Privacy Policy
Last updated: 2026-10-30
Version 1, effective 2026-10-30.
Who we are
YourHourly is run by Gerald Ong, doing business as Mind Your Own, 7038 Kerr St, Vancouver, BC, Canada. This policy covers the YourHourly website and its free tracker, the iPhone and Android app, YourHourly Plus, our emails and invoice share links.
For your own details, we decide how they're used (we are the "controller"). For the client details you put on invoices, we handle them for you, to make and send your invoices.
Summary by how you use YourHourly
| How you use it | What we store | Where | How long |
|---|---|---|---|
| Website tracker, no account | Nothing. Your hours stay in your browser. | Your browser only | Until you clear your browser's site data |
| App guest profile | A random profile ID and what you enter: hours, jobs, rates, calendar, settings | Our servers | Until you delete it, or after 400 days with no activity |
| Account | Your email, sign-in details, business details and everything you enter | Our servers | Until you delete the account |
| Plus | Your plan, renewal date and store purchase IDs. Never your card number. | Our servers, plus Stripe, Apple or Google | While you subscribe, then as tax law requires |
| Ads (free only) | We store nothing. Google collects ad IDs and cookies. | See Google's policies |
The website
The free time tracker on the website needs no account. It keeps the hours, jobs, notes and rates you enter in your browser's local storage, on your device only. None of it is sent to us, and we can't see it. Clearing your browser's site data erases it. If you later create an account, the website asks whether to bring those hours into it. Only if you choose "Bring them in", it copies this browser's entries, jobs, rates, pay rules and time-off settings to your account once; the pay and time-off settings replace the account's. The copy in your browser stays where it is.
Like any website, our host receives basic technical data when pages load (IP address, browser type, the page requested). We use it only to run and secure the site. If you write to us through the contact form, we receive what you send.
Calculators. The Pay Calculator doesn't save your numbers. They live in the page address (URL), so you can bookmark or share a result. We don't store them in an account or a database. Like any web address, a link with numbers in it can show up in our host's request logs when the page loads.
The app and accounts
Guest profile. On first launch the app creates a guest profile for that device: a random ID, no name, email or phone number. The hours, jobs, pay rates, calendar entries and settings you enter are stored on our servers under it.
Account. If you choose "Back up with an account" or sign in on the website, we also store your email address, a hashed password (or a Google or Apple sign-in token), and any business details you add: name, company, phone, address, tax numbers and your "How to pay" text. Your guest data moves onto that account. With YourHourly Plus, we also keep a change history for each entry (when it changed and what changed).
Invoices and clients. We store the client details you enter (name, company, contact details), line items and totals. When you send an invoice, anyone with its share link can see it.
Expenses, trips and receipt photos. We store the amounts, vendors, categories and receipt photos you add, and the places, distances and purpose of trips you log. When you upload a photo, we remove all its hidden data, including GPS location, before we store it. A photo can still show other personal details, so only add what you need. Your expenses, trips and receipt photos are in your data download (the ZIP), and a photo is deleted when you delete its expense or your account.
Purchases. If you subscribe on the website, Stripe takes your card details and email. We receive a customer ID, the subscription status and its renewal date; we never receive or store your card number. If you subscribe in the app, Apple or Google handles the payment, and we receive the plan, renewal state, store transaction IDs and country.
Technical data. IP address, device and system version, app version, crash and error logs, and your timezone (used to put your hours on the right day).
Emails. Emails you need (sign-in, password reset, receipts, invoices you send) go through our email provider, which logs delivery. We send marketing emails only if you agree, and you can stop them any time.
We use all of this only to run YourHourly: showing your hours, making reports, PDFs and invoices, sending the emails you ask for, handling billing, preventing abuse and fixing problems.
Legal bases (EEA and UK). We rely on our contract with you to run the service, on our legitimate interests for security and fixing problems, on consent for personalized ads and marketing emails, and on legal obligations for tax records.
What we don't do
We don't sell your data for money. We never use your hours, clients or invoices for advertising, and we don't use them to train AI models. We don't use an analytics service.
Under California law, letting Google show personalized ads on our free pages can count as "sharing" personal information. You can opt out; see Advertising below.
Advertising
The website is free because of one small ad. We use Google AdSense to show it on some pages (never on the public invoice pages we send to your clients). Google and its partners may use cookies and similar technologies to show ads based on your visits to this and other sites. You can opt out of personalized advertising at any time in Google's Ad Settings, and learn more in how Google uses information from sites that use its services.
The free app shows ads from Google AdMob. AdMob may use your device's advertising ID, IP address and similar data to show and measure ads. On iPhone, the app asks before it uses your advertising ID; if you say no, ads are not personalized. You can reset or delete your advertising ID in your phone's settings. YourHourly Plus subscribers see no ads; in the app, the ad tools don't run for them at all.
How consent works where you live:
- EEA, UK and Switzerland: we ask before loading ads or ad cookies. "Only necessary" is as easy as "Accept".
- Quebec: tracking for ads is off until you turn it on.
- Rest of Canada: you can opt out of personalized ads at any time.
- California and other US states with privacy laws: use "Do Not Sell or Share My Personal Information" on our Cookies and ads page. We also treat a Global Privacy Control signal from your browser as an opt-out.
Details are in our Cookies and ads notice.
Subprocessors
We share data only with the companies that help us run YourHourly, each under data-protection terms. Last changed 2026-10-30.
- Render — hosting and database, in US West (Oregon)
- Cloudflare R2 — storage for receipt photos and exports
- Stripe — payments for YourHourly Plus bought on the website (checkout, billing portal, renewals)
- RevenueCat — confirming YourHourly Plus bought in the App Store or Google Play
- Apple App Store / Google Play — the app download and in-app billing; we never receive your payment details
- Google AdSense — ads on the website (see Advertising above)
- Google AdMob — ads in the free app (see Advertising above)
- Resend — sending email (sign-in, password reset, receipts, invoices)
- Google / Apple — sign-in to an account, only where the app offers "Continue with Google" or "Continue with Apple" and you choose it
We also share data when the law requires it, to protect people from harm, or as part of a sale of the business (you'd be told). Anyone you give an invoice link to can see that invoice. We'll update this list when it changes.
International transfers
Our servers are in US West (Oregon), and our providers may process data in the US and other countries. If you're in Canada (including Quebec), your data is stored outside your province and outside Canada, where local laws apply to it. For the EEA and the UK, we rely on Standard Contractual Clauses, the UK addendum, or the EU-US Data Privacy Framework where a provider uses it.
Retention
| What | How long we keep it |
|---|---|
| Website tracker data | We never have it. It stays in your browser until you clear it (unless you bring it into an account). |
| Guest profiles | Deleted with all their data after 400 days with no activity. |
| Account data | Until you delete the account. |
| Deleted data | Gone from our backups within 30 days. |
| Invoice share links | Stop working when you delete the invoice or the account. |
| Purchase and tax records | As long as tax law requires (usually 6 to 7 years), even after you delete the account. We keep only what's needed. |
| Server and email logs | 30 days |
Security
Data is encrypted in transit (TLS) and at rest where our providers support it. Staff access is limited to what's needed, and we keep backups. No system is perfectly secure. If a breach puts you at risk, we'll tell you and the regulators as the law requires.
Your rights
Everyone can:
- see and download your data (a ZIP file, free, in Settings);
- correct it in the app or on the website;
- delete it: delete the account, or the guest profile, in Settings;
- withdraw consent, opt out of personalized ads, and stop marketing emails.
Canada (PIPEDA and Quebec Law 25). You can access and correct your data and withdraw consent. You can complain to the Office of the Privacy Commissioner of Canada, or in Quebec to the Commission d'accès à l'information. Quebec residents have tracking off by default.
EEA and UK (GDPR). You can ask to access, correct, erase, restrict or move your data, and object to how we use it. You can complain to your data protection authority.
US (California and other states). You can ask what we collect and why, and ask us to delete or correct it. You can opt out of the "sale" or "sharing" of your data for ads. We don't use sensitive data in ways that need a "limit" right. We won't treat you differently for using these rights. An authorized agent can ask for you with your signed permission.
To ask, email us from the address on your account. A guest profile has no email, so you can download or delete it yourself in the app's Settings; if you write to us, we may ask you to confirm from that device. We answer within 30 days (45 days where California law allows).
Children
YourHourly isn't made for children. No one under 13 (US and Canada) or under 16 (EEA and UK) may create an account. If we learn we have a child's data, we delete it.
Person responsible for privacy
Gerald Ong, owner is responsible for privacy at YourHourly. Write to them at hello@yourhourly.com or 7038 Kerr St, Vancouver, BC, Canada.
Changes to this policy
We'll post any update here with a new date. For a change that matters, we'll tell you at least 14 days before it takes effect, by email or in the app.
Contact
Questions about this policy or your data? Reach us at hello@yourhourly.com or the contact page.