Privacy

For each stretch of work in your browser, three things:

• The website name. figma.com — the host only. Never the page address, never anything after the slash, never a query string.
• The tab title, so you can recognise the work later. With one exception below.
• When it started and when it ended.

Plus the account details you type in yourself: your email, your business name and address, your clients, your rates and your invoices.

• Screenshots. Not now, not as an option, not ever.
• Keystrokes, mouse movement, microphone or webcam.
• Page addresses, form contents, or anything you type into a website.
• What you search for. A results page titles itself after your query, so on search engines the title is thrown away and only the site name is kept. Your visit to Google is counted as work; what you asked it is not our business.
• Anything at all on a site in your ignore-list.

97 sites are ignored from the first minute of a new account, without you doing anything: banks and payment services, health services, government and tax portals, email, messaging, dating, adult sites and password managers. They span every region this is sold in, not one country.

The filter runs twice. Once in the extension on your own machine, so an ignored hostname never leaves your computer at all, and again on our server, so a stale copy of your settings cannot leak something through. You can add any site you like to the list.

You. There is no manager view, no team dashboard, and no way for another person to be given access to your hours. Hourfair is not employee-monitoring software and we are not building that product.

Inside the database, every row carries your account and row-level security refuses any query that reaches for someone else’s. That is enforced by the database itself, not by the application asking politely.

Your data is never sold, never rented, and never used to train anything.

• Supabase — database and sign-in.
• Vercel — hosting.
• Paddle.com Market Ltd (Paddle) — payments. Paddle is the seller of record and handles your card details entirely. We never see or store a card number.

• While you subscribe: your full history, for as long as you want it.
• If your subscription ends: nothing is deleted. Your hours and invoices stay where they are and you can still export all of them. A record of work you did is not something to hold over you.
• After twelve months of an inactive subscription: tracked hours are deleted. We email you first and you have at least thirty days to download them or come back. Invoices are kept, because they are financial records you may need for tax years after the fact.
• If you delete your account: everything goes, immediately.

• See everything. The timesheet is the raw record; nothing is hidden from you.
• Export everything as CSV, including while your account is locked for non-payment.
• Delete any entry, or erase everything ever recorded, with one button.
• Delete your account, which removes all of it.

If you are in the UK, the EU or another place with equivalent law, these are your rights of access, portability, erasure and objection. They are buttons here rather than a form to fill in, because a right you have to request is not much of a right.

We process your tracked activity to provide the service you asked for — the contract between us. Account and payment records are kept to meet accounting and tax obligations. There is no advertising, no profiling and no automated decision-making.

Data is stored and processed outside your country in most cases. Where that involves a transfer out of the UK or EEA, it relies on the standard contractual clauses our processors above operate under.

The data controller is:

The postal address is given on request — ask and it will be sent to you. It is not printed here because this is a one-person business and that address is a home; a product arguing that software should collect no more than it needs would look poor doing the opposite to its own author.

Questions, requests, or complaints: support@hourfair.com. If you are in the UK or EU and you are not satisfied with the answer, you can complain to your national data protection authority.