Who this policy covers
Verified Hours operates the website, account service and connected time-verification features at verified-hours.com. This policy covers the desktop app, browser companion, website and backend, including individual users and company workspaces. Your company is responsible for its own reasons for monitoring work, its instructions to workers and copies it exports. Verified Hours processes company records to deliver that workspace service and handles account and security information to operate the service.
Account and authentication information
We process your email, name, account type, organization membership, device name/public key and authentication records. Passwords are transmitted over HTTPS and stored as password hashes. Verification/reset codes and session credentials are time-limited. Google sign-in supplies a verified email, name and Google account identifier; we do not request access to your email inbox or cloud documents. Network IP addresses and request headers are processed to serve and protect requests. Rate-limit identifiers are hashed where supported by the active account service.
Personal activity and local storage
The desktop stores detailed timelines, projects, billing and bank-transfer details, classification results, corrections and invoices in a local SQLite database. Privacy & data shows the exact location. The database is not encrypted by the application; protect your device and backups. Account credentials use the operating system’s secure-storage facility. Local storage does not mean no remote processing occurs.
While a session runs, the app observes the foreground app/window, browser tab title/address and idle state. The companion communicates with the desktop over a loopback connection on your computer. The local browser-context pipeline removes URL credentials, query strings and fragments and redacts certain resource IDs; remaining paths and titles may still identify work. Screenshots, keystrokes, clipboard contents, full webpages and document contents are not captured by the normal monitoring pipeline. Personal-mode timelines are not uploaded as company history, but AI context still leaves the device.
Company records and administrator access
Company sessions upload project and task names, application names, session and activity times, durations, idle status and verification states, including excluded intervals. Your company administrators can review these records. Website addresses, window/page titles, screenshots, keystrokes and local files are not included in company history.
Membership connects uploaded records to your name, account and company. Company administrators can see current working/idle/paused status, project and task names, app names, start/end times, elapsed and verified durations, and interval verification states. This includes excluded intervals. They cannot retrieve local window/page titles, URLs, local files, screenshots, passwords or earlier personal sessions through the company-history feature. An administrator’s exported copies are outside the app’s deletion controls.
Before company sharing starts, an acknowledgement is recorded with your account, company, disclosure version and timestamp. This is an acknowledgement of the feature’s operation, not a claim of employee GDPR consent. Company history is an automatic feature of acknowledged company sessions.
AI-assisted features
The desktop sends sanitized application names, a short window/page title where useful, a domain and project/task context through our backend to OpenAI. Email/messaging and supported private-document titles are omitted. URL paths, queries and fragments, client-name fields, account/company IDs, device credentials, resource signals and previous activity records are excluded from the model payload. Automated filters redact email addresses, obvious secrets and local filesystem paths; they cannot reliably remove all names or confidential meaning from free text. Use only context you are authorized to process remotely. Project/task context is also sent to check whether a proposed session task is clear enough. AI estimates relevance; you can confirm or exclude activity in review, and results may be wrong.
Model results, attempts and user review decisions are stored locally. Backend response caching supports safe retries and is limited to 15 minutes. Both OpenAI request paths set response storage off. That setting is not a promise of zero provider retention: OpenAI may retain content for security/abuse monitoring under its applicable controls. See OpenAI API data controls. We do not send account credentials or deliberate identity fields to the model.
What is stored on the backend
Server records include accounts and devices, authentication and security records, memberships and invitations, company sessions and their interval metadata, sharing acknowledgements, deletion cutoffs, cached AI responses, limited admin-access audit events, privacy requests, outreach provenance and email suppressions. Deletion cutoffs record only an account and timestamp so old queued sessions cannot restore deleted history. Application logs exclude passwords, bearer tokens and raw AI/activity payloads; the web server uses a log format that omits query strings.
Providers and international processing
OpenAI processes limited text context for AI features; Resend delivers verification, password-reset and invitation emails; Google processes sign-in when you choose it; DigitalOcean hosts our backend on a droplet in Frankfurt, Germany. These providers receive the data needed for those services. We do not integrate a payment processor, advertising network or product analytics provider.
Processing by service providers may take place outside your country, including outside the European Economic Area. The Frankfurt server location does not mean all processing remains in Europe. Applicable provider agreements and lawful transfer safeguards govern those transfers; this notice does not promise a particular data-residency or zero-retention configuration.
Billing, support and outreach
Invoice rates, addresses, tax settings and bank-transfer instructions are stored locally and appear in exports you choose to share. Verified Hours does not currently charge subscriptions or process card payments in this implementation. Privacy-request messages are stored for the service operator to review; avoid sending sensitive work content. Invitations use the recipient email/name and company name. Any outreach contact added through the included tooling requires a reviewed source, collection date, relevance and permission basis. Available do-not-contact disclaimers cause exclusion. Suppression is checked before every invitation or outreach provider call. Unsubscribe links and the account opt-out stop future invitations and outreach; requested account-security email is separate.
Cookies, browser storage and analytics
The website uses essential HttpOnly cookies: vh_identity for the signed-in session (up to 30 days) and vh_google for Google sign-in continuity (10 minutes). Cookies use SameSite and Secure outside local development. Session storage keeps temporary download, desktop-connection and invitation continuation information. There are no product analytics scripts, advertising cookies or visitor-fingerprinting tools in the website. Fonts, website demo and 3D resources are hosted with the site. No non-essential tracker is activated, so no advertising-cookie consent banner is used.
Retention
Company sessions and interval records expire at most 90 days after session start. The server runs cleanup hourly and checks expiry before serving company history or exports. A deployment may use a shorter period, shown in Privacy & data. Raw AI inputs are processed in memory rather than saved as a request archive. Classification responses are cached for up to 15 minutes; expired cache entries are removed by hourly cleanup. Security rate-limit and usage records last up to two days; account/admin audit events and privacy requests up to 90 days. Expired authentication flows are removed by hourly cleanup. Expired company invitations are removed within 30 days after expiry. Account/profile records remain until account deletion. Suppression records and unsubscribe tokens remain to honour opt-outs. Reviewed outreach provenance expires after 90 days. Restricted database backups expire within 14 days; server access/error logs are configured for up to 14 days. Local databases, imported backups and exported files remain until you remove them.
Export and deletion
Privacy & data provides a JSON export of your account, membership, remote company history, available cached classifications, acknowledgement and privacy requests. Authentication secrets and internal security records are excluded. Detailed local records remain in the desktop app.
Delete my remote history removes your active company sessions/intervals and cached AI responses, and prevents sessions started before deletion from uploading again. Clear local history removes local sessions, AI records, reviews and saved invoices but keeps projects, billing details, imported backups and external files. Deleting a project is also local only. Use both controls if you want both copies removed.
Delete my account removes the active profile, authentication, membership and associated remote records and signs you out. A company administrator must remove coworkers before deleting the administrator account; this also deletes the workspace and its remaining company history. Removing a coworker alone ends access but retains company history until expiry or an applicable deletion action. Suppression records remain to prevent unwanted email. Restricted backups expire within 14 days; local databases, imported backups and downloaded exports must be removed separately. Uninstalling does not reliably remove local data.
Purposes, legal bases and rights
We process account and work-verification information to provide requested services and administer company workspaces. Where GDPR applies, service delivery relies on performance of a contract where applicable; service security and prevention of abuse rely on legitimate interests; legal obligations may require specific processing. A company must identify its own lawful basis and provide required worker notices. We do not rely on the sharing acknowledgement as a substitute for that assessment. Optional processing requiring consent must have a valid choice before it begins.
Depending on the law that applies, you may request access, correction, erasure, restriction, portability or object to processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. We may verify your identity to protect records. You may complain to your local data-protection authority. AI results assist review; they are not a binding employment, tax or payment decision.
Security and children
We use HTTPS, device authentication, scoped company access, hashed authentication secrets and operating-system credential storage. Authorized service operators can technically inspect server records and information processed by the backend; the service is not end-to-end encrypted. Protect your device, account and exported records. No system can guarantee perfect security. Verified Hours is intended for adults managing professional work and is not directed to children.
Contact and changes
Use Privacy & data to submit a privacy request to the service operator, export records or delete data. Sign in to identify your account securely. If your question concerns your company’s use of work records, you can also contact your company administrator. Invitation recipients can use the unsubscribe link without creating an account.
This policy is effective 6 October 2026. We will update the date when practices change and provide appropriate notice of material changes. A changed company-sharing disclosure requires a new acknowledgement before further company uploads.