Privacy policy

1. Who we are

Hourmark is made and run by Stephen Adeniji, an independent developer in Nigeria. In this policy, “we” means him. Questions go to hello@stephenadeniji.com.

2. What we store, and why

Only what the app needs to do its job, which is billing your clients:

• Your email address, to sign you in with a one-time code. There are no passwords.
• Your business details: business name, logo, brand colour, currency, invoice number prefix and payment instructions. They're printed on your invoices.
• Your clients: the names, email addresses, currencies, hourly rates and notes you enter for them.
• Your work: time entries, invoices and their lines, amounts, dates and notes.
• What happened to each invoice: when it was sent, emailed, first opened by your client, and paid. “Viewed” records only when the invoice page was first opened, not who opened it or from where.

It's kept in your account so the app and the web dashboard show the same thing, and so your clients can open what you send them.

3. What your clients see

Each invoice you send has its own link. Anyone with the link can view that invoice and download its PDF, without an account: your business name, email address and logo, how to pay you, your client's name and email address, and the lines and totals. The links are long random strings that aren't listed anywhere. Drafts never have a working link, and voiding an invoice turns its link off.

4. Emails

We email you your sign-in codes, and once, after you sign up, a welcome with your first steps. When you choose to email an invoice, we send it to your client's address from “your business name via Hourmark”, with the PDF attached, and replies go to your own email address. If you write to us from “Contact support”, we keep your message with your account so we can follow up, and it's deleted with your account. We don't send newsletters or marketing.

5. Who else handles it

A few services run parts of Hourmark for us. They process your data only to provide their service, under their own privacy terms, and may do so outside Nigeria:

• Supabase stores the database and logos, and handles sign-in.
• Vercel hosts the website and the invoice pages your clients open. Like any website host, it logs requests (IP address, browser, time).
• Resend delivers our emails, and keeps delivery logs for a limited time.
• Sentry receives a report when the app or the website hits an error or crashes: what went wrong, where in our code, and the kind of device or browser. Reports don't include your name, email, IP address, or what's in your invoices, and invoice links are removed from them.
• Vercel Web Analytics counts visits to the website: which pages, and the country and kind of device. It uses no cookies and doesn't identify you, and invoice links are removed before anything is counted. The app has no analytics.
• Google Play delivers the Android app.

We don't sell your data or share it with anyone else.

6. What we don't do

• No ads, and no advertising or tracking libraries in the app or on the website.
• No product analytics: we don't record which screens you open or what you tap. Error reports and the website's visit counts (above) are the only exceptions, and neither identifies you.
• No payment card or bank logins. Clients pay you directly, outside the app.
• No reading your contacts, photos or files, except the logo you choose to upload.

7. Cookies and storage

The website uses one cookie, to keep you signed in, and remembers your light or dark choice in your browser's storage. There are no tracking or advertising cookies. On your phone, the app keeps you signed in and remembers a running timer until you stop it. If you allow notifications, it shows that timer in your notifications; they're made on your phone, and nothing about them is sent anywhere.

8. Keeping it safe

Everything travels over encrypted connections. The database only lets each account read and change its own records, enforced by the database itself, not just the app. Sign-in uses one-time codes sent to your email, so there's no password to leak.

9. How long we keep it, and deleting it

We keep your data for as long as you have an account. You can delete the account, and everything in it, at any time: in the app under Settings, Delete account, or on the web at /account/delete. It's removed straight away. Copies in our providers' routine backups and logs expire on their own schedules, usually within 30 days.

10. Your rights

You can see and correct your details in the app or on the web at any time, and delete them as above. Depending on where you live (for example under Nigeria's Data Protection Act 2023, or the GDPR in the UK and EU), you may also have the right to a copy of your data or to object to how it's used. Email us and we'll respond within 30 days.

11. Your clients' details

You decide what to store about your clients, and you're responsible for having a reason to (usually, that you're billing them). If a client asks us about their data, we'll point them to you, or remove it if you can't be reached.

12. Children

Hourmark is a tool for running a business and isn't meant for children.

13. Changes

If this policy changes in a way that matters, the date at the top changes, and the app's release notes say what changed.

14. Contact

Questions, requests or concerns: hello@stephenadeniji.com.