Privacy policy

This policy explains what Timerfly ("we", "us") collects when you use timerfly.com, the Timerfly web app (my.timerfly.com) and the Timerfly desktop app, and what we do with it.

Who decides what is tracked

Timerfly is used by companies ("customers") to record their own team's working time. The company decides whether its people use Timerfly and which optional features are on (such as screenshots and window titles). For the activity data of a company's employees, the company is the data fiduciary (the one that decides why and how it is processed) and we process it on the company's behalf, under our Terms of service. If you are an employee, questions about why your company tracks time are best asked to your company; you can also write to us.

What we collect

Account details

• Name and email address; the contact number of whoever signs the company up (so we can help with setup); a password (stored only as a one-way hash); and the two-step sign-in secret if you turn it on.
• If you start creating an account and don't finish, we keep the email address you typed and may send you one reminder about it.
• Your company's name, time zone, work schedules, departments and settings.
• Sign-in records for security: IP address, browser or device, and when.
• If your company lists its office networks, whether each piece of work was sent from one of them (office) or not (remote). The address itself isn't kept for this.

Activity from the desktop app

Recorded only while the work day is on: started by the person, or automatically during their work hours if their company chooses that, always with a notification.

• Which application and website is in use and for how long, and whether the computer is active or idle.
• Whether there was keyboard or mouse input, whether it came from the keyboard and mouse or was made by a program, and how far each movement of the mouse pointer went and where on the screen it stopped (the pointer's position only, not what's on the screen), to tell active from idle time and to spot activity that looks automated. We never record what is typed or clicked.
• Window titles, only if the company turns them on.
• Screenshots, only if the company turns them on, taken every few minutes while the person is working; they can be blurred.
• The computer's name, operating system and app version.

Nothing is recorded during a break or private time, or when work is stopped: we only note that it was a break or private time.

Billing

Plan, number of people, invoices and the billing contact. Payments are handled by our payment provider; we do not see or store card numbers or bank passwords.

Partners

If you apply to our partner programme: your name, firm, email, phone, city and, if you give it, GSTIN and website, to run the programme. For each company that signs up with your link or code, we count visits to your link (a daily number, nothing about the visitors) and work out your commission from what the company pays. Your partner page shows each company's name, status and payments, never anything from inside its account. A company you introduce is told your firm's name when it signs up.

This website

timerfly.com does not use advertising or tracking cookies.

• Server logs: our hosting provider keeps standard server logs (such as IP address and pages requested) to keep the site running and secure.
• Cloudflare Web Analytics: we count visits to timerfly.com and the web app with Cloudflare Web Analytics, which doesn't use cookies or identify you: it tells us only how many people visit, which pages they open, which site sent them and how fast the pages load.
• Our own count: we also count visits ourselves, without cookies: your browser keeps a random number (in its storage, not a cookie) so we can tell a first visit from a return one, and we record the page, the site or link that sent you, your IP address, your approximate location (city, state and country, worked out from the IP address) and whether it's a phone or a computer. We keep IP addresses for 90 days, to tell real visitors from automated ones, then delete them. That number goes on the sign-up link, so if you start a trial we can see which pages and channels lead to sign-ups. It identifies a browser, never a person; visit records are deleted after about 13 months.
• The web app: it uses a cookie and your browser's storage only to keep you signed in and remember your settings.
• Ads and tagged links: if you arrive from an ad or a tagged link, the site remembers that tag for your visit (in the browser tab, not a cookie) and passes it to sign-up, so we know which ads bring sign-ups; for Google ads that includes Google's click reference, which we report back to Google when a trial becomes a customer.
• Partner links: if you arrive with a partner’s link, the site keeps only that partner’s code in your browser’s storage for 90 days and adds it to sign-up, so a company you start is linked to the partner who introduced you.

Why we use it

• To provide Timerfly: show time, attendance and reports to the people the company allows to see them.
• To send the emails and alerts the company sets up (reports, late or idle alerts), and messages about the account (sign-in codes, invites, billing).
• To keep the service secure, prevent misuse and fix problems.
• To bill for the service and meet legal obligations such as tax records.

We do not sell personal data, and we do not use activity data or screenshots for advertising.

Who can see it

• In the company: owners and admins see everyone's time, apps, attendance and (if on) screenshots. Employees see their own data only.
• Our staff: only when needed to run the service, fix a problem or answer a request from the company.
• Service providers who process data for us, under contract: cloud hosting and storage (including Cloudflare), email delivery (Zoho ZeptoMail), and payments (Razorpay).
• Apps the company connects: if a company links Telegram or Slack, the alerts it chooses are sent there.
• Authorities, when the law requires it.

How long we keep it

• Screenshots are deleted automatically after the period on the company's plan (Starter 45 days, Pro 90 days, Business 6 months).
• Other activity and account data are kept while the company's account is open, so its reports stay complete.
• When a company closes its account, we delete its data within 90 days, except records we must keep by law (such as invoices).

Security

Data is encrypted in transit (HTTPS). Each company's data is kept apart at the database level. Passwords are stored as one-way hashes, and two-step sign-in and office-network-only sign-in are available. No system is perfectly secure; if a breach affects your data, we will tell the affected companies and the authorities as the law requires.

Your rights

Under India's Digital Personal Data Protection Act, 2023, you can ask to see, correct or erase your personal data, and to withdraw consent where processing relies on it. Employees should usually ask their company first, since it controls its workspace; we will help the company respond. Write to us at the address below.

Questions and grievances

For anything about your data, or to raise a grievance, write to us.
Email: [email protected]

We reply within 30 days.

Changes

If we change this policy in a way that matters, we will tell account owners by email before it takes effect. The date at the top shows the latest version.