Privacy policy

Who runs this

TPM Tracker is operated by an individual, not a company. Questions about anything on this page can go to hello@tpmtracker.com.

Personal space and teams

Everything in TPM Tracker lives in a workspace, and there are two kinds. Most of this policy depends on which one something is in.

• Your personal space. Every account has one. It is private to you: nobody else can be added to it, and no other account can read anything in it. Today, reviews, waiting on, meetings, notes, the weekly review and people always live here, as do your personal tasks, documents, templates, projects and time.
• Teams. A team is a shared workspace that somebody creates and invites people into. Whatever is created in a team, such as tasks, sprints, epics, boards, documents, retros and comments, is visible to every member of that team. Only people who have accepted an invitation are members.

Nothing moves from your personal space into a team unless you put it there, and you can always tell which space you are in from the sidebar.

What is stored, and why

Your account

Your email address, which is how you sign in and how we reach you. If you sign in with Google, your name and profile picture URL when Google provides them. Your timezone, so that due dates, the Today screen and time entries land on the right day for you. And which team you last chose, so the app reopens on it.

If you sign in with a password, only a cryptographic hash of it is stored. Nobody, including the operator, can read your password.

What you put into the app

Everything you create: tasks, reviews, things you are waiting on, follow-ups and their activity history, notes, meetings, people, projects and tags; documents and their earlier versions; sprints, epics, boards, retros and votes; time-off requests; comments and the people you mention; files you attach; templates, custom statuses and fields, and page settings. This is stored so the app can show it back to you and, in a team, to your teammates. It is used for no other purpose.

Time tracking

If you use timers or log time, each entry records who it belongs to, the day, the duration and the task or description you gave it. A running timer records when it started.

Time off

In a team you can ask for time off. A request records who it is for, the dates, its kind (such as vacation or sick leave), any note you add, and the answer: who gave it, when, and any reason. A team's admins can also record who your managers are, which allowance rule and holiday calendar apply to you, and how many vacation days you have in a year. Everyone in the team can see when you are away. The kind, the notes, requests not yet approved and your allowance are shown only to you, your managers and the team's owners and admins. Sick leave is recorded only as a kind of absence; there is no need to put medical details in the note.

Files you attach

Screenshots and other files you attach to a task or a comment, or put into a description, a note, meeting notes or a document, are stored with Cloudflare in the European Union, together with the file's name, type, size and who uploaded it. A file opens only for people in the workspace it was uploaded to, through a link that works for a few minutes. In your personal space, that is only you.

Invitations

When a team admin invites somebody, we store the invited email address, the team, who sent the invitation and when it expires. If email is set up, we send that address the link to join, and again if an admin resends it. An invitation lasts 14 days. One that is declined is kept as a record so it is not shown again, and does not stop a fresh invitation later.

Notifications

When somebody mentions you, replies to a thread you are in, or assigns you something in a team, a notification is stored for you. While the app is open, it reaches your browser over a live connection, so it appears without a reload. If you allow desktop notifications in your browser, it can also show one when the tab is in the background. That permission is asked for by your browser, and you can take it back there at any time.

Email

We send email only for these reasons:

• Confirming your email address and resetting a password
• Inviting somebody to a team, when an admin sends an invitation
• A daily digest of what needs your attention, but only if you switch it on in Account settings. It is off by default, and it lists only items that are yours: assigned to you, or created by you and not assigned to anybody else, in your personal space and your teams.

There is no marketing email and no newsletter.

Google Calendar, if you connect it

Connecting your calendar is optional and off by default. If you connect it, we request read-only access (calendar.readonly) and store a copy of events from your primary calendar in a window of 7 days back to 30 days ahead:

• Event title, description and location
• Start and end times
• Organiser email and attendee email addresses
• Meeting links and the link back to the event in Google Calendar

We also store the tokens Google issues so that syncing can continue without you being present. We never write to your calendar, and we do not read any calendar other than your primary one. Calendar events belong to your personal space and are never shown to a team.

Disconnecting removes the stored tokens and deletes every mirrored event immediately. You can also revoke access from your Google account permissions page.

Technical logs

The web server keeps standard request logs including IP address, the page requested and the time. These are used to keep the service running and to investigate faults. They are not linked to your account content.

Google API Services User Data Policy

TPM Tracker's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, calendar data obtained through Google APIs is:

• Used only to display your events inside the app to you
• Never shown to the members of any team you belong to
• Never transferred to anyone else, apart from the service providers named under Who we share data with who host the service on our behalf, or where required by law
• Never used for advertising
• Never sold
• Not read by humans, except with your explicit permission to debug a problem you have reported, or where required by law

What your teammates can see

Joining a team means sharing some things with its members. In a team:

• Members see each other's name, email address, profile picture and role, so that they can assign work and mention each other.
• Members see everything created in the team, and who created, changed or commented on it. The activity feed records changes by name.
• Your time entries are visible to you and to the team's owners and admins, not to other members.
• Owners and admins can invite and remove members, change roles, configure the team, and delete it. Deleting a team deletes everything in it.

Teammates never see anything in your personal space. The one place team work appears in your personal space is the Today screen, which lists open team tasks assigned to you, and only you see that.

If you leave a team, or are removed from it, you lose access to it straight away. What you created there stays with the team, since it is the team's shared record.

Who we share data with

We do not sell your data, and we do not give it to advertisers or data brokers. We do not hand it to anyone to use for their own purposes.

Running the service does mean a few companies handle data on our behalf. They may only act on our instructions, and they may not use anything they hold for their own ends. This is the complete list:

Google user data goes to no other company. In particular, none of it reaches an analytics service, an advertising network, an error reporting service or an AI model, because the app uses none of these. Calendar events are never included in any email.

Two other situations could cause data to leave, and neither is routine. We would hand over data if the law required it, such as under a valid court order. And if the service were ever transferred to somebody else, you would be told by email before it happened, with time to export your data and close your account.

The operator

Whoever runs a service like this has technical access to its server and database, and it would be wrong to pretend otherwise. That access is used to keep the service running. It is not used to read what you have written, except when you ask for help with a problem and agree to it, or where the law requires it.

Inside the app, the operator's admin page shows the list of accounts: email addresses, when each signed up and last signed in, and how many items each has. It does not show anyone's content.

We do not use advertising networks or third-party analytics.

How your data is protected

Keeping workspaces apart

• Every request for content is filtered to a workspace you are a member of. A workspace you are not in answers as if it did not exist, so nobody can even confirm that it is there.
• Links between records are checked too: a task in one workspace cannot be pointed at a person, project or sprint from another.
• Mentions only reach members of the team, so mentioning somebody outside it does not tell them anything.
• Automated tests walk every part of the API before each release and fail if anything is reachable without that filtering.

The keys to your calendar

When you connect your calendar, Google issues tokens that let the app read your events later without you being present. These are encrypted before they are written to the database, using AES-128 in CBC mode with HMAC-SHA256 authentication. The encryption key lives in the server's environment, never in the database and never in the source code. Anyone who obtained a copy of the database or a backup file would find unreadable ciphertext rather than working credentials.

If the app cannot encrypt a token, it refuses to store it and the connection fails. It will never fall back to saving one in plain text.

On the way to you

Everything between your browser and the app travels over TLS 1.2 or 1.3, including the live connection that carries notifications. Plain HTTP is redirected to HTTPS, and the site sends an HSTS header so that browsers refuse to connect insecurely afterwards. The app also talks to Google's APIs over TLS. The live connection only accepts this site as its origin, and checks every few minutes that you are still signed in.

On the server

• The database listens only on the server's own loopback address, so it cannot be reached from the internet at all.
• Secrets, including the encryption key and the Google client secret, sit in a file readable only by the account that runs the app.
• Backups stay on the same server under the same restrictions, and the encrypted tokens inside them stay encrypted.
• Administrative access to the server is limited to the operator, over SSH, using a key rather than a password.
• Dependencies are pinned to specific versions and updated deliberately, so an upstream change cannot arrive unnoticed.

Inside the app

• Session cookies are HttpOnly, Secure and SameSite, which keeps them away from JavaScript and off other sites.
• Form submissions are protected against cross-site request forgery.
• Passwords, where one is used at all, are stored as PBKDF2-SHA256 hashes and cannot be reversed.
• What you write in documents is checked against a fixed list of allowed formatting on the server, so a document cannot carry a script to the teammates who open it.
• Exported spreadsheets of time entries are escaped, so a cell cannot run as a formula when somebody opens the file.
• The app asks Google only for read-only calendar access, so it holds no permission to change or delete anything in your calendar.

No system is perfectly secure and it would be wrong to promise otherwise. If something does go wrong in a way that affects your data, you will be told by email, with what happened and what to do about it.

If you find a security problem, please report it to hello@tpmtracker.com rather than posting it publicly, and it will be dealt with promptly.

Where it is stored

On a private server in Germany, in a PostgreSQL database, with the protections described above. Files you attach are stored with Cloudflare, in the European Union. If you are outside the European Union, your data is stored there rather than where you live.

Connecting Google Calendar means your events are read from Google in the United States and stored on that German server.

How long it is kept

• Your content is kept until you, or a team admin for team content, delete it.
• Archiving hides an item from lists but keeps it. Deleting removes it, along with its subtasks.
• A document keeps its earlier versions so changes can be restored. They go when the document is deleted.
• A deleted comment leaves a placeholder, so the replies under it keep their place. Its text is no longer shown to anyone, and its files are deleted.
• An attached file is deleted when you remove it, or when what it is attached to is deleted. A file uploaded but never posted or saved is deleted after a week.
• Database backups are kept for 30 days, then deleted. Something you delete can therefore remain in a backup for up to 30 days.
• Server logs are rotated and discarded within a few weeks.

Deleting your account

Deleting your account from Account settings removes your sign-in, your profile, your email settings, your notifications, your Google Calendar connection and events, and every task, note, meeting, person, project and tag you created. This includes tasks you created in a team, so hand those over first if your teammates still need them.

Team records that are part of the team's shared history, such as documents, sprints, epics, boards, comments and time entries, stay with the team, with your name removed from them.

Documents, templates and time entries in your personal space are not yet removed automatically when the account goes. Until they are, email hello@tpmtracker.com after deleting your account and they will be removed by hand. Deletion cannot be undone.

What you can do

• Export your data as JSON from Account settings, at any time, and import it again later. Attached files are not in the export yet; download them from where they are attached
• Correct anything by editing it in the app
• Leave a team whenever you like (an owner hands ownership to somebody first)
• Switch off the digest email, or never switch it on
• Disconnect Google Calendar, which deletes the mirrored events
• Delete your account from Account settings

If you would like a copy of your data in another form, or have it removed on your behalf, email hello@tpmtracker.com.

Cookies and browser storage

Three cookies, all of them needed for the app to work: one that keeps you signed in, one that protects forms against cross-site request forgery, and one that remembers how wide you like the sidebar. Your browser also keeps a couple of preferences on your own device, such as light or dark mode and which reminders it has already shown you today. There are no tracking or advertising cookies. The time-off app has its own address and keeps its own sign-in cookie; moving between it and the app uses a one-time link that expires within two minutes.

Children

This app is meant for working adults and is not directed at children under 16.

Changes to this policy

If this policy changes in a way that affects how your data is handled, the date at the top will change and, for anything significant, you will be told by email.