the law requires it. You can revoke TimeLet's access at any time from your Google Account permissions page.

If you choose "Sign in with GitHub", we request only the read:user and user:emailscopes. We receive your GitHub user ID, username, display name, profile picture URL and your verified primary email address, and we use them only to create your TimeLet account and sign you in. We do not access your repositories, code or organizations, and we do not keep your GitHub access token after sign-in. You can revoke TimeLet's access at any time from your GitHub authorized applications page.

4. How we share information

We share information only with service providers that help us run TimeLet, under their own privacy and security terms:

• Vercel — hosting for the website and API.
• Neon — PostgreSQL database hosting.
• Google — Google sign-in, if you choose to use it.
• GitHub — GitHub sign-in, if you choose to use it.
• Our email delivery provider — to send account emails.

We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy will continue to apply to your data.

5. Data retention and deletion

We keep your account and activity data for as long as your account is active. When you delete your account, your profile, activity history, focus sessions, goals, settings and device records are permanently deleted from our database. Copies in backups are removed as those backups expire. Data stored locally by the desktop app or extension stays on your device until you uninstall it or sign out.

6. Your choices and rights

• Pause or resume tracking at any time from the extension, the desktop app or your dashboard.
• Disconnect the extension or desktop app from your dashboard, or uninstall them.
• Change how websites and apps are categorized.
• Request a copy of your data, correction, or deletion of your account by emailing queryfortimelet@gmail.com.

Depending on where you live (for example, the EU, UK or California), you may have additional rights, such as to object to or restrict processing, or to lodge a complaint with a data protection authority. We will respond to requests within 30 days.

7. Security

Data is encrypted in transit using HTTPS. Passwords are hashed, API access uses signed tokens, and access to production systems is restricted. No system is perfectly secure, but we work to protect your information and will notify you of a breach where the law requires.

8. International transfers

Our providers may process data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards for these transfers.

9. Children

TimeLet is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date above and, for significant changes, notify you by email or in the app before they take effect.

11. Contact

Questions about privacy? Email queryfortimelet@gmail.com. See also our Terms of Service.