Privacy policy

1. Who we are

Timepora is a time tracking service operated by NashSaint, based in Cardiff, United Kingdom. In this policy, “we”, “us”, and “our” mean NashSaint. We are responsible for the personal data described here as its data controller.

This policy covers the Timepora website, your account, the time tracking service and its connected clients, and support communications. For privacy questions or requests, use our contact form and choose “Privacy or account deletion request”. We reply to the email address you provide.

2. Information we collect

• Account details: your name, email address, password hash, email verification status, and account preferences such as time zone, currency, and display settings.
• Work records: the projects, client labels, tasks, ticket URLs, notes, tags, start and stop times, durations, billable status, rates, saved report views, and changes to time entries that you save.
• Authentication information: session records, device or client token names, authentication tokens, and, when you enable MFA, your chosen method, authenticator secret, recovery code hashes, and information needed to prevent code reuse. Temporary email codes and login challenges are also processed.
• Optional connections: the credentials and account identifiers you provide for GitHub, Linear, or Jira, together with details of the issues or other resources you request. For a connected calendar, we process its subscription URL and event information such as titles, times, descriptions, and locations available in the feed.
• Technical information: IP addresses, browser or device information, request times, error details, and authentication or security events where recorded by the service or its hosting infrastructure.
• Support correspondence: your contact details, messages, and any attachments or diagnostic information you choose to send.

Most information comes directly from you or from your use of Timepora. Connected services supply the information you authorise us to access. Avoid putting sensitive personal information or unnecessary information about other people in notes, project names, or support messages.

3. How and why we use your information

Where UK data protection law applies, we rely on the following legal bases:

• Providing the service — performance of a contract: creating your account, storing and displaying your work, calculating time and reports, syncing your workspace between clients, fulfilling exports, and providing the optional connections you request.
• Account communications — performance of a contract: sending verification links, password reset links, email security codes, and essential service messages.
• Security and reliable operation — legitimate interests: preventing fraud and misuse, diagnosing faults, protecting accounts, and maintaining the service. Our interest is in operating a dependable service while limiting access and data use to what is needed.
• Support — performance of a contract or legitimate interests: answering account questions and resolving problems, or responding to enquiries from people who do not yet have an account.
• Legal requirements — legal obligation: responding to valid legal requests and meeting applicable recordkeeping or data protection duties.

Where an optional activity requires consent, we will ask before carrying it out. You can withdraw that consent without affecting earlier lawful processing. Core account and work information is needed to provide the features you request; optional integrations can be disconnected.

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

4. Sharing and connected services

We use service providers to host and operate Timepora and deliver account emails. Amazon Web Services Simple Email Service (AWS SES) processes recipient addresses and email content to deliver verification, password reset, and other service emails. Hosting, database, backup, and diagnostic providers may process information needed to operate and protect the service.

The website loads some fonts from Bunny Fonts. Your browser sends the network information needed to retrieve those files, including your IP address and browser request information, to that provider.

If you connect GitHub, Linear, Jira (Atlassian), or a calendar feed, Timepora sends the credentials or requests needed to retrieve the information you ask to see. These providers operate under their own privacy policies. Connecting an integration is optional. Disconnecting removes the saved connection from Timepora; revoking a provider-issued token requires action with that provider.

People who receive a report or export from you will receive the information you choose to share. We may also disclose information where required by law, to protect legal rights or prevent abuse, or as part of a business transfer subject to appropriate confidentiality and data protection requirements.

We do not sell personal data or share it with advertising networks for targeted advertising. External websites linked from Timepora are responsible for their own data practices.

5. Cookies and storage on your device

Timepora uses session and security cookies to keep you signed in and protect requests against forgery. A “remember me” choice can keep you signed in for longer. Session duration depends on the service’s session settings and whether you ask to be remembered.

The web workspace also uses local storage to coordinate idle detection and timer reminders across tabs and to avoid repeating the same notification. This can include account or entry identifiers and activity timestamps; it does not capture the contents of what you type. A connected client may store an authentication token so it can access your account.

We do not currently use advertising cookies or third-party behavioural analytics in the Timepora web application. If that changes, we will update this policy and seek consent where required. You can clear cookies and site storage through your browser, but doing so may sign you out or reset local reminder state. Desktop notifications are optional and can be disabled in your browser or device settings.

6. How long we keep information

We retain account and work records while your account is active so you can use your tracking history. Archiving a project or task keeps its history; it does not delete the account or its records. Entry changes may remain in the work history even after an entry is edited or removed.

Connection credentials are retained until replaced, disconnected, or removed with your account. Temporary authentication codes and challenges expire after their short validity period. Security and diagnostic records are kept for the period needed to investigate problems, detect misuse, and meet applicable legal requirements. Support correspondence is kept for handling the enquiry and any related follow-up or dispute.

When assessing retention, we consider the purpose of the record, its sensitivity, whether a dispute or security investigation remains open, and applicable legal requirements. Account deletion requests are reviewed under those criteria. Information subject to a legal retention requirement is restricted to that purpose. Residual backup copies may remain until their normal replacement cycle and are not used as active account records. Contact us if you need the retention details relevant to a particular request.

7. Security and administrator access

Passwords are stored as hashes. Saved integration tokens, authenticator secrets, and calendar subscription URLs are encrypted in the application’s storage. MFA is available to add protection to your account. These measures reduce risk, but no service can guarantee absolute security.

Authorised administrators can view account details and use an impersonation feature to access a user’s workspace for administration, support, or troubleshooting. This can expose work records to the administrator. The application displays an impersonation banner during that session. MFA settings cannot be managed while impersonating another user.

Protect your password, recovery codes, and connected-service credentials. If you suspect unauthorised access or a vulnerability, use the contact form and choose “Security report”.

8. International processing

We operate from the United Kingdom. Service providers and the external tools you connect may process information in other countries, whose data protection rules may differ from those where you live.

Where a transfer is restricted by UK data protection law, an applicable legal transfer mechanism is required, such as UK adequacy regulations or approved contractual safeguards. You can contact us for information about the providers, processing locations, and safeguards relevant to your personal data.

9. Your rights and account deletion

Depending on your location and the law that applies, you may have rights to:

• Access your personal data and receive a copy.
• Correct inaccurate or incomplete information.
• Request deletion of your personal data and closure of your account.
• Restrict processing in certain circumstances.
• Object to processing based on legitimate interests.
• Receive data you provided in a portable format where applicable.
• Withdraw consent where processing relies on consent.

Some rights have exceptions, including where information is needed for a legal obligation or legal claim. You can edit your profile name, manage work records, disconnect integrations, and export time entries within Timepora. For account deletion, a full data request, or changes you cannot make yourself, use the contact form with your registered email address, choose “Privacy or account deletion request”, and explain your request.

We may need proportionate information to verify your identity. We respond within the time limits of the law that applies; UK GDPR requests are normally answered within one month, with permitted extensions for complex or multiple requests. We will explain any extension or refusal and any applicable exception.

You can raise a concern with us at any time. You also have the right to complain to your local data protection authority. In the United Kingdom, this is the Information Commissioner’s Office (ICO).

10. Children’s privacy

Timepora is designed for managing work and is not directed at children under 13. We do not knowingly collect their personal data. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action. Higher age or consent requirements may apply where you live.

11. Changes and contact

We update this policy when the service or its data practices change. The date at the top identifies the latest version. Where required, we will bring material changes to your attention before they take effect.

For privacy requests, deletion requests, or questions about this policy, use the contact form. For product help, visit Timepora support.