Privacy policy

This policy explains what Timerfly ("we", "us") collects when you use timerfly.com, the Timerfly web app (my.timerfly.com) and the Timerfly desktop app, and what we do with it.

Who decides what is tracked

Timerfly is used by companies ("customers") to record their own team's working time. The company decides whether its people use Timerfly and which optional features are on (such as screenshots and window titles). For the activity data of a company's employees, the company is the data fiduciary (the one that decides why and how it is processed) and we process it on the company's behalf, under our Terms of service. If you are an employee, questions about why your company tracks time are best asked to your company; you can also write to us.

What we collect

Account details

• Name and email address; the contact number of whoever signs the company up (so we can help with setup); a password (stored only as a one-way hash); and the two-step sign-in secret if you turn it on.
• Your company's name, time zone, work schedules, departments and settings.
• Sign-in records for security: IP address, browser or device, and when.
• If your company lists its office networks, whether each piece of work was sent from one of them (office) or not (remote). The address itself isn't kept for this.

Activity from the desktop app (only while the work day is on: started by the person, or automatically during their work hours if their company chooses that, always with a notification)

• Which application and website is in use and for how long, and whether the computer is active or idle.
• Whether there was keyboard or mouse input, to tell active from idle time. We never record what is typed or clicked.
• Window titles, only if the company turns them on.
• Screenshots, only if the company turns them on, taken every few minutes while the person is working; they can be blurred.
• The computer's name, operating system and app version.

Nothing is recorded during a break or private time, or when work is stopped: we only note that it was a break or private time.

Billing

Plan, number of people, invoices and the billing contact. Payments are handled by our payment provider; we do not see or store card numbers or bank passwords.

Partners

If you apply to our partner programme: your name, firm, email, phone, city and, if you give it, GSTIN and website, to run the programme. For each company that signs up with your link or code, we count visits to your link (a daily number, nothing about the visitors) and work out your commission from what the company pays. Your partner page shows each company's name, status and payments, never anything from inside its account. A company you introduce is told your firm's name when it signs up.

This website

timerfly.com does not use advertising or tracking cookies. Our hosting provider keeps standard server logs (such as IP address and pages requested) to keep the site running and secure. We count visits to timerfly.com and the web app with Cloudflare Web Analytics, which doesn't use cookies or identify you: it tells us only how many people visit, which pages they open, which site sent them and how fast the pages load. The web app uses a cookie and your browser's storage only to keep you signed in and remember your settings. If you arrive from an ad or a tagged link, the site remembers that tag for your visit (in the browser tab, not a cookie) and passes it to sign-up, so we know which ads bring sign-ups; for Google ads that includes Google's click reference, which we report back to Google when a trial becomes a customer. If you arrive with a partner’s link, the site keeps only that partner’s code in your browser’s storage for 90 days and adds it to sign-up, so a company you start is linked to the partner who introduced you.

Why we use it

• To provide Timerfly: show time, attendance and reports to the people the company allows to see them.
• To send the emails and alerts the company sets up (reports, late or idle alerts), and messages about the account (sign-in codes, invites, billing).
• To keep the service secure, prevent misuse and fix problems.
• To bill for the service and meet legal obligations such as tax records.

We do not sell personal data, and we do not use activity data or screenshots for advertising.

Who can see it

• In the company: owners and admins see everyone's time, apps, attendance and (if on) screenshots. Employees see their own data only.
• Our staff: only when needed to run the service, fix a problem or answer a request from the company.
• Service providers who process data for us, under contract: cloud hosting and storage (including Cloudflare), email delivery (Zoho ZeptoMail), and payments (Razorpay).
• Apps the company connects: if a company links Telegram or Slack, the alerts it chooses are sent there.
• Authorities, when the law requires it.

How long we keep it

• Screenshots are deleted automatically after the period on the company's plan (Starter 45 days, Pro 90 days, Business 6 months).
• Other activity and account data are kept while the company's account is open, so its reports stay complete.
• When a company closes its account, we delete its data within 90 days, except records we must keep by law (such as invoices).

Security

Data is encrypted in transit (HTTPS). Each company's data is kept apart at the database level. Passwords are stored as one-way hashes, and two-step sign-in and office-network-only sign-in are available. No system is perfectly secure; if a breach affects your data, we will tell the affected companies and the authorities as the law requires.

Your rights

Under India's Digital Personal Data Protection Act, 2023, you can ask to see, correct or erase your personal data, and to withdraw consent where processing relies on it. Employees should usually ask their company first, since it controls its workspace; we will help the company respond. Write to us at the address below.

Questions and grievances

For anything about your data, or to raise a grievance, write to us.
Email: support@timerfly.com

We reply within 30 days.

Changes

If we change this policy in a way that matters, we will tell account owners by email before it takes effect. The date at the top shows the latest version.