Privacy Policy

HourFlow is a time-tracking app for tutoring teams. Tutors and administrators use it to record when tutoring sessions start and end. This policy explains what information HourFlow collects, how it is used, who can see it, and the choices you have.

Information we collect

Account information

When you sign up we collect your name, email address, password, and role (tutor or administrator). Passwords are handled by our authentication provider and are never stored in plain text. If you join with an invite code, we record which administrator's team you belong to.

Time records

We store the start and end time of each session, the time zone it was recorded in, and its category: Google Meet (recorded automatically from Google Meet) or out of classroom ("OOC", entered with the clock in / clock out buttons). For OOC sessions we also store the optional description you write when you clock out.

Google account and Google Meet data

Connecting Google Meet is optional. If you choose to connect it, we request read-only access to your Google Meet activity (the meetings.space.readonly permission) plus your basic Google account identity (openid and email). With that access we collect:

• Your Google account ID and Google email address.
• An access credential (a refresh token) that lets HourFlow check your Meet activity without asking you to sign in each time.
• For meetings that you host with the connected account: the meeting's start and end time and the times you joined and left.

To find your own join and leave times, HourFlow reads the meeting's participant list from Google. We use it only to locate your entry and do not store other participants' names, email addresses, or attendance. HourFlow does not access meeting audio, video, chat, recordings, transcripts, or the contents of your calendar, email, or files.

How we use information

• To create your account and sign you in.
• To record your tutoring sessions, either from your manual clock in / clock out or automatically from the Google Meet meetings you host.
• To show your hours to you and to the administrator of the team you joined, including calendars, tables, and PDF time reports.
• To send account emails such as sign-up confirmation.

We do not use your information for advertising, we do not sell it, and we do not use Google data to train AI or machine learning models.

Google API Services disclosure

HourFlow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the time-tracking feature described above and is not transferred to others except as needed to provide that feature, to comply with the law, or as part of a merger or acquisition with notice to users. HourFlow staff do not read your Google data unless you ask us to for support, it is needed for security, or it is required by law.

Who can see your information

• You can see your own account, time records, and Google connection status.
• Your administrator can see your name, your time records with their category and descriptions, and whether your Google Meet is connected (including the connected Google email).
• Service providers that run HourFlow on our behalf: Supabase (database and authentication), Vercel (hosting), and our email delivery provider. They process data only to provide their services to us.

Your Google access credential is stored on our servers and is never sent to your browser or shown to your administrator.

Retention and deletion

• Account information and time records are kept while your account is active so your team has an accurate history of hours worked.
• Google keeps meeting records for about 30 days. HourFlow only keeps the session times it creates from them.
• When you click Disconnecton your dashboard, we revoke HourFlow's access with Google and delete your stored Google credential and Google account details. Sessions already recorded stay in your time history.
• To delete your account and associated data, email us at the address below. We will process the request within 30 days.

You can also remove HourFlow's access at any time from your Google Account permissions page.

Security

Data is sent over encrypted HTTPS connections. Database access is restricted so each person can only read the records they are allowed to see, and Google credentials can only be read by HourFlow's server. No system is perfectly secure, but we work to protect your information and limit who can access it.

Children

HourFlow is intended for tutors and administrators, not students. It is not directed to children under 13, and we do not knowingly collect their personal information.

Changes to this policy

If we change this policy we will update the effective date above. For significant changes, especially to how Google data is used, we will notify users before the change takes effect.

Contact

Questions or requests about your data? Email privacy@yourdomain.com.