Privacy Policy

Version of November 6, 2026 (draft for legal review). This page explains what TimeSnitch does with your data, in plain words wherever the law allows.

Questions and requests: support@timesnitch.com.

In short

• TimeSnitch is time tracking with an AI assistant. You log your own time: we don’t track apps or websites and we take no screenshots.
• We collect what the service needs to work and what the law makes us keep.
• We don’t sell your data and we don’t train AI models on it.
• An employee sees about themselves everything their manager sees: reports, signals and AI notes.
• Data is stored in the European Union, in Finland.
• If you use TimeSnitch at work, your employer controls the data about your work; we process it on their behalf.
• You can get everything you added, and delete it.

Who is responsible

The controller is Foxgid, Inc., a Delaware corporation, 651 N Broad St, Suite 201, Middletown, DE 19709, United States (“we”).

Company data. When a company (an employer) brings its people onto TimeSnitch, the company is the controller of the data about their work: time entries, tasks, ratings, pay calculations. We are its processor: we store that data, show it to whom the company allows, and never use it for our own purposes. The company is responsible for having a lawful basis and for telling its employees, including any notice that state electronic-monitoring laws require.

What we collect and why

• Account. Your email address and the one-time code or link from our email (stored only as a hash, short-lived). When the Slack app is live: your Slack user and workspace IDs, display name and language.
• Time entries. What you started (the text you wrote), when it started and ended, breaks, your rating of the entry and edits. This is the core of the service.
• Tasks and company. Tasks, their deadlines and norms; in a company, its structure, your role and your manager.
• Pay calculation (Pro, coming soon). Rates, salaries, bonuses and the calculated amounts. We make no payouts.
• Signals and AI notes. Hints like “this task took longer than its norm”. You see a signal first; your manager sees it later in the summary.
• AI assistant (AI plan). Your questions, its answers, and the entries it helped you write or fix.
• Purchases. What was bought, when, for how much, the status, the payment ID and the seat count. Card details never reach us: you enter them on Stripe’s checkout page.
• Support messages. What you send us when asking for help.
• Technical records. IP address, browser and device type, timestamps and errors, to keep the service working and to fight abuse. Application logs hold IDs, counts and error codes, never the text of your entries or your email.
• Web analytics. Google Analytics (Google LLC, US) and Yandex Metrica (Yandex LLC) run on the site and the app. They receive pseudonymous usage data: pages viewed, referrer, device, browser, approximate location from the IP address and a random browser ID in their cookies. Session recording is off. There are no ads. See the Cookie Policy.

Legal bases (where GDPR applies)

Performance of the contract; legitimate interest (security, abuse prevention, product improvement, web analytics); legal obligation (accounting and tax); consent, where we ask for it. You can withdraw consent at any time.

AI processing

On the AI plan, the entries and questions needed for an answer go to the AI model provider Anthropic (Claude models, US). The assistant only sees what you can see yourself: for a manager, only their part of the org. We don’t train models on your data. The assistant is software, not a person, and it can be wrong.

Who else sees data

Inside a company, an employee’s data is seen only by those whose role allows it: a manager sees their branch, the owner sees everything, pay is seen only by those granted that right.

We do not sell personal information and do not share it for cross-context behavioral advertising, as California and other US state laws use those terms. We disclose data to authorities only on a valid legal demand.

Where data is stored

On Hetzner servers in Finland, with backups in the same place. We are a US company, so our staff and contractors in the US can access data to run and support the service. Transfers from the EEA and the UK to the US are covered by the European Commission’s Standard Contractual Clauses.

How long we keep it

• Time entries, tasks, reports: until you (or the company, for its data) delete them or the account.
• AI assistant conversations: 180 days.
• Sign-in session: up to 30 days; email code or link: up to 15 minutes.
• Technical logs: up to 30 days. Backups: 7 days.
• After account deletion: done within 30 days. Payment records: as long as the law requires.

Your rights

You can access, correct, delete and export your data, object to processing based on legitimate interest and restrict processing. Depending on your US state, you may have rights to know, delete, correct and port your data and to opt out of sale, sharing and targeted advertising; we do none of those three. We treat a Global Privacy Control signal as a valid opt-out. If your employer controls the data, we pass your request to them and help. We won’t treat you worse for using any right.

Write to support@timesnitch.com. We answer within 30 days.

Security

Data travels only over encrypted connections (TLS). Sign-in codes are stored only as hashes. Access to production systems is limited to those who need it. If a breach affects you, we will tell you and the supervisory authority within 72 hours of learning about it.

Children

TimeSnitch is a work tool and is not directed at children under 16. If we learn we hold a child’s data, we delete it.

Changes

We’ll tell you about material changes by email or in the app at least 14 days before they take effect.