TimeBolt

Privacy Policy

Effective [EFFECTIVE DATE]

The short version

  • The time you log in TimeBolt is stored on your Mac. We never receive it.
  • There is no account, no telemetry, no analytics and no advertising, in the app or on this website.
  • Calendar access is off until you turn it on. Events are read on your Mac and never uploaded.
  • Integrations you connect, such as Linear, talk directly from your Mac to that service. Your sign-in stays in your Mac's Keychain, never on our servers.
  • You can export everything to CSV and delete everything from Settings.

1. Who we are

TimeBolt is made by [LEGAL NAME] ("we", "us"). We are responsible for the personal data described in this policy. You can reach us at support@timebolt.cloud or by post at [POSTAL ADDRESS].

This policy covers the TimeBolt app for macOS, however you got it (Mac App Store, TestFlight or direct download), this website at timebolt.cloud, and the TimeBolt online service described in section 8 once it is available.

2. Data that stays on your Mac

TimeBolt keeps what you enter in a database on your Mac. It contains:

  • Time entries: activity, category, description, tags, start and end times, and the time zone each entry was logged in.
  • Links from entries to items in services you connect, such as a Linear issue's key, title and web address, or the calendar event a meeting entry came from.

Alongside the database, TimeBolt keeps:

  • Settings: your preferences, shortcuts, colours, which calendars to include, which meeting suggestions you dismissed, and which integration accounts are connected (the account's name and ID). These are stored in TimeBolt's preferences file.
  • A task cache: the tasks assigned to you in services you connect, kept in TimeBolt's Caches folder so Quick Entry can show them quickly and offline.

None of this is sent to us, and we have no copy. TimeBolt doesn't sync between devices. Your Mac's own backups, such as Time Machine, include this data like any other file on your Mac.

The database is in ~/Library/Application Support/TimeBolt/ for the direct download, and in ~/Library/Containers/com.treesong.timebolt/Data/Library/Application Support/TimeBolt/ for the Mac App Store and TestFlight versions. TimeBolt ▸ Settings ▸ General ▸ Data shows the exact location.

3. What we don't collect

  • TimeBolt has no account and no sign-up.
  • The app contains no telemetry, analytics, advertising or third-party crash-reporting code.
  • The app makes no network requests of its own. It goes online only to reach a service you have connected, such as Linear, and later the TimeBolt online service if you use a feature that needs it.
  • We don't sell or rent personal data, share it for advertising, or use it to build profiles.

4. Calendar

Calendar suggestions are off until you turn on Suggest Entries from Calendar in TimeBolt ▸ Settings ▸ Integrations. macOS then asks whether TimeBolt may access your calendars.

With access granted, TimeBolt reads events from the calendars you choose, for the days you're looking at, to suggest entries for meetings you attended. It uses each event's title, start and end times and your response to the invitation, and looks in the event's URL, location and notes for a video-call link (for example Zoom, Google Meet, Microsoft Teams or Webex). This happens on your Mac. Calendar events are never sent to us or to anyone else.

A suggestion becomes an entry only when you accept it. The entry then stores the meeting's title and times, its meeting link if there is one, and the calendar's identifiers for the event, so the same meeting isn't suggested twice.

You can turn suggestions off in Settings at any time, or remove TimeBolt's access in System Settings ▸ Privacy & Security ▸ Calendars.

5. Integrations with other services

TimeBolt can connect to services you already use so that entries can link to your work. Linear is available today; Jira, Asana, GitHub, Toggl and Clockify are planned. Nothing is connected unless you connect it.

  • Direct from your Mac. TimeBolt talks to the service directly, over HTTPS, using your API key or sign-in. Our servers are not involved.
  • What it reads: your account's name and ID, to show which account is connected, and the tasks assigned to you with their key, title, status, team or project, and web address. When you look up a task in Quick Entry, what you type may be sent to the service as a search.
  • Read-only. Integrations in this version never create, change or delete anything in the connected service.
  • The service's own policy applies to the requests it receives from your Mac, which include your IP address as with any connection.
  • Links stay with your entries on your Mac and are included in CSV exports.

Features that send your time to another service, such as Toggl, Clockify or Jira worklogs, will be optional, and we will update this policy before they are released.

6. Sign-ins, tokens and API keys

  • API keys and sign-in tokens are stored in the macOS Keychain on your Mac.
  • They are sent only to the service they belong to, over HTTPS. They are never sent to us, and we never store them.
  • Disconnecting an account in TimeBolt ▸ Settings ▸ Integrations removes its key or token and its cached tasks from your Mac. You can also revoke TimeBolt's access in the service's own settings.

When you sign in to a service through your browser, the service sends your browser back to TimeBolt with a one-time code. Services that only accept web addresses send it through the sign-in redirect page on this website (section 7). TimeBolt uses PKCE, so that code is useless without a secret that never leaves your Mac.

7. This website

  • timebolt.cloud uses no cookies, analytics, advertising, tracking pixels, or scripts and fonts from other sites.
  • It is hosted on Google's Firebase Hosting. To deliver pages and protect the site from abuse, Google processes technical details of each request, such as your IP address, browser type, the address requested and the time, on our behalf. We don't turn on request logging for the site and don't use this information to identify you.
  • If you email us, we use your message and address to reply, and delete them once they're no longer needed for that, unless the law requires us to keep them longer.

The sign-in redirect page

Addresses starting timebolt.cloud/oauth/ are a hand-off point for signing in to a service. The page runs entirely in your browser: it passes the service's response (a one-time code and a check value, or an error message) to the TimeBolt app on your Mac, then removes it from the address bar. It doesn't store the response, send it anywhere else, or load anything from other sites.

Like any page request, your browser's request for this page passes through our hosting provider with the code in the address. The code works only once, expires within minutes, and can't be exchanged for access without the secret held by TimeBolt on your Mac.

8. The TimeBolt online service (when enabled)

Some planned features need a small server: signing in to services such as Jira and Asana, which require a secret that can't be shipped inside an app, and passing on notices that one of your tasks changed. This service is not available yet. When it is, and only if you use those features, it works like this:

  • No account. TimeBolt creates a key pair on your Mac. The service keeps the public key, a random install ID, the app version and channel, and when the install was created and last seen. It is kept until you remove the install, or deleted after 180 days without use.
  • Sign-in exchange. The service exchanges the one-time sign-in code for tokens, returns them to your Mac and does not store them. A short-lived sign-in record is kept for 10 minutes. Request and response bodies are never logged.
  • Change notices. When a connected service reports a change to one of your tasks, the service keeps only identifiers (which service, the type and ID of the item, the kind of change, and the time) for 72 hours, until your Mac collects them and fetches the details itself. Task titles and contents are never stored. The routing record that matches notices to your install is deleted when you disconnect, or after 35 days without renewal.
  • Usage limits. Where a service limits how often TimeBolt may call it, the service keeps per-install usage counts for 48 hours.
  • Purchases. If the service is part of a paid plan, it keeps the plan, its expiry and a hashed purchase or licence ID while the plan is active and for 30 days after.
  • Logs. Request method, path, status, timing and a shortened IP address, without bodies and without the query strings of sign-in requests, kept for 14 days.
  • Never stored: sign-in tokens, task titles or contents, time entries, or email addresses.

You will be able to remove an install, and everything tied to it, from the app or by emailing us. We will update this section with the final details before the service launches.

9. Apple, TestFlight and payments

  • If you have chosen to share analytics with app developers in System Settings ▸ Privacy & Security ▸ Analytics & Improvements, Apple may give us crash reports and usage statistics, under Apple's privacy policy. They don't identify you to us.
  • If you test TimeBolt through TestFlight, Apple may share with us details of you as a tester, such as the name and email address you joined with, along with install and session information and any feedback, screenshots and crash reports you choose to send. We use these only to run the beta and fix problems.
  • If TimeBolt offers paid features, purchases in the Mac App Store are handled by Apple. We receive confirmation of the purchase, never your payment details. If purchases are offered outside the App Store, we will name the payment provider here first.

10. Exporting your data

Choose File ▸ Export CSV… (Command Shift E) to save every entry, with its category, description, tags, times and links, as a CSV file you can open anywhere.

11. Deleting your data

  • Entries: TimeBolt ▸ Settings ▸ General ▸ Data ▸ Delete All Data… permanently deletes all activities, time entries and tags.
  • Integrations: Disconnect each account in Settings ▸ Integrations to remove its key or token and cached tasks.
  • Everything: quit TimeBolt and delete its data folder (section 2). For the Mac App Store and TestFlight versions, deleting ~/Library/Containers/com.treesong.timebolt removes all of TimeBolt's files. For the direct download, also delete ~/Library/Preferences/com.treesong.timebolt.plist and ~/Library/Caches/com.treesong.timebolt. Any remaining keychain items are listed in Keychain Access under com.treesong.timebolt.integrations.
  • Calendar access: remove it in System Settings ▸ Privacy & Security ▸ Calendars.
  • Data we hold: to delete your emails with us, or online service records once the service exists, write to support@timebolt.cloud.

12. Your rights

Depending on where you live, data protection law (such as the GDPR in the EU and UK, or the CCPA in California) may give you the right to access, correct, delete, restrict or object to the use of your personal data, and to receive a copy of it.

Because your TimeBolt data stays on your Mac, you can do most of this yourself in the app: view and edit entries, export them, and delete them. For anything we hold, such as emails or online service records, write to support@timebolt.cloud. We will answer within the time the law allows, normally one month. You may also complain to your local data protection authority.

Where the GDPR applies, we rely on these legal bases: to provide a feature you asked for (performance of a contract) for the online service; and our legitimate interests in answering your messages and in running and securing this website.

We do not sell or share personal information as those terms are defined in California law.

13. Security

Your data on your Mac is protected by macOS: FileVault disk encryption if you use it, the App Sandbox for the Mac App Store version, and the Keychain for sign-ins. Connections to other services use HTTPS. No system is perfectly secure, so please keep your Mac up to date and backed up.

14. Children

TimeBolt is not directed at children under 13, and we don't knowingly collect personal data from them.

15. International transfers

We and the providers we use, such as Google for hosting and Apple for distribution, may process the limited data described here in the United States and other countries. Where the law requires it, these transfers are covered by safeguards such as the European Commission's Standard Contractual Clauses.

16. Changes to this policy

We will post any change on this page and update the effective date. If a change is significant, such as a new kind of data leaving your Mac, we will say so in the app or on this site before it takes effect.

17. Contact

Questions or requests about privacy: support@timebolt.cloud.

[LEGAL NAME]
[POSTAL ADDRESS]