Track time, not you.

Information We Collect

We collect only the information necessary to authenticate users, operate timers, attribute work to the correct tenant, and bill for the Service.

Account & Identity

When you sign in with your Microsoft work or school account through MSAL, Azure Active Directory provides us an identity token. From that token we read and store:

• Email address (used as your unique identifier)
• Display name (where present in the token)
• Azure AD tenant identifier
• Authentication provider (“microsoft” or “manual”)
• Role (user, admin, organization admin), active status, who invited you, first and last sign-in timestamps

Tenant & Organization

• Organization name and slug, Azure AD tenant ID, Azure DevOps organization name
• Administrator email, chosen plan (trial, internal, paid), per-user rate, seat limit
• Trial start/end dates, Azure Marketplace subscription ID, user-count snapshot at purchase

Usage & Timer Data

• Email of the user who performed the action
• Azure DevOps organization, project and work item identifiers the timer is attached to
• Start time, stop time, elapsed duration (ms), and existing hours captured at start
• Timer log of start/stop actions with timestamps, and in-product action log (action type and page)

Work Item Metadata

We read work item ID, type, title, assignee name and state from your own Azure DevOps organization through the Microsoft REST API, using the access token you provide at sign-in. We cache it solely to display it back to you in reports.

Billing Records

For paid tenants we generate monthly billing records containing the tenant ID, Azure Marketplace subscription ID, plan, list of active-user emails, active user count, rate per user, computed total, billing month, and the subscription lifecycle event type from Microsoft. We do not store credit card numbers or any other payment instrument.

How We Use Your Information

Your data is processed solely to deliver and operate the TimeTracker service.

We do not sell or share personal data for marketing or advertising.

Cookies & Browser Storage

TimeTracker does not use advertising cookies or third-party tracking pixels. The Service relies on two browser storage mechanisms:

• sessionStorage (MSAL token cache): Microsoft Authentication Library caches your ID and access tokens so you do not have to sign in on every page navigation. Cleared when you close the tab.
• localStorage (theme preference): A single value that records your light or dark theme preference.

Microsoft may also set cookies as part of the Azure AD sign-in flow; those cookies are governed by Microsoft’s privacy statement.

Data Storage & Retention

• Data is stored on Microsoft Azure (Azure SQL Database, Azure App Service) in the region we have configured.
• User accounts: retained until deactivated by a tenant administrator. Deactivated accounts and historical timer logs are kept for audit and billing reconciliation.
• Timer logs, action logs, active timers: retained for the lifetime of the tenant unless explicit deletion is requested.
• Billing records: retained for the period required by tax and accounting law (typically seven years).
• Trial tenants: data is retained after trial expiry to allow upgrade without data loss; deletion may be requested at any time.

Data Sharing & Access

We only share data under strict conditions:

• Tenant administrators: Users with the admin or super_admin role can see timer logs, action logs and active timers of users in their tenant to manage time and billing.
• Subprocessors: Microsoft Corporation through Azure Active Directory, Azure SQL Database, Azure App Service, Microsoft Graph, Azure DevOps REST API, and Azure Marketplace SaaS Fulfillment & Billing API.
• Legal authorities: Only when required to comply with a valid court order, subpoena or regulatory request.
• Successors: In the event of a merger, acquisition or asset sale, with prior notice to affected users.

No third-party advertising or analytics SDKs are embedded in TimeTracker.

Payment Information

Paid subscriptions are purchased through the Microsoft Azure Marketplace. Microsoft is the merchant of record; we do not see, receive or store credit card numbers, bank details or any other payment instrument. Our database stores only the marketplace subscription ID, plan ID, operation ID, event type, seat quantity and the computed monthly total used to generate invoices.

Security Measures

We apply multiple layers of security consistent with Microsoft and ISO 27001 best practices:

• All traffic between your browser and the TimeTracker API is forced over HTTPS (TLS).
• Database connections are encrypted in transit.
• Authentication is delegated to Azure Active Directory we do not store user passwords.
• API requests are authorised through short-lived bearer tokens issued by Azure AD and validated on every call.
• Inbound Microsoft billing webhooks are cryptographically validated against Microsoft’s public signing keys before any state change.
• Our Azure infrastructure inherits Microsoft’s ISO 27001, SOC 2 and ISO 27018 controls.

If we become aware of a personal data breach affecting your information, we will notify affected users and, where required, the relevant supervisory authority within the timelines set by applicable law.

Your Rights (GDPR, CCPA, India DPDP)

Subject to your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your account and associated personal data
• Object to or restrict certain processing activities
• Receive a portable copy of the personal data you have provided to us
• Withdraw consent where processing is based on consent
• Lodge a complaint with your local data protection authority

EU/UK users have the additional right not to be subject to a decision based solely on automated processing TimeTracker does not engage in such automated decision-making. California residents have the right to know, delete, correct, opt out of sale/sharing, and limit the use of sensitive personal information; we do not sell or share personal information for cross-context behavioural advertising. For users in India, QServices IT Solutions acts as a Data Fiduciary under the Digital Personal Data Protection Act, 2023, and you may nominate another individual to exercise your rights in the event of your death or incapacity.

AI & Data Training Usage

TimeTracker does not embed any large language model or other artificial intelligence service in the product, and we do not use your personal data, timer logs or work item metadata to train machine learning models. No customer data is shared with OpenAI, Anthropic, Azure OpenAI or any similar provider.

Children’s Privacy

TimeTracker is a business productivity tool that is not directed at children. We do not knowingly collect personal information from anyone under the age of 16 (or the equivalent minimum age in the relevant jurisdiction). If you believe that a child has provided us with personal information, please contact us and we will delete it.

International Data Transfers

TimeTracker is hosted on Microsoft Azure. Depending on the region in which our backend and database are deployed, your data may be processed in countries outside your country of residence, including India, the European Union and the United States. Where data is transferred out of the EEA, the UK or other regulated jurisdictions, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum and Microsoft’s Data Protection Addendum to provide an adequate level of protection.

Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or for other operational reasons. When we make material changes, we will update the “Last Updated” date and, where appropriate, notify you through the Service or by email. Your continued use of TimeTracker after the changes take effect constitutes acceptance of the revised Policy.

Contact Us

For any privacy-related questions or concerns, reach out anytime.