ChronoTab — Privacy Policy

Who is responsible for your data

Your organization decides what ChronoTab is used for and whose time is recorded in it. For the data in your organization's workspace (time entries, notes, clients, timesheets, members, and the GitHub data your organization connects), your organization is the controller. Under India's Digital Personal Data Protection Act, 2023, your organization is the Data Fiduciary. NFN Labs processes that data on your organization's behalf as its processor (Data Processor), under our Terms of Service.

NFN Labs decides how a small set of data is used for running and securing the Service itself: sign-in records, security and operational logs, and support correspondence. We describe that data below too.

If you are a member of an organization, please send requests about your data to your organization's administrator first. We will help them respond.

1. Information we collect

1.1 Account and identity information

To sign in, you authenticate with Google or GitHub using OAuth. Depending on the provider, we receive:

• Your email address (we require a verified email from the provider before linking or creating an account)
• Your name and, for Google, basic profile info (openid email profile scope)
• Your GitHub account's numeric user ID, for GitHub sign-in
• For GitHub, an OAuth token used only to confirm your verified primary email address (user:email scope) — we do not use this token to read your repos, issues, or code

We never receive or store your Google or GitHub password.

1.1a When you create an organization

When you create a ChronoTab organization yourself, we use your GitHub authorization only during sign-up, and do not store it, to list the ChronoTab installations you can access and to confirm that you are an owner of the account you connect. We keep a sign-up record: your GitHub username and numeric ID, your verified email address and name, the GitHub account and installation you chose, the organization name, address, and timezone you set, whether you chose to add the organization's members, the version of the Terms you accepted and when, and timestamps. Unfinished and resolved sign-up records are deleted after 30 days. The record of a completed sign-up stays with the organization (it shows which Terms version was accepted) and is deleted when the organization is deleted.

1.2 Organization, repository, and issue data

Once your organization's administrator installs the ChronoTab GitHub App on their GitHub organization or specific repositories, ChronoTab reads, for the repositories the administrator has approved:

• Repository names and identifiers
• Issue numbers, titles, and node IDs (used to resolve and label your time entries — never free-typed by you)

If the person creating an organization chooses to add its GitHub members, ChronoTab reads the organization's member list through the installation (GitHub usernames and whether each member is an owner) and creates a ChronoTab membership for each person, without a real email address until they sign in. The organization, as controller, decides to do this and is responsible for having a lawful basis for it.

The GitHub App is installed by your organization's admin, not by ChronoTab, and can be scoped to specific repositories or revoked at any time from GitHub. ChronoTab does not read source code or commits, or any repository content beyond what is needed to identify an issue. If your team logs time by writing a time command on an issue comment, GitHub sends ChronoTab the issue-comment event, and ChronoTab reads that comment's text to find the time command and record the entry. ChronoTab does not support logging time against pull requests, and reads no pull request data.

1.3 Time entries and organization data you or your teammates create

• Time entries: duration, work date, activity type, an optional note, and the linked GitHub issue
• Organization data: organization name, membership list, roles (admin, manager, member), and invitations
• Seat status: whether each member is active or disabled and, if disabled, whether an administrator or the plan disabled them, and whether an administrator has pinned them to keep their seat
• Reports and exports you or an admin generate from the above

ChronoTab is a timesheet ledger, not a billing or payments product — we do not collect or store payment card numbers, bank details, or currency amounts.

Seats and activity. A plan has a limit on the number of active members (seats). When an organization has more active members than its plan allows and does not fix it within 14 days, ChronoTab disables the members beyond the limit (see the Terms of Service, section 3). To decide who keeps a seat, it ranks members by role (administrators first), then by whether an administrator pinned them, then by how recently they were active, measured by the date of their newest time entry or their newest use of an API key. It uses no other measure of activity for this, and the figures come from data ChronoTab already holds. The organization's administrators can see each member's role, last-active date and whether they will keep their seat or have been disabled by the plan.

1.4 Chrome extension local storage

The ChronoTab extension stores the following only on your own device, in Chrome's local extension storage (chrome.storage.local), which is never transmitted to us except where noted:

• Your ChronoTab API key bundle (used to authenticate the extension to the ChronoTab API)
• Your active organization/membership selection and display preferences (timezone, duration format)
• A short-lived cache of your assigned repositories and recent time-entry summaries, to make the popup load instantly
• A local queue of time entries you have submitted while offline, until they are successfully synced to the ChronoTab API

This data stays on your device and is not visible to other Chrome profiles or other users. Uninstalling the extension deletes it.

1.5 Technical and operational data

ChronoTab runs on Cloudflare Workers. Like any web service, our infrastructure records standard operational logs (request timestamps, response status, error traces) to operate, debug, and secure the Service. These logs are kept for no more than 30 days.

For API-key requests, we also keep a usage record so administrators can review how their organization's keys are used. It contains the time, the endpoint called, the response status, and the caller's IP address, and it is kept for 31 days.

Audit records. Actions that administrators and managers take in an organization, such as changing a member's role, disabling or restoring a member, approving a timesheet or editing another member's entry, are recorded in the organization's audit log, which its administrators can review. Actions that ChronoTab takes automatically, such as disabling members when the seat limit is exceeded and restoring them when there is room, and actions our staff take to operate the Service, are recorded in our own audit log.

Audit records written on or after 26 October 2026 hold references and structured facts: internal identifiers for the people, entries, timesheets and other items involved, the kind of action, and details such as which fields changed, counts and dates. They do not hold names, email addresses, GitHub logins or text that people typed, such as entry descriptions, notes or reasons. Where the log shows a name or a description, it is looked up from the current records when the log is viewed, so a person whose identity has been anonymized is shown as anonymized. We keep these records for one year after they are written and then delete them; a record is deleted only once its archived copy (below) has been made, so it can occasionally be kept a little longer while that copy is pending. Records written before that date can also contain names, GitHub logins and text that people typed, and are kept for up to 180 days.

Audit archive. Each day we copy the audit records written on or after 26 October 2026 to a separate archive. Each organization's records are encrypted with a key of their own, and each day's copies are listed in a signed record that is chained to the day before, which makes the archive tamper-evident. The archive is locked against change: once a copy is written, the Service cannot overwrite or delete it before its retention period ends. We keep archived copies for up to three years to protect the integrity of the record and to establish, exercise or defend legal claims, and then they expire. An archived copy holds only the references and structured facts of the record it copies.

We do not use this data for advertising, profiling, or behavioral analytics, and we do not run any third-party analytics, advertising, or tracking scripts on the Service.

Billing information. If your organization buys a paid plan, the purchase is made with Paddle.com, our reseller and merchant of record. Paddle collects the billing details it needs (name, email address, billing address, country, tax identifiers you provide, and the payment method) under its own privacy policy. Paddle sends us only what we need to run your plan: the organization's plan, billing period, subscription status (for example active, past due or cancelled), the billing email address, and Paddle's identifiers for the customer, subscription and transactions. We do not receive or store card or bank details.

1.6 Imports from other time-tracking tools

If an administrator of your organization imports time from another tool, such as Atlassian Jira or Tempo, Harvest, Toggl Track or Clockify, we receive from that tool the time entries being imported: dates, durations, descriptions, whether each entry was billable, and the tool's own identifier for each entry. We also receive the people who logged them (name, email address and the tool's identifier for them, used only to match them to members of your organization), the projects, tasks and clients they were logged against, and links to the issues they refer to. Imported entries become part of your organization's time entries (section 1.3) and are marked as imported.

To read from those tools, the administrator gives us an access token for that tool, such as an API token or API key. We encrypt the token before storing it, with a key we keep separately from the database. We use it only to read the data for imports the administrator starts and to check that the issues those entries refer to exist. We never show it again after it is entered, and we never write it to logs. By default, the token is deleted when that import finishes, and in any case no later than 7 days after it was added. An administrator can instead choose to keep it so the import can be run again; it is then deleted 30 days after it was last used. An administrator can remove it at any time. We recommend using a read-only token, and revoking it in the other tool once the import is done. Deleted tokens may remain in our encrypted backups for up to 30 days before those expire.

1.7 AI assistants you connect

You can connect an AI assistant to ChronoTab, such as Claude Code, Cursor, VS Code or another app that supports the Model Context Protocol (MCP), so that it can record and look up your time for you. The assistant is a third-party service that you choose and authorize; it is not part of ChronoTab, and NFN Labs does not operate or control it. You connect an assistant with an API key that you create for it on your Profile page. The key belongs to you, works only in the organization you created it in, and lets the assistant do only what your role allows.

Some assistants, such as Claude, ChatGPT or Claude Code, connect differently: you add ChronoTab in the assistant, sign in to ChronoTab with Google or GitHub, choose one organization, and approve the connection on a ChronoTab page that shows the assistant's name and web address and what it can and cannot do. The connection then works like a key: it belongs to you, works only in the organization you chose, and lets the assistant do only what your role allows.

A connected assistant can use only a fixed set of actions: start and stop your timers, log time against an issue, list your own time entries, search the issues in your organization's repositories, show the days on which you have no time logged and, if you are an administrator or manager, list your organization's clients and read their hours. It cannot edit or delete entries, discard timers, or create, submit or approve timesheets. Entries it logs are your time entries like any others (section 1.3): they are marked as logged by an AI assistant and appear in reports and timesheets.

ChronoTab sends data to an assistant only in reply to a request the assistant makes with your key. We do not send your data to any assistant you have not connected, and ChronoTab does not itself use an AI assistant or AI model to process your data. ChronoTab does not receive your conversation with the assistant, only the requests it sends, such as the issue, duration, date and note of an entry to log. What ChronoTab returns, for example your entries, issue titles, timer details or client hours, is then held and processed by the assistant's provider under that provider's own terms and privacy policy, not this policy. Read them before you connect an assistant, and follow any rules your organization sets about which assistants you may use.

For an assistant's key we keep the key's name, its prefix and a hash of the key (never the key itself), and when it was created, approximately when it was last used and, if it is revoked, when. Its requests are recorded in the API usage record and operational logs described in section 1.5. The usage record shows a request to the assistant endpoint, not which action the assistant used; the operational logs show which ChronoTab features it called, when, and the result.

For a connection you approve this way, we keep the assistant's name and web addresses as its provider publishes them, the organization you chose, when you connected, approximately when it was last used and, if it has ended, when and why. The tokens the assistant uses are stored only as hashes. An access token lasts one hour; the assistant renews it with a refresh token that lasts 30 days and is replaced each time it is used. Approving a connection, and disconnecting it in ChronoTab, are recorded in your organization's audit log (section 1.5).

Your organization's administrators can see your API keys, including those you create for an assistant, with their recent requests (endpoint, status, IP address and time), and can revoke them. They can also see each member's connected assistants (the assistant's name and web address, when it was connected and when it was last used) and disconnect them. Anyone in your organization who can see your time entries (section 4) can also see which of them an assistant logged. To disconnect an assistant, revoke its key under API keys, or remove it under Connected assistants, on your Profile page; the assistant is refused from its next request. Revoking the key does not delete what the assistant's provider already holds: that is governed by the provider's own policy.

2. Information we do not collect

• We do not read your browsing history. The extension only activates on github.com issue pages to show the ChronoTab widget, and does not read or log time against pull requests.
• We do not collect or store payment-card or bank details. Payments for paid plans are taken by Paddle.com, our merchant of record (section 4).
• We do not sell your personal information, and we do not share it with advertisers or data brokers.
• We do not use cookies for tracking. A sign-in token is kept in your browser's local storage so you stay signed in for up to 24 hours, including after you close the tab. Signing out removes it. During sign-in we set a short-lived, strictly necessary cookie that protects against forged sign-in requests.

3. How we use information

We use the information above to:

• Authenticate you and maintain your session
• Record, display, and let you edit or export your own time entries
• Resolve GitHub issues so entries are labeled accurately
• Enforce your organization's repository access and your role's permissions
• Generate reports and exports your organization requests
• Import time entries that your organization's administrators choose to bring in from other time-tracking tools, and check that the issues those entries refer to exist
• Answer the requests of AI assistants you connect (section 1.7), and mark the entries they log as logged by an AI assistant
• Operate, secure, monitor, and improve the Service (e.g., diagnosing errors)
• Keep audit records of actions in each organization, and a locked, encrypted archive of them, to protect the integrity of the organization's records and to establish, exercise or defend legal claims
• Communicate with you about your account or material changes to the Service
• Run your organization's plan: apply its limits, tell administrators about billing events (renewals, failed payments, scheduled changes, paused repositories), and reconcile our records with Paddle's
• Enforce the plan's seat limit: when an organization is over it, choose which members keep a seat by role, pin and recent activity (section 1.3), disable the others, and restore them automatically when there is room

We do not use your data to train third-party AI models, and we do not use it for any purpose incompatible with operating ChronoTab as a timesheet tool.

4. How we share information

We do not sell personal information. We share data only with:

• Your own organization. Time entries and reports are visible to your organization's admins/managers according to your organization's roles, by design of the product.
• People your organization chooses to share with. If your organization creates a timesheet share link, for example for a client, anyone with that link can view that timesheet until the link is revoked or expires.
• Tools your organization connects for an import. When an administrator imports from another tool, we send that tool only the requests needed to read your organization's data with the token the administrator provided. These tools are not our sub-processors: your organization's use of them is governed by its own agreements with them.
• AI assistants you connect. When you connect an AI assistant (section 1.7), we send it the data it asks for with your credentials, limited to what your role allows. You choose the assistant and its provider, not us, and they are not our sub-processors: what we send is processed under the provider's own terms and privacy policy.
• Service providers who process data on our behalf, under contract and only to provide the Service:
  • Cloudflare, Inc. — hosting, database (D1), file storage (R2, for backups, deletion receipts and the encrypted audit archive), background job processing (Workers Queues), and transactional email delivery: operational alerts and billing emails to organization administrators. Cloudflare does not use this data for its own purposes.
  • GitHub, Inc. — OAuth sign-in and the GitHub App integration your organization installs.
  • Google LLC — OAuth sign-in, if you choose "Continue with Google."
  • Slack Technologies, LLC — internal operational notifications to the NFN Labs team, for example when a background job fails. These can include organization names and GitHub usernames.
  • Paddle.com (Paddle.com Market Ltd, UK, and Paddle.com Inc., US) — reseller and merchant of record for paid plans: checkout, payment processing, tax collection, invoicing, subscription billing and payment-failure notices. Paddle is an independent controller of the billing information it collects from you at checkout. We share with Paddle the organization's identifier and the administrator's email address so the subscription can be linked to the organization.
• Legal reasons. If required to comply with a legal obligation, protect our rights, or prevent fraud or abuse.
• A business transfer. If NFN Labs is involved in a merger, acquisition, or asset sale, data may transfer as part of that transaction, subject to this policy or a policy at least as protective.

5. Data retention and deletion

5.1 While your organization uses ChronoTab

• We keep your organization's data for as long as your organization uses the Service.
• ChronoTab's ledger is append-only for audit-trail integrity. Editing or deleting an entry marks it as superseded or deleted rather than erasing it. Superseded and deleted entries are excluded from every report, export, and total, and remain part of your organization's records until your organization is deleted.
• Time entries and timesheets are your organization's own records. ChronoTab has no retention requirement of its own for them. Your organization can export them at any time.
• Disabling a member, whether an administrator does it or the plan does it because the organization is over its seat limit, does not delete them or their data. Their account, entries, reports and timesheets are kept. While the plan has them disabled, their API keys are suspended, not revoked, and work again when the member is restored. When an administrator disables a member by hand, the member's API keys are revoked instead. Their data is deleted or anonymized only as described in sections 5.2 and 5.3.
• Files from an import (the data read from the other tool and the import's preview) are kept for 30 days after the import finishes, so it can be reviewed, and then deleted. Access tokens for other tools are kept only as described in section 1.6.

Subscription records (plan, period, status and Paddle's identifiers) are kept while the organization exists and, after the organization is deleted, as a scrubbed record for as long as tax and accounting law requires.

5.2 Deleting an organization

An active administrator of the organization can delete it from Settings. Deleting needs a GitHub sign-in from the last 10 minutes and typing the organization's address to confirm. An administrator can also ask us to delete it by writing to privacy@chronotab.com; we verify the request through a GitHub sign-in. We do not send an email when a deletion is scheduled: the organization's other administrators and members see a notice with the deletion date the next time they open ChronoTab. Then:

• Immediately: we lock the organization, revoke all of its API keys, assistant connections, shared timesheet links, and other sessions, and stop syncing with GitHub. Members can still export their own entries, and administrators can export reports and timesheets, until the deletion date.
• 30-day grace period: any administrator can cancel the deletion during this time. Cancelling unlocks the organization but does not restore revoked API keys, share links, or sessions.
• After the grace period: we permanently delete the organization's data, including time entries, timesheets, clients, share links, repository and issue data, API keys, assistant connections, branding, imports, and any stored access tokens for other tools, and we remove the ChronoTab GitHub App from your GitHub account. If we cannot remove the App, we ask an owner to remove it in GitHub's settings. We anonymize the identity of any member who does not belong to another ChronoTab organization.
• Audit logs: the organization's audit records are kept for integrity for one year from when they were written (up to 180 days for records written before 26 October 2026), as described in section 1.5, then deleted. Until then, the only other data that remains is the placeholders those records depend on: the organization and its memberships, with names and personal details removed. Records written before that date can contain names and text that people typed until they are deleted. When we delete the organization's data, we also destroy its archive key, so the archived copies of its audit records can no longer be read; the locked copies then expire on schedule, within three years of being written.
• Backups: deleted data may remain in encrypted backups and database recovery snapshots for up to 30 days before they expire. This includes a destroyed archive key. We do not restore a deleted organization from them.

Once the grace period ends the deletion cannot be undone. Members of other ChronoTab organizations are not affected.

5.3 Individual members

If you are a member of an organization, ask your organization's administrator to remove you or delete your records. Your organization controls that data (see "Who is responsible for your data"). Once you no longer belong to any ChronoTab organization, you can ask us to anonymize your identity. We do this on the same timeline as above. Audit records written on or after 26 October 2026, and their archived copies, refer to you only by an internal identifier, so once your identity is anonymized they show you as anonymized. Records written before that date can contain your name or GitHub login until they are deleted, up to 180 days after they were written.

6. Security

• All traffic to the Service is encrypted in transit (TLS/HTTPS).
• API access requires a per-user API key; keys are never logged, never returned in full after initial creation, and never appear in a URL.
• Every data access is scoped to your organization; cross-organization access attempts are rejected and treated as if the resource does not exist.
• Access to repositories is limited to what your organization's admin has explicitly allow-listed.
• Access tokens for other tools are encrypted at rest with a key held separately from the database, can only be decrypted for the organization they belong to, are never logged or shown again, and are deleted automatically (section 1.6).
• An AI assistant you connect can use only a fixed set of actions, which cannot edit or delete entries, with your own role's permissions, in one organization (section 1.7).

If we become aware of a security incident affecting your organization's data, we will notify the organization without undue delay.

No method of transmission or storage is 100% secure, but we design the Service to make cross-tenant data leaks and key exposure structurally difficult, not just policy-prohibited.

7. Your rights and choices

Depending on your location, you may have rights to access, correct, export, or delete your personal information, or to object to or restrict certain processing. To exercise these rights:

• Revoke sign-in access any time from your Google account permissions or GitHub authorized OAuth Apps.
• Uninstall the GitHub App or narrow its repository access from your GitHub organization's settings — this immediately stops ChronoTab from reading any newly added repository.
• Uninstall the Chrome extension to remove all locally stored data on that device.
• Disconnect an AI assistant at any time from your Profile page (section 1.7). Data the assistant's provider already holds is governed by that provider's own policy.
• Contact us (Section 11) to request access to, export of, or deletion of your personal data, or to ask a question about this policy. If your request concerns data in an organization's workspace, we will involve that organization's administrator, as the controller.

If you are located in the European Economic Area, the UK, or a jurisdiction with a similar data protection authority, you also have the right to lodge a complaint with your local supervisory authority. If you are in India, you can raise a grievance with us at privacy@chronotab.com, and you may approach the Data Protection Board of India.

8. Children's privacy

ChronoTab is a workplace tool and is not directed at, and is not knowingly used by, children under 16. We do not knowingly collect personal information from children.

9. International data

ChronoTab runs on Cloudflare's global network. Your data may be processed in a country other than your own. We rely on our processors' standard safeguards (such as Cloudflare's and GitHub's own compliance programs) for any such transfer.

10. Changes to this policy

We may update this policy as the Service changes. We will update the "Last updated" date above, and for material changes, we will provide a more prominent notice (such as an in-app notice or email) before the change takes effect.

11. Contact us

Questions, requests, or concerns about this policy or your data:

Privacy and data requests (access, export, correction, deletion, grievances): privacy@chronotab.com
General help: support@chronotab.com
NFN Labs (OPC) Pvt. Ltd.
Kasturi Apartments, Radhakrishnan Salai 6th Street, Krishnapuram, Mylapore, Chennai, Tamil Nadu, India

Appendix: Chrome Web Store data disclosure summary

For Chrome Web Store listing purposes, the ChronoTab extension:

ChronoTab does not sell or transfer user data to third parties for purposes unrelated to providing the Service, and does not use user data for creditworthiness or lending purposes.