Privacy policy

Hourweave is run by Fronsline Technologies (“we”, “us”). This policy explains what we collect when you use hourweave.com and the Hourweave CLI, why, and what you can do about it. Questions: hello@hourweave.com.

What we collect

• Account details: your name, email address and password (stored only as a secure hash), or the profile your sign-in provider shares (GitHub or Google).
• Workspace data you add: clients, projects, rates, time entries, notes, tags, invoices, payments you record and the people you invite.
• Connected sources, only if you connect them: commit metadata from GitHub, GitLab or Bitbucket (message, author, time, repository, lines changed), and issue titles, keys and estimates from Linear or Jira. We never read or store your source code.
• AI session metadata from the CLI: the tool used (Claude Code, Codex, Cursor), the project folder, branch, session title, timestamps of activity, prompt counts and lines changed. Your prompts, the AI’s replies and your code stay on your machine.
• Billing: your plan and billing address. Card details go straight to Stripe; we never see or store them.
• Technical data: IP address and browser details in server logs, used for security, rate limiting and debugging.

How we use it

• To run Hourweave: draft your timesheet, build reports and invoices, show your clients what you share with them.
• To bill your subscription and send service emails such as invitations, invoices you send, and payment notices.
• To keep the service secure and working, and to fix problems.

We don’t sell your data, show ads, or use your workspace data to train AI models.

Who processes it for us

• Vercel (hosting) and Neon (database), with data stored in Singapore.
• Stripe (subscription payments).
• Resend (email delivery).
• GitHub, GitLab, Bitbucket, Linear and Jira, only when you connect them.

Each processes data only to provide its service to us. Some are based outside India, so your data may be processed in other countries.

Cookies

We use only the cookies needed to keep you signed in and to remember your theme. There are no tracking or advertising cookies.

Your clients

If you share a client portal, your client sees only what you choose to show them. When you add client contacts, you are responsible for having the right to share their details with us.

Keeping and deleting data

We keep your data while your account is active. Workspace owners can delete a workspace at any time in Settings, which permanently deletes its data. To delete your account, email us. Backups roll off within 30 days, and we keep billing records as long as tax law requires.

Your rights

You can access, correct, export or delete your personal data, and withdraw consent where we rely on it. Write to hello@hourweave.com and we’ll reply within 30 days. This includes your rights under India’s Digital Personal Data Protection Act, 2023 and, where it applies, the GDPR.

Security

Data is encrypted in transit, integration tokens are encrypted at rest, passwords are hashed, and every workspace is isolated from the others. No system is perfectly secure; if a breach affects you, we’ll tell you promptly.

Children

Hourweave is for businesses and isn’t meant for anyone under 18.

Changes

If we change this policy in a way that matters, we’ll email account owners before it takes effect.