Privacy policy

Last updated: 8 October 2026

Who we are

UseTimer (https://usetimer.app) is operated by Avi Ezra, Israel. Privacy questions and requests: [email protected].

What we collect

• Account details: email address, display name, time zone, language and preferences. Passwords are stored only as a one-way hash.
• Work data you enter: time entries, descriptions, clients, projects, tasks, tags, rates, reports, team settings and files you import.
• Sessions and security: a session cookie, the device name you choose, IP address, browser type, sign-in times and audit records of sensitive actions.
• Fiduso identity links and purchases: UseTimer user identifier, Fiduso account identifier (subject) and profile including display name and primary email; link confirmation, purchase identifiers, plan, member quantity, entitlement period, and purchase and entitlement status. UseTimer does not receive or store credit-card details.
• System email: delivery status of verification, recovery and invitation messages.

There are no ads, no sale of data and no third-party tracking cookies.

Browser speech dictation

Where supported by your browser, dictation starts only at your direction, after an in-product disclosure and the browser's microphone permission. Audio may be sent to the browser provider's recognition service; that processing is subject to the recognition provider's terms and privacy policy. Recognition may require an internet connection. UseTimer does not promise local processing or offline recognition.

UseTimer does not save an audio file. The recognized text may be stored as a time-entry description, in a local draft or in the synchronization queue, depending on your action and the system state. Once saved as work data, it follows the work-data retention, sharing and deletion rules in this policy. You can cancel dictation or choose to type a description instead.

How we use it

Only to provide the service: sign-in, storing and syncing your work, reports, sharing with team members you invite, system email, linking account identities, assigning purchases and enabling Pro or Team entitlements, resolving billing and cancellation/refund requests, abuse prevention and account security.

Cookies and browser storage

One essential cookie, timer_session (HttpOnly, Secure, SameSite=Strict). The browser also keeps a local copy of your data and pending changes so the app works offline; signing out lets you clear it.

Service providers and recipients

Cloudflare (DNS, TLS and attack protection; site traffic passes through it), Brevo (system email: recipient address and message content) and the virtual server that hosts the service, its database and backups. Some providers may handle data outside Israel.

Fiduso: account linking, checkout, billing, invoices, purchase management, cancellations and refunds. When you link accounts, UseTimer sends its user identifier to Fiduso and receives the Fiduso account identifier, profile and link confirmation. Fiduso sends UseTimer purchase and entitlement information needed to activate and update your plan. Card details are supplied in Fiduso’s checkout, not to UseTimer. Information provided at checkout is also processed by Fiduso. At this update we have no link to a public Fiduso privacy policy; contact us for clarification before linking accounts or purchasing.

Sharing

In addition to processing by the providers described above, sharing at your direction includes members of workspaces you belong to, or anyone you send a shared report link. We disclose data to authorities only when legally required.

Connections to other systems

A connection to an external service, such as Zync, requires your approval for a specific workspace and permissions. The connected service may receive user and workspace identifiers, catalog details and time entries within those permissions. A webhook sends change metadata and the workspace identifier; content is fetched only with authorization. Revoke the connection token in account settings to stop further access. Revocation does not automatically delete information already copied by the connected service; deletion is also subject to that service’s policy.

Retention

Account and work data are retained to operate your account and the service. Deletion in the app may be logical (soft) deletion: the record is marked deleted but remains in storage until actual removal. Marking a record deleted or requesting account deletion does not guarantee immediate removal from every copy. Deletion requests are assessed according to the type of information, the need to operate the service and applicable legal retention obligations. Identity-link details and confirmations, purchases and entitlements are retained to manage the link and subscription, resolve billing, cancellations and refunds, prevent fraud and meet applicable legal obligations. Cancelling a subscription does not automatically delete these records. Deletion requests are assessed against the need to retain records for those purposes; we do not promise deletion of records that must legally be kept. Information already provided to Fiduso is managed there; contact us to clarify a deletion request concerning the link. Shared links expire as you set them. Technical logs and audit records are retained for security, abuse prevention and troubleshooting; billing and accounting records are retained as needed to resolve transactions and meet legal obligations. Retention depends on the purpose, incidents requiring investigation and applicable legal obligations, rather than a single period for all information. Backups may retain data deleted from the active system until they are replaced or removed through backup rotation. Deletion from the active system does not immediately remove data from backups.

Your rights

You may access, correct and export your data and ask for your account and data to be deleted, subject to retaining records required for the purposes above or by law. Email [email protected] from your account address where possible to help verify the request. We will acknowledge and review the request, including any need for identity verification and continued record retention, subject to mandatory deadlines under applicable law. You may also contact the Israeli Privacy Protection Authority.

Security

Traffic is encrypted (HTTPS), passwords are hashed, access is checked per account and permission, and backups are access-restricted. If a breach affects you, we will tell you.

Children

The service is for professional use and not intended for children under 16.

Changes

Updates are published on this page; material changes are announced by email or in the app before they take effect.