Privacy Policy
Last updated: 29 March 2026
1. Introduction
TMRW Timesheet ("the App") is an internal time-tracking and project management tool operated by TMRW. This policy explains what data we collect, how we use it, and your rights.
2. Data We Collect
- Account information — name, email address, and profile photo provided during Google sign-in.
- Timesheet data — time entries, project assignments, and related notes you create within the App.
- Google Calendar data (read-only) — when you use the Calendar Sync feature, we fetch your calendar event titles, dates, and durations for the selected week. This data is used solely to pre-fill timesheet entries and is not stored permanently.
3. How We Use Your Data
- To authenticate your identity and manage your account.
- To record and display your timesheet entries.
- To pre-fill timesheet entries from your Google Calendar events when you explicitly initiate a sync.
- To generate reports and invoices for project management.
4. Google Calendar Access
The App requests read-only access to your Google Calendar (calendar.readonly). We:
- Only read calendar events — we never create, modify, or delete your events.
- Do not store calendar data permanently — events are fetched on demand and held in memory only during your import session.
- Do not store your Google credentials long-term — we use the short-lived OAuth token from your sign-in session.
- Do not share your calendar data with any third parties.
5. Data Storage
Account and timesheet data is stored securely in a hosted database (Supabase) with row-level security policies. Access is restricted to authenticated users and authorised administrators.
6. Data Sharing
We do not sell or share your personal data with third parties. Data may be shared with:
- Infrastructure providers (Supabase, Vercel) that host the App, under their respective privacy policies.
- Organisation administrators who manage projects, teams, and reporting within the App.
7. Data Retention & Deletion
Your data is retained for as long as your account is active. You may request deletion of your account and associated data by contacting your organisation administrator.
8. Your Rights
You may:
- Access and export your timesheet data.
- Revoke Google Calendar access at any time via your Google Account permissions.
- Request account deletion through your administrator.