TimeTracer privacy notice
TimeTracer tracks time and takes periodic screenshots of your screen while a session is running. This document sets out what is collected, who can see it, where it is held, how long it stays, and what you can require us to do about it.
If a sentence here is vague, email privacy@muslimspot.com and we will correct it.
- In effect from
- Last reviewed
- Questions to
- privacy@muslimspot.com
Who is responsible for your data
MuslimSpot is the data controller for everything described here. We decide what TimeTracer collects and why, and we are the people you hold responsible for it.
We do not have a statutory Data Protection Officer, because we are not of a size or type that requires one. Privacy questions go to a person, not a department: privacy@muslimspot.com.
The screenshots, first, because they are the sensitive part
TimeTracer takes pictures of your screen at intervals while a tracked session is running. That is the main thing the product does, and it is the most intrusive thing described here.
What is captured
The visible content of your screen at the moment of capture. If a private message, a bank page or an unrelated document is on screen when a capture happens, it is in the image. TimeTracer does not know what it is looking at and does not attempt to detect or redact sensitive content.
When
Only while a tracked session is running. Stop the timer and capture stops. There is no capture when the application is idle, when you are signed out, or when the application is closed. The desktop application indicates that a session is running while it is running.
Who can see them
- You, for your own sessions.
- The administrators of the workspace the session belongs to. If your employer or client set up the workspace, they can see your screenshots. That is the purpose of the product and you should assume it.
- Nobody outside that workspace. Not other customers, not other workspaces, and not any third party in the list below.
- Us, only when it is necessary to operate or fix the system, for example investigating a report that images are not loading. We do not browse them, and we will not hand them to anyone without a legal obligation that we would tell you about unless we were forbidden from doing so.
How the links work
A screenshot is served through a signed, time-limited URL rather than a permanent public address. A link that is copied out of the application stops working when it expires, instead of becoming a public image on the internet forever.
Turning it off
Capture is a setting. Whoever administers your workspace can turn it off, and the timer, the projects and the reports all still work. If you are an employee and you want it off, that is a conversation with your employer rather than with us, because they control the workspace.
If you are deploying this to a team
Tell them. In most of Europe you have your own obligations as an employer when you monitor staff, including telling them what is collected and why, and in some jurisdictions consulting them or their representatives first. Those obligations are yours, and we are not in a position to discharge them for you.
Everything TimeTracer collects, and why
That is the complete list. Nothing is collected “for product improvement” beyond what is here.
| What | Why | Lawful basis |
|---|---|---|
| Your name, e-mail address and a hash of your password. Your workspace membership and role. | To give you an account, let you sign in, and decide what you are allowed to see. | Performance of our contract with you. |
| Time entries: the project, your own description of the work, start and stop times, and which of your devices the session ran on. | This is the product. It is the record you came for. | Performance of our contract with you. |
| Screenshots taken during a tracked session. | To make a time entry evidenced rather than asserted. Described in full in the section above. | Performance of our contract with you, or, where your employer is the customer, their legitimate interest in verifying work they are paying for. |
| Request logs: your IP address, the time, what was requested, and your browser or application version. | Security, and the login rate limit that stops somebody guessing your password. | Our legitimate interest in keeping the service secure and available. |
| A browser push subscription, if you ask for notifications. This includes an endpoint URL at your browser vendor and the keys needed to encrypt a message to it. | To send the notifications you asked for. | Your consent, which you can withdraw in your browser at any time. |
| Your e-mail address, if you turn on digest e-mails. | To send you the digest. | Your consent. Turning the digest off stops it. |
| Update checks from the desktop application: the version you are on and your platform. | To tell the application whether a newer release exists. | Our legitimate interest in shipping security fixes to installed software. |
What TimeTracer does not do
- It does not log your keystrokes.
- It does not record your screen as video.
- It does not use your camera or microphone.
- It does not read your files, your e-mail or your browser history.
- It does not track your location. Your IP address appears in request logs, which implies a rough region, as it does for every website you visit.
- It makes no automated decision about you with a legal or significant effect. No scoring, no ranking, no productivity grade generated and acted on without a human.
Where your data is stored
On a single server that we own and administer, in a data centre in Lauterbourg, France, inside the European Union. The database and the screenshot files are both on that machine. There is no second region, no content delivery network in front of your data and no cloud provider holding it.
Connections to it are encrypted in transit with TLS. The database is not reachable from the internet. The application reaches it over the machine’s own internal network, authenticating as an account that can read and write one database and nothing else.
We take a backup every night to a private object storage bucket so that a disk failure is recoverable. That copy is the one place your data leaves our machine, and it is why Cloudflare appears in the list below.
The third parties involved, all of them
Four, and these are the only ones. If we add a fifth, this table changes before it happens.
| Who | What they do for us | What they can see | Where |
|---|---|---|---|
| Contabo GmbH | Owns the data centre and the physical machine our server runs on. They have physical custody of the disks. They are not given access to the application or the database. | Everything on the machine, in the sense that whoever holds the hardware could in principle reach it. Nothing is handed to them. | Lauterbourg, France (European Union) |
| Cloudflare, Inc. (R2 object storage) | Holds the nightly off-box backup, so that a failure of our machine is recoverable. The bucket is private and is not readable without our keys. | A copy of the database, uploaded files and screenshots, as they exist at the time of the nightly run. | Cloudflare's own network. The bucket is created with Cloudflare's automatic region selection, so we cannot state that every copy stays inside the EEA. Outside the EEA. |
| Twilio SendGrid (Twilio Inc.) | Sends application e-mail: the optional TimeTracer digest, and account mail such as a password reset. Mail you send to a muslimspot.com address does not go through them. That runs on our own mail server. | The recipient's e-mail address and the contents of the message sent to them. | United States and other locations in Twilio's network. Outside the EEA. |
| GitHub, Inc. (a Microsoft company) | Hosts the desktop application release files. When the desktop app checks for or downloads an update, it fetches the file from GitHub. | The IP address and user agent of the computer downloading an update, as any web server would. No account data and no screenshots. | United States and other locations in GitHub's network. Outside the EEA. |
Data leaving the European Economic Area
Three of the four are United States companies and may process data outside the EEA. Where that happens we rely on the European Commission’s Standard Contractual Clauses as incorporated into each provider’s data processing terms. If a backup copy of your screenshots being held by a United States company is not acceptable to you, that is a reason not to use TimeTracer.
What we do not use
- No analytics on this website.
- No advertising network, advertising pixel or conversion tracking.
- No third-party fonts. Both typefaces are served from our own server.
- No session recording, heatmaps or chat widget.
- No cookies, which is why there is no cookie banner.
- No selling or sharing of personal data.
How long we keep it
Two clocks run on everything, the live system and the backups. A deletion is immediate on the live system and takes a known number of weeks to clear the backups. Both are set out below.
In the live system
- Screenshots: kept for the period the workspace’s administrators set, and deleted when they or you delete them. There is no documented default yet. Ask your workspace administrator what yours is set to.
- Time entries and projects: kept while the account exists, because they are the record the product is for.
- Account details: kept while the account exists.
- Request logs: kept on the server only as long as they are useful for security review, and rotated off. They are not copied into the off-box backup.
- Push subscriptions: deleted when you turn notifications off, or when your browser tells us the subscription is dead.
In the backups
The off-box backup keeps fourteen daily copies and eight weekly copies. Anything removed by a nightly sync is also parked in a separate area for fourteen days, so that a mistaken deletion on our side is recoverable.
In practice something you delete today stops being visible in the product immediately, and the last backup copy of it ages out in about ten weeks. That second figure comes from the retention schedule above rather than from a rounder number.
When you close your account
Tell us and we delete your account, your time entries and your screenshots from the live system within thirty days. Backup copies then age out on the schedule above. We do not keep a shadow copy of a closed account.
Your rights under the GDPR
Because our server is in France and we are offering a service to people in the European Union, the General Data Protection Regulation applies. You have these rights, and exercising them is free and does not require a reason:
- Access. Ask what we hold about you and get a copy.
- Rectification. Have anything inaccurate corrected.
- Erasure. Have it deleted, subject to the backup schedule described above and to anything we are legally required to keep.
- Restriction. Ask us to stop processing it while a dispute about it is resolved.
- Portability. Get your data in a machine-readable form, or have it sent to somebody else.
- Objection. Object to processing we are doing on the basis of a legitimate interest.
- Withdrawing consent. For anything based on consent, such as notifications and digest emails, withdraw it at any time. Withdrawing it does not undo processing that already happened lawfully.
A note if your employer is the customer
Where your employer set up the workspace, they decide what is collected about you within it and we act on their instructions for that part. You can still ask us directly and we will help, and we will also tell them you asked. Some rights are only theirs to exercise, such as turning capture off or changing retention, and we will say so plainly.
How to ask
E-mail privacy@muslimspot.com. We will acknowledge it and answer within the month the Regulation allows, and sooner if it is a simple request.
If we get it wrong
You can complain to a supervisory authority. Because our processing happens in France, that is the Commission Nationale de l’Informatique et des Libertés (CNIL), and you may also complain to the authority in the country where you live or work. You do not have to come to us first.
Security, and what we would do if it went wrong
The machine runs a firewall that denies inbound traffic by default. The database and the administrative interfaces are not exposed to the internet, and that was verified by trying from outside rather than by reading the configuration. Passwords are stored as hashes, never in a readable form. Operating system security updates are applied automatically. Access to the server is limited to the people who administer it.
We are a small team running one machine. A very small number of people and systems can reach anything, and there is no separate security department.
If there were a breach affecting your data, we would notify the supervisory authority within the seventy-two hours the Regulation requires, and we would tell you directly: what happened, what was reached, what we have done, and what you should do. We would not wait for certainty about the details before telling you that it happened.
If you have found a vulnerability, please tell us at security@muslimspot.com. We will not threaten you for it.
Children
TimeTracer is a tool for working adults and is not intended for anyone under sixteen. We do not knowingly create accounts for children. If you believe a child has an account, tell us and we will delete it.
Changes to this notice
When we change something that matters, such as a new processor, a new category of data or a change in retention, we will update this page, change the dates at the top, and tell account holders by email before the change takes effect.
Small corrections, such as fixing a typo or clarifying a sentence, get the reviewed date updated and nothing more.
The company-wide policy, which covers this website and anything not specific to TimeTracer, is at the MuslimSpot privacy policy.