How your data works
- Your computer
The app records foreground activity during sessions into your local database.
- AI processing
Limited sanitized text goes through Verified Hours to OpenAI to check context and estimate relevance.
- Company workspace
After acknowledgement, selected company session records upload for authorized company administrators.
- Your controls
Review results, export remote data, clear local history, delete remote history or delete your account.
Where is my activity stored?
The desktop stores detailed timelines, projects, billing and bank-transfer details, classification results, corrections and invoices in a local SQLite database. Privacy & data shows the exact location. The database is not encrypted by the application; protect your device and backups. Account credentials use the operating system’s secure-storage facility. Local storage does not mean no remote processing occurs.
What changes when I join a company?
Company sessions upload project and task names, application names, session and activity times, durations, idle status and verification states, including excluded intervals. Your company administrators can review these records. Website addresses, window/page titles, screenshots, keystrokes and local files are not included in company history.
Personal sessions recorded before joining are not included in company history. Sharing is acknowledged with a version and date before company recording starts.
What can administrators and staff see?
Your company administrators see your name/email, session project/task, app names, timings, duration, live working/idle/paused status and verification states, including excluded intervals. They do not receive window/page titles or website addresses through company history. Verified Hours server operators can technically access backend records and AI requests during processing. The service does not provide end-to-end encryption or remote access to your local files.
Are screenshots or keystrokes uploaded?
No. The normal capture pipeline records metadata, not screen images, keystrokes, clipboard contents or full documents. Website demonstrations use simulated records and do not monitor visitors.
Are full URLs stored or sent to AI?
Local records can contain sanitized URL paths. Query strings, fragments and URL credentials are removed before local storage. Company history includes no URLs or domains. AI receives a domain only, with no URL path/query/fragment. Titles and user-entered context can still contain identifying information despite redaction.
What does AI receive, and why?
The desktop sends sanitized application names, a short window/page title where useful, a domain and project/task context through our backend to OpenAI. Email/messaging and supported private-document titles are omitted. URL paths, queries and fragments, client-name fields, account/company IDs, device credentials, resource signals and previous activity records are excluded from the model payload. Automated filters redact email addresses, obvious secrets and local filesystem paths; they cannot reliably remove all names or confidential meaning from free text. Use only context you are authorized to process remotely. Project/task context is also sent to check whether a proposed session task is clear enough. AI estimates relevance; you can confirm or exclude activity in review, and results may be wrong.
AI results are stored locally, with a short backend response cache. You can correct verification decisions. OpenAI response storage is disabled; separate provider security retention may apply.
How long is remote data kept?
Company sessions and interval records expire at most 90 days after session start. The server runs cleanup hourly and checks expiry before serving company history or exports. A deployment may use a shorter period, shown in Privacy & data. Raw AI inputs are processed in memory rather than saved as a request archive. Classification responses are cached for up to 15 minutes; expired cache entries are removed by hourly cleanup. Security rate-limit and usage records last up to two days; account/admin audit events and privacy requests up to 90 days. Expired authentication flows are removed by hourly cleanup. Expired company invitations are removed within 30 days after expiry. Account/profile records remain until account deletion. Suppression records and unsubscribe tokens remain to honour opt-outs. Reviewed outreach provenance expires after 90 days. Restricted database backups expire within 14 days; server access/error logs are configured for up to 14 days. Local databases, imported backups and exported files remain until you remove them.
How do I export or delete data?
Open Privacy & data in your browser or the desktop settings. Export my remote data downloads JSON. Delete my remote history erases active company records and cached AI outputs, and blocks re-upload of those older sessions. Account deletion removes active account and remote records. Clear local history is available on the desktop and leaves remote records separate.
Uninstalling does not guarantee removal of your local database. Projects, billing details, external exports and import backups have separate lifetimes. If you delete a coworker as an administrator, their historical company work remains until expiry or deletion; that button ends access.
Is data sold or used for advertising?
The implemented service has no data-sale, advertising, product-analytics or third-party visitor-tracking integration. Authentication cookies and temporary browser storage support account flows. No advertising-cookie banner is needed for this setup.
Who provides connected services?
OpenAI processes limited text context for AI features; Resend delivers verification, password-reset and invitation emails; Google processes sign-in when you choose it; DigitalOcean hosts our backend on a droplet in Frankfurt, Germany. These providers receive the data needed for those services. We do not integrate a payment processor, advertising network or product analytics provider.
How can I contact Verified Hours?
Use Privacy & data to submit a privacy request to the service operator, export records or delete data. Sign in to identify your account securely. If your question concerns your company’s use of work records, you can also contact your company administrator. Invitation recipients can use the unsubscribe link without creating an account.