Privacy

The short version

This application holds the hours you type, the pay rules you configure, the savings you record, and the name, e-mail address and picture Google gives it when you sign in. That is all of it.

It is never sold and never shared. There are no advertisements and no marketing e-mail — there is no e-mail at all. Google Analytics is used to see how the application is used, and what you record is never sent to it.

Nobody else can read your hours or your wages. Not another account, and not whoever administers this instance.

What is stored, and why

What you type: shifts, breaks and notes; the usual shift, breaks and days off you set for each weekday; the names of the jobs you work, if more than one; your hourly wages and contract terms; your pay rates, and the public holidays you keep for them; what your payslips said, if you record them; your savings accounts, contributions, goals and projections. This is the application. It is stored because it is what you came to store.

How you want figures shown: your text size, your theme, where you open, and how money is rounded. Your time zone and the first day of your week are read from the browser you are using rather than asked for, and stored so that pages — which are rendered on the server — put your shifts on the right days.

No date of birth: a wage is typed in by hand and priced by the date it was worked, so nothing in the calculation needs to know how old you are. A date of birth was held once, for a feature that has since been removed, and it was deleted with it.

Your Google identity: Google's own account identifier, plus your name, e-mail address and profile picture. The identifier is what you are recognised by; the address is used once, to attach a first sign-in to an account that already has that address.

Your sessions: for each browser you are signed in on, when it was last used and what it reported itself as. Used to keep you signed in, to show you where you are signed in, and to let you end any one of those sessions or all of them at once.

Tickets you open: what you asked for, the replies, and which version of the terms was on screen when you sent it.

How one account is kept from another

Not by remembering to filter every query. Every request establishes whose data it is once, and then drops into a database role that cannot see anybody else's rows — the database enforces it, statement by statement, rather than the application being careful.

A request that cannot establish an account reads nothing at all, which is the correct outcome rather than an error to work around.

Administering this instance is a separate thing from reading records, deliberately and by design. Somebody who administers it can see that your account exists, what role it has and which tier it is on. They cannot open a single week of your hours, and there is no screen that would let them.

Signing in

Google is the only way in. There is no password to choose, so there is no password here to lose.

Signing in shares your name, e-mail address and profile picture with this application. Nothing is written back to your Google account, and this application cannot read your e-mail, your files or anything else there.

You are identified by Google's own account identifier rather than by your e-mail address. An address can be changed, given up and handed to somebody else; the identifier cannot. So changing your Google address keeps your wages, and a recycled address does not inherit them.

Your session is a random token your browser holds in a cookie that scripts on the page cannot read. The database stores only a hash of it, so a copy of that table is not a set of working keys. Sessions last thirty days and roll forward as they are used.

Measuring how it is used

Google Analytics is used, and only to understand how the application is used — which screens people open, which they never reach, where something is confusing enough that they give up. It exists so that what gets built next is decided by what people actually do rather than by guesswork.

It is never used to advertise to you, and nothing collected through it is sold, shared or combined with anything else. Your hours, your wages and your savings are never sent to it. What you recorded is not behaviour; it is the thing this application is for, and it stays here.

Analytics is about pages and actions, not about people. Nothing is sent to it that identifies you as an individual — no name, no e-mail address, no account identifier.

If you would rather not be counted, a browser setting or extension that blocks analytics stops it, and the application works exactly as it did before. Nothing here refuses to run because you declined to be measured.

Cookies

The one cookie this application sets itself is your session — the thing that keeps you signed in. There are no advertising cookies and nothing is sold to anybody.

Google Analytics sets cookies of its own to tell one visit from another. They carry no name, no e-mail address and no account identifier, and blocking them costs you nothing here.

Your browser also remembers your theme and your text size locally, so a reload never flashes the wrong one. That never leaves your browser and is not read by the server.

Who else is involved

Signing in goes through Google, and measuring how the application is used goes through Google Analytics. Beyond those, the application is run on ordinary hosting and the data sits in its database — a hosting arrangement is an operational detail that can change, and naming today's would only make this page wrong the day it does.

A contribution, if you ever send one, goes through PayPal as a personal payment. This application never sees your card or bank details, and it cannot: there is no payment integration here at all. It only records that a ticket was settled.

Nobody else is involved, and your records are not passed to anybody. Wherever this runs, the arrangement stays the same: whoever hosts it holds the data in order to run it and for nothing else.

Getting it back, and getting rid of it

Everything you have entered is on the screens you entered it on, and you can change or delete any of it at any time. Dropping to a lower tier never deletes anything and never stops you tidying up what you already have.

Your data, under Settings, is where you take it with you or remove it, without asking anybody. It downloads your shifts and your priced lines as spreadsheet files, or everything you have recorded as one file. And it deletes the account: you type the address you sign in with, and the account and everything belonging to it is removed at once — hours, jobs, wages, rates, payslips, savings, settings, tickets and every signed-in session.

Backups are whatever the database host keeps, so a deletion may survive in a backup for a short while before it ages out. Nothing is copied anywhere else.

This is a demo, run by a person

This is not a company, and there is no legal department behind this page. It is a personal project that is kept running and added to, and it says so everywhere rather than in one place somebody might miss.

That is also the honest answer about guarantees: it is looked after carefully, but it is one person's project. Keep anything that matters to you somewhere else as well.

If something here is wrong, say so on a ticket. Questions about this page go to the same place as everything else.