Privacy Policy

Last updated: July 11, 2026

Time Trakkr (“we”, “us”) provides time tracking, approvals, reporting, and invoicing software at timetrakkr.com. This policy explains what we collect, why, and the choices you have. The short version: we collect what the product needs to work, we don’t sell it, and your workspace’s data belongs to your organization.

What we collect

• Account data — name, email, and password hash (or Google sign-in identifiers) for authentication.
• Workspace data — the time entries, projects, clients, rates, expenses, invoices, and approvals your team creates or imports (including data imported from Harvest at your request).
• Integration data — when you connect Google Calendar, we read events from your primary calendar (read-only) to draft time entries. Calendar access tokens are stored encrypted and can be disconnected any time.
• Waitlist requests — name, company, and email you submit when requesting an invite, used only to respond to your request.
• Usage basics — server logs (IP, timestamps, requests) for security and reliability. We do not run third-party advertising trackers.

AI features

The Ask assistant and Magic fill send the text of your request, plus the minimum workspace context needed to answer (for example project names or aggregated hours), to Anthropic’s Claude API for processing. Voice input is transcribed by your browser’s built-in speech service and reaches us as text. AI answers are computed from your own workspace data; we do not use your data to train models. If you connect an external AI over MCP, that AI accesses your workspace under the permissions you grant on the consent screen, and you can revoke the connection at any time.

How we use data

To operate the product, secure it, provide support, send transactional email (invites, approvals, reminders, import notifications), and improve reliability. We do not sell personal data, and we only email waitlist contacts about their request.

Sharing

We use service providers to run Time Trakkr: Railway (hosting, US), managed PostgreSQL storage, Resend (email delivery), Anthropic (AI processing), and Google (sign-in and calendar, where you enable them). Each processes data only to provide their service. We disclose data if required by law, and workspace data is always available to your organization’s administrators.

Retention and deletion

Workspace data is retained while your organization’s account is active. Your organization can export its data at any time and can request deletion of the workspace, which removes it from production systems within 30 days. Waitlist requests are deleted on request (“Remove my request” in the confirmation email).

Security

Data is encrypted in transit (TLS) and at rest; integration tokens are additionally encrypted at the application layer; every workspace is isolated with database row-level security. Access is invite-only and role-based.

Your rights

You may access, correct, export, or delete your personal data, subject to your organization’s role as the controller of workspace data. Contact us at [email protected] and we’ll respond within 30 days.

Changes

We’ll post updates to this policy here and, for material changes, notify workspace administrators by email.

Contact

Time Trakkr · [email protected]