Privacy Policy for Time Tracker

Last Updated: September 22, 2026

Introduction

Time Tracker ("we", "our", or "the app") is a time tracking application that helps you log and track time spent on projects. This Privacy Policy explains how we collect, use, store, and protect your information when you use our mobile application.

Developer Information

App Name: Time Tracker
Developer: Light of Data Ltd
Contact: support@lightofdata.earth

Information We Collect

1. Account Information

When you create an account or sign in to Time Tracker with your email and password, we collect:

• Your email address
• A unique user identifier associated with your account

2. Time Tracking Data

The app collects and stores the following information you create:

• Projects: Project names, descriptions, client associations, and hourly rates
• Clients: Client names and contact information you enter
• Tasks: Task names and project associations
• Time Entries: Start times, end times, descriptions, and associated projects/tasks
• Settings: Your app preferences and configuration

3. Google Calendar (Optional, Pro)

If you connect Google Calendar, Time Tracker asks Google only for permission to create its own calendars and manage the events in them (calendar.app.created). It cannot see or change any other calendar in your Google account.

Once connected:

• Each client you choose to sync gets its own calendar in your Google account, and each finished time entry becomes an event in it, with the project and task as its title, the entry's start and end times, and its notes as the description
• Events are updated when you edit an entry and deleted when you delete it. Changes you make in Google Calendar are not copied back into the app
• Time Tracker does not read the contents of any calendar. It knows the events it wrote from its own records, and the only thing it asks Google about is whether a calendar it created still exists, so that it notices one you have deleted

To keep your calendars up to date while the app is closed, the writing is done by our server (Supabase). We store:

• A refresh token from Google, the long-lived key that lets our server keep writing to these calendars, stored encrypted and used for nothing else
• The email address of the Google account you connected
• The IDs of the calendars and events we created, and their sync status

The token is revoked, and stops working, when you disconnect, when you delete your Time Tracker account, when you remove Time Tracker's access in your Google account, or 30 days after your Pro subscription ends. Syncing stops as soon as Pro ends.

Calendars and events already written stay in your Google account unless you choose to delete them. You can have Time Tracker delete a client's calendar when you untick or delete that client, or you can delete calendars and events yourself in Google Calendar.

Limited Use. Time Tracker's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google is not used for advertising, is not sold, is not sent to AI providers, and is not used to develop or train AI models.

4. Technical and Device Information

We may collect:

• Device type and operating system version (for app compatibility)
• App version information
• Error logs and crash reports (to improve app stability)

Crash reports and error logs are collected through Firebase Crashlytics, which receives a crash stack trace together with basic device and app information. The app does not use an analytics SDK, and we do not collect screen views, feature usage, or other behavioural analytics.

5. Local Storage

The app uses local storage on your device to:

• Cache data for offline functionality
• Store app preferences and settings
• Enable offline time tracking

6. Subscription and Purchase Information

Time Tracker offers an optional paid subscription. If you subscribe, we collect:

• Your subscription status, plan, and renewal or expiry dates
• Purchase history for this app, including transaction identifiers
• A pseudonymous app user identifier, which is the same account identifier used to store your time tracking data

We never receive or store your payment details. Card numbers, billing addresses, and similar payment information are handled entirely by Apple or Google as the seller of record, and are never sent to us.

We use RevenueCat to record which accounts hold an active subscription. When you sign in, the app sends your Time Tracker account identifier to RevenueCat so your subscription follows your account across your devices and can be restored after a reinstall. Your email address and name are not sent. RevenueCat also receives purchase and subscription details from Apple and Google, together with basic device and app information collected by its SDK.

Subscribing is optional. If you never subscribe, no purchase information is collected.

7. AI Summaries (Optional)

If you ask for an AI summary of a report, the names of the clients, projects and tasks in it and the notes of its time entries are sent to an AI provider to write the summary:

• With Pro, using our service: our server sends them to Anthropic, which processes them on our behalf. Under Anthropic's commercial terms, data sent through its API is not used to train its models
• With your own API key: the app sends them directly from your device to the provider you chose (OpenAI, Anthropic, Google Gemini or OpenRouter), under that provider's terms. Your key is stored only on your device, in its secure storage

Summaries are only generated when you ask for one; nothing is sent to an AI provider otherwise.

How We Use Your Information

We use the collected information to:

1. Provide Core Functionality: Enable time tracking, project management, and reporting features
2. Synchronisation: Sync your data across your devices using PowerSync and Supabase
3. Calendar Integration: Write your time entries to Google Calendar (when connected)
4. AI Summaries: Generate report summaries when you ask for one
5. Offline Functionality: Allow you to track time without an internet connection using local caching
6. Authentication: Verify your identity using your email and password
7. Improve Stability: Use crash reports and error logs to diagnose and fix bugs
8. Subscription Management: Determine whether your account has an active subscription, unlock paid features, and restore previous purchases

Data Storage and Security

Storage Location

Your data is stored:

• Cloud Database: Supabase (a secure PostgreSQL-based backend service)
• Local Device: Cached data using PowerSync (SQLite-based) for offline access and synchronisation
• Google Calendar: The calendars and events Time Tracker creates (only if you connect Google Calendar)

Security Measures

We implement industry-standard security practices:

• Encryption in Transit: All data transmitted between your device and our servers uses HTTPS/TLS encryption
• Authentication: Handled by Supabase Auth. Your password is sent to Supabase over an encrypted connection and is never stored by the app on your device
• Database Security: Supabase provides row-level security and encrypted storage
• Access Control: Your data is associated with your unique user ID and is not accessible to other users

Data Retention

• Active Accounts: Data is retained as long as your account is active
• Account Deletion: If you delete your account, all associated data is permanently deleted from our live servers immediately. Copies may persist in routine backups, which age out within 7 days, and are never restored to the live service. A confirmation email is sent to your account's confirmed email address as soon as the account is deleted — see how to delete your account and data
• Local Data: Cached data on your device is deleted when you uninstall the app or clear app data
• Email Delivery Records: Resend, which delivers our account emails, keeps a copy of each email and its delivery record (recipient address, subject, and send time) under its own retention policy — currently 30 days on Resend's standard plans. This includes the account-deletion confirmation email, so its copy and its delivery record remain with Resend after your account is deleted.
• Subscription Records: Purchase and subscription records are retained by RevenueCat and by Apple or Google for as long as required for billing, tax, and dispute-resolution purposes, which may be longer than the deletion and backup windows above. Deleting your Time Tracker account removes your data from our servers but does not cancel a subscription — cancel that through your Apple or Google account.

Data Sharing and Third Parties

We Do NOT

• Sell your personal information to third parties
• Share your data with advertisers
• Use your data for marketing purposes
• Access your calendar data without your explicit permission

Third-Party Services We Use

1. Supabase: For cloud data storage, synchronisation, and authentication (Supabase Privacy Policy)
2. Resend: For delivering account emails — sign-up confirmation, password reset, and account-deletion confirmation (Resend Privacy Policy)
3. PowerSync: For offline data synchronisation between your device and cloud database (PowerSync Privacy Policy)
4. Firebase Crashlytics: For crash reporting and app stability (Firebase/Google Privacy Policy)
5. Google Calendar API: Only when you connect Google Calendar (Google API Services User Data Policy)
6. Anthropic: For AI summaries generated by our service (Anthropic Privacy Policy)
7. The AI provider you choose: When you use your own API key for AI summaries, under that provider's own privacy policy
8. RevenueCat: For managing subscription status and restoring purchases (RevenueCat Privacy Policy)
9. Apple App Store and Google Play: As the payment processors and sellers of record for subscriptions (Apple Privacy Policy, Google Privacy Policy)

Each third-party service has its own privacy policy governing their use of your information.

Your Rights and Choices

Access and Control

You have the right to:

• Access Your Data: View all your time tracking data within the app
• Edit Your Data: Modify or update your projects, clients, tasks, and time entries
• Delete Your Data: Delete individual entries or request complete account deletion — see how to delete your account and data
• Export Your Data: Export your time tracking data (functionality may vary by version)

Calendar Sync Control

You can:

• Connect or disconnect Google in Settings → Integrations → Calendar Sync
• Choose, per client, whether its entries are synced
• Revoke calendar access through your Google account settings

Granting calendar access is the only thing Time Tracker uses your Google account for — it is not how you sign in. To revoke that access:

1. Visit your Google Account settings
2. Find "Time Tracker" in the list of apps
3. Click "Remove Access"

Children's Privacy

Time Tracker is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately, and we will delete that information.

International Data Transfers

Your data may be stored and processed in servers located in different countries where Supabase operates. By using the app, you consent to the transfer of your information to countries outside your country of residence, which may have different data protection rules.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make changes:

• We will update the "Last Updated" date at the top of this policy
• Significant changes will be communicated through the app or via email
• Your continued use of the app after changes constitutes acceptance of the updated policy

Data Breach Notification

In the unlikely event of a data breach that affects your personal information, we will:

• Notify affected users within 72 hours of discovering the breach
• Provide details about what information was compromised
• Explain steps we are taking to address the breach
• Advise you on actions you can take to protect yourself

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Email: support@lightofdata.earth

For help using the app, see Time Tracker Support.

Legal Compliance

This app complies with:

• GDPR (General Data Protection Regulation) for users in the European Union
• CCPA (California Consumer Privacy Act) for users in California
• Google Play Developer Policies
• Google API Services User Data Policy (for Calendar API usage)

Your GDPR Rights (for EU users)

Under GDPR, you have the right to:

• Request access to your personal data
• Request correction of your personal data
• Request erasure of your personal data
• Object to processing of your personal data
• Request restriction of processing your personal data
• Request data portability
• Withdraw consent at any time

To exercise these rights, please contact us using the information above.

Consent

By using Time Tracker, you consent to this Privacy Policy and agree to our Terms of Use.