ChronoTab — Privacy Policy

Who is responsible for your data

Your organization decides what ChronoTab is used for and whose time is recorded in it. For the data in your organization's workspace (time entries, notes, clients, timesheets, members, and the GitHub data your organization connects), your organization is the controller. Under India's Digital Personal Data Protection Act, 2023, your organization is the Data Fiduciary. NFN Labs processes that data on your organization's behalf as its processor (Data Processor), under our Terms of Service.

NFN Labs decides how a small set of data is used for running and securing the Service itself: sign-in records, security and operational logs, and support correspondence. We describe that data below too.

If you are a member of an organization, please send requests about your data to your organization's administrator first. We will help them respond.

1. Information we collect

1.1 Account and identity information

To sign in, you authenticate with Google or GitHub using OAuth. Depending on the provider, we receive:

• Your email address (we require a verified email from the provider before linking or creating an account)
• Your name and, for Google, basic profile info (openid email profile scope)
• Your GitHub account's numeric user ID, for GitHub sign-in
• For GitHub, an OAuth token used only to confirm your verified primary email address (user:email scope) — we do not use this token to read your repos, issues, or code

We never receive or store your Google or GitHub password.

1.1a When you create an organization

When you create a ChronoTab organization yourself, we use your GitHub authorization only during sign-up, and do not store it, to list the ChronoTab installations you can access and to confirm that you are an owner of the account you connect. We keep a sign-up record: your GitHub username and numeric ID, your verified email address and name, the GitHub account and installation you chose, the organization name, address, and timezone you set, whether you chose to add the organization's members, the version of the Terms you accepted and when, and timestamps. Unfinished and resolved sign-up records are deleted after 30 days. The record of a completed sign-up stays with the organization (it shows which Terms version was accepted) and is deleted when the organization is deleted.

1.2 Organization, repository, and issue data

Once your organization's administrator installs the ChronoTab GitHub App on their GitHub organization or specific repositories, ChronoTab reads, for the repositories the administrator has approved:

• Repository names and identifiers
• Issue numbers, titles, and node IDs (used to resolve and label your time entries — never free-typed by you)

If the person creating an organization chooses to add its GitHub members, ChronoTab reads the organization's member list through the installation (GitHub usernames and whether each member is an owner) and creates a ChronoTab membership for each person, without a real email address until they sign in. The organization, as controller, decides to do this and is responsible for having a lawful basis for it.

The GitHub App is installed by your organization's admin, not by ChronoTab, and can be scoped to specific repositories or revoked at any time from GitHub. ChronoTab does not read source code or commits, or any repository content beyond what is needed to identify an issue. If your team logs time by writing a time command on an issue comment, GitHub sends ChronoTab the issue-comment event, and ChronoTab reads that comment's text to find the time command and record the entry. ChronoTab does not support logging time against pull requests, and reads no pull request data.

1.3 Time entries and organization data you or your teammates create

• Time entries: duration, work date, activity type, an optional note, and the linked GitHub issue
• Organization data: organization name, membership list, roles (admin, manager, member), and invitations
• Seat status: whether each member is active or disabled and, if disabled, whether an administrator or the plan disabled them, and whether an administrator has pinned them to keep their seat
• Reports and exports you or an admin generate from the above

ChronoTab is a timesheet ledger, not a billing or payments product — we do not collect or store payment card numbers, bank details, or currency amounts.

Seats and activity. A plan has a limit on the number of active members (seats). When an organization has more active members than its plan allows and does not fix it within 14 days, ChronoTab disables the members beyond the limit (see the Terms of Service, section 3). To decide who keeps a seat, it ranks members by role (administrators first), then by whether an administrator pinned them, then by how recently they were active, measured by the date of their newest time entry or their newest use of an API key. It uses no other measure of activity for this, and the figures come from data ChronoTab already holds. The organization's administrators can see each member's role, last-active date and whether they will keep their seat or have been disabled by the plan.

1.4 Chrome extension local storage

The ChronoTab extension stores the following only on your own device, in Chrome's local extension storage (chrome.storage.local), which is never transmitted to us except where noted:

• Your ChronoTab API key bundle (used to authenticate the extension to the ChronoTab API)
• Your active organization/membership selection and display preferences (timezone, duration format)
• A short-lived cache of your assigned repositories and recent time-entry summaries, to make the popup load instantly
• A local queue of time entries you have submitted while offline, until they are successfully synced to the ChronoTab API

This data stays on your device and is not visible to other Chrome profiles or other users. Uninstalling the extension deletes it.

1.5 Technical and operational data

ChronoTab runs on Cloudflare Workers. Like any web service, our infrastructure records standard operational logs (request timestamps, response status, error traces) to operate, debug, and secure the Service. These logs are kept for no more than 30 days.

For API-key requests, we also keep a usage record so administrators can review how their organization's keys are used. It contains the time, the endpoint called, the response status, and the caller's IP address, and it is kept for 31 days.

Audit records. Actions that administrators and managers take in an organization, such as changing a member's role, disabling or restoring a member, approving a timesheet or editing another member's entry, are recorded in the organization's audit log, which its administrators can review. Actions that ChronoTab takes automatically, such as disabling members when the seat limit is exceeded and restoring them when there is room, and actions our staff take to operate the Service, are recorded in our own audit log.

Audit records written on or after 26 October 2026 hold references and structured facts: internal identifiers for the people, entries, timesheets and other items involved, the kind of action, and details such as which fields changed, counts and dates. They do not hold names, email addresses, GitHub logins or text that people typed, such as entry descriptions, notes or reasons. Where the log shows a name or a description, it is looked up from the current records when the log is viewed, so a person whose identity has been anonymized is shown as anonymized. We keep these records for one year after they are written and then delete them; a record is deleted only once its archived copy (below) has been made, so it can occasionally be kept a little longer while that copy is pending. Records written before that date can also contain names, GitHub logins and text that people typed, and are kept for up to 180 days.

Audit archive. Each day we copy the audit records written on or after 26 October 2026 to a separate archive. Each organization's records are encrypted with a key of their own, and each day's copies are listed in a signed record that is chained to the day before, which makes the archive tamper-evident. The archive is locked against change: once a copy is written, the Service cannot overwrite or delete it before its retention period ends. We keep archived copies for up to three years to protect the integrity of the record and to establish, exercise or defend legal claims, and then they expire. An archived copy holds only the references and structured facts of the record it copies.

We do not use this data for advertising, profiling, or behavioral analytics, and we do not run any third-party analytics, advertising, or tracking scripts on the Service.

Billing information. If your organization buys a paid plan, the purchase is made with Paddle.com, our reseller and merchant of record. Paddle collects the billing details it needs (name, email address, billing address, country, tax identifiers you provide, and the payment method) under its own privacy policy. Paddle sends us only what we need to run your plan: the organization's plan, billing period, subscription status (for example active, past due or cancelled), the billing email address, and Paddle's identifiers for the customer, subscription and transactions. We do not receive or store card or bank details.

1.6 Imports from other time-tracking tools

If an administrator of your organization imports time from another tool, such as Atlassian Jira or Tempo, Harvest, Toggl Track or Clockify, we receive from that tool the time entries being imported: dates, durations, descriptions, whether each entry was billable, and the tool's own identifier for each entry. We also receive the people who logged them (name, email address and the tool's identifier for them, used only to match them to members of your organization), the projects, tasks and clients they were logged against, and links to the issues they refer to. Imported entries become part of your organization's time entries (section 1.3) and are marked as imported.

To read from those tools, the administrator gives us an access token for that tool, such as an API token or API key. We encrypt the token before storing it, with a key we keep separately from the database. We use it only to read the data for imports the administrator starts and to check that the issues those entries refer to exist. We never show it again after it is entered, and we never write it to logs. By default, the token is deleted when that import finishes, and in any case no later than 7 days after it was added. An administrator can instead choose to keep it so the import can be run again; it is then deleted 30 days after it was last used. An administrator can remove it at any time. We recommend using a read-only token, and revoking it in the other tool once the import is done. Deleted tokens may remain in our encrypted backups for up to 30 days before those expire.

2. Information we do not collect

• We do not read your browsing history. The extension only activates on github.com issue pages to show the ChronoTab widget, and does not read or log time against pull requests.
• We do not collect or store payment-card or bank details. Payments for paid plans are taken by Paddle.com, our merchant of record (section 4).
• We do not sell your personal information, and we do not share it with advertisers or data brokers.
• We do not use cookies for tracking. A sign-in token is kept in your browser's local storage so you stay signed in for up to 24 hours, including after you close the tab. Signing out removes it. During sign-in we set a short-lived, strictly necessary cookie that protects against forged sign-in requests.

3. How we use information

We use the information above to:

• Authenticate you and maintain your session
• Record, display, and let you edit or export your own time entries
• Resolve GitHub issues so entries are labeled accurately
• Enforce your organization's repository access and your role's permissions
• Generate reports and exports your organization requests
• Import time entries that your organization's administrators choose to bring in from other time-tracking tools, and check that the issues those entries refer to exist
• Operate, secure, monitor, and improve the Service (e.g., diagnosing errors)
• Keep audit records of actions in each organization, and a locked, encrypted archive of them, to protect the integrity of the organization's records and to establish, exercise or defend legal claims
• Communicate with you about your account or material changes to the Service
• Run your organization's plan: apply its limits, tell administrators about billing events (renewals, failed payments, scheduled changes, paused repositories), and reconcile our records with Paddle's
• Enforce the plan's seat limit: when an organization is over it, choose which members keep a seat by role, pin and recent activity (section 1.3), disable the others, and restore them automatically when there is room

We do not use your data to train third-party AI models, and we do not use it for any purpose incompatible with operating ChronoTab as a timesheet tool.

4. How we share information

We do not sell personal information. We share data only with:

• Your own organization. Time entries and reports are visible to your organization's admins/managers according to your organization's roles, by design of the product.
• People your organization chooses to share with. If your organization creates a timesheet share link, for example for a client, anyone with that link can view that timesheet until the link is revoked or expires.
• Tools your organization connects for an import. When an administrator imports from another tool, we send that tool only the requests needed to read your organization's data with the token the administrator provided. These tools are not our sub-processors: your organization's use of them is governed by its own agreements with them.
• Service providers who process data on our behalf, under contract and only to provide the Service:
  • Cloudflare, Inc. — hosting, database (D1), file storage (R2, for backups, deletion receipts and the encrypted audit archive), background job processing (Workers Queues), and transactional email delivery: operational alerts and billing emails to organization administrators. Cloudflare does not use this data for its own purposes.
  • GitHub, Inc. — OAuth sign-in and the GitHub App integration your organization installs.
  • Google LLC — OAuth sign-in, if you choose "Continue with Google."
  • Slack Technologies, LLC — internal operational notifications to the NFN Labs team, for example when a background job fails. These can include organization names and GitHub usernames.
  • Paddle.com (Paddle.com Market Ltd, UK, and Paddle.com Inc., US) — reseller and merchant of record for paid plans: checkout, payment processing, tax collection, invoicing, subscription billing and payment-failure notices. Paddle is an independent controller of the billing information it collects from you at checkout. We share with Paddle the organization's identifier and the administrator's email address so the subscription can be linked to the organization.
• Legal reasons. If required to comply with a legal obligation, protect our rights, or prevent fraud or abuse.
• A business transfer. If NFN Labs is involved in a merger, acquisition, or asset sale, data may transfer as part of that transaction, subject to this policy or a policy at least as protective.

5. Data retention and deletion

5.1 While your organization uses ChronoTab

• We keep your organization's data for as long as your organization uses the Service.
• ChronoTab's ledger is append-only for audit-trail integrity. Editing or deleting an entry marks it as superseded or deleted rather than erasing it. Superseded and deleted entries are excluded from every report, export, and total, and remain part of your organization's records until your organization is deleted.
• Time entries and timesheets are your organization's own records. ChronoTab has no retention requirement of its own for them. Your organization can export them at any time.
• Disabling a member, whether an administrator does it or the plan does it because the organization is over its seat limit, does not delete them or their data. Their account, entries, reports and timesheets are kept. While the plan has them disabled, their API keys are suspended, not revoked, and work again when the member is restored. When an administrator disables a member by hand, the member's API keys are revoked instead. Their data is deleted or anonymized only as described in sections 5.2 and 5.3.
• Files from an import (the data read from the other tool and the import's preview) are kept for 30 days after the import finishes, so it can be reviewed, and then deleted. Access tokens for other tools are kept only as described in section 1.6.

Subscription records (plan, period, status and Paddle's identifiers) are kept while the organization exists and, after the organization is deleted, as a scrubbed record for as long as tax and accounting law requires.

5.2 Deleting an organization

An active administrator of the organization can delete it from Settings. Deleting needs a GitHub sign-in from the last 10 minutes and typing the organization's address to confirm. An administrator can also ask us to delete it by writing to [email protected]; we verify the request through a GitHub sign-in. We do not send an email when a deletion is scheduled: the organization's other administrators and members see a notice with the deletion date the next time they open ChronoTab. Then:

• Immediately: we lock the organization, revoke all of its API keys, shared timesheet links, and other sessions, and stop syncing with GitHub. Members can still export their own entries, and administrators can export reports and timesheets, until the deletion date.
• 30-day grace period: any administrator can cancel the deletion during this time. Cancelling unlocks the organization but does not restore revoked API keys, share links, or sessions.
• After the grace period: we permanently delete the organization's data, including time entries, timesheets, clients, share links, repository and issue data, API keys, branding, imports, and any stored access tokens for other tools, and we remove the ChronoTab GitHub App from your GitHub account. If we cannot remove the App, we ask an owner to remove it in GitHub's settings. We anonymize the identity of any member who does not belong to another ChronoTab organization.
• Audit logs: the organization's audit records are kept for integrity for one year from when they were written (up to 180 days for records written before 26 October 2026), as described in section 1.5, then deleted. Until then, the only other data that remains is the placeholders those records depend on: the organization and its memberships, with names and personal details removed. Records written before that date can contain names and text that people typed until they are deleted. When we delete the organization's data, we also destroy its archive key, so the archived copies of its audit records can no longer be read; the locked copies then expire on schedule, within three years of being written.
• Backups: deleted data may remain in encrypted backups and database recovery snapshots for up to 30 days before they expire. This includes a destroyed archive key. We do not restore a deleted organization from them.

Once the grace period ends the deletion cannot be undone. Members of other ChronoTab organizations are not affected.

5.3 Individual members

If you are a member of an organization, ask your organization's administrator to remove you or delete your records. Your organization controls that data (see "Who is responsible for your data"). Once you no longer belong to any ChronoTab organization, you can ask us to anonymize your identity. We do this on the same timeline as above. Audit records written on or after 26 October 2026, and their archived copies, refer to you only by an internal identifier, so once your identity is anonymized they show you as anonymized. Records written before that date can contain your name or GitHub login until they are deleted, up to 180 days after they were written.

6. Security

• All traffic to the Service is encrypted in transit (TLS/HTTPS).
• API access requires a per-user API key; keys are never logged, never returned in full after initial creation, and never appear in a URL.
• Every data access is scoped to your organization; cross-organization access attempts are rejected and treated as if the resource does not exist.
• Access to repositories is limited to what your organization's admin has explicitly allow-listed.
• Access tokens for other tools are encrypted at rest with a key held separately from the database, can only be decrypted for the organization they belong to, are never logged or shown again, and are deleted automatically (section 1.6).

If we become aware of a security incident affecting your organization's data, we will notify the organization without undue delay.

No method of transmission or storage is 100% secure, but we design the Service to make cross-tenant data leaks and key exposure structurally difficult, not just policy-prohibited.

7. Your rights and choices

Depending on your location, you may have rights to access, correct, export, or delete your personal information, or to object to or restrict certain processing. To exercise these rights:

• Revoke sign-in access any time from your Google account permissions or GitHub authorized OAuth Apps.
• Uninstall the GitHub App or narrow its repository access from your GitHub organization's settings — this immediately stops ChronoTab from reading any newly added repository.
• Uninstall the Chrome extension to remove all locally stored data on that device.
• Contact us (Section 11) to request access to, export of, or deletion of your personal data, or to ask a question about this policy. If your request concerns data in an organization's workspace, we will involve that organization's administrator, as the controller.

If you are located in the European Economic Area, the UK, or a jurisdiction with a similar data protection authority, you also have the right to lodge a complaint with your local supervisory authority. If you are in India, you can raise a grievance with us at [email protected], and you may approach the Data Protection Board of India.

8. Children's privacy

ChronoTab is a workplace tool and is not directed at, and is not knowingly used by, children under 16. We do not knowingly collect personal information from children.

9. International data

ChronoTab runs on Cloudflare's global network. Your data may be processed in a country other than your own. We rely on our processors' standard safeguards (such as Cloudflare's and GitHub's own compliance programs) for any such transfer.

10. Changes to this policy

We may update this policy as the Service changes. We will update the "Last updated" date above, and for material changes, we will provide a more prominent notice (such as an in-app notice or email) before the change takes effect.

11. Contact us

Questions, requests, or concerns about this policy or your data:

Privacy and data requests (access, export, correction, deletion, grievances): [email protected]
General help: [email protected]
NFN Labs (OPC) Pvt. Ltd.
Kasturi Apartments, Radhakrishnan Salai 6th Street, Krishnapuram, Mylapore, Chennai, Tamil Nadu, India

Appendix: Chrome Web Store data disclosure summary

For Chrome Web Store listing purposes, the ChronoTab extension:

ChronoTab does not sell or transfer user data to third parties for purposes unrelated to providing the Service, and does not use user data for creditworthiness or lending purposes.