Privacy Policy
1. Who we are
Service: TimeFlow — a Chrome browser extension for time tracking and productivity.
Operator: Apka Agent
Contact: support@apkaagent.tech
2. Information we collect
We collect only what is needed to provide the service:
2.1 Data stored locally in your browser
Most TimeFlow data stays on your device using Chrome's storage API (local and sync storage). This may include:
- Time entries (website domain or URL, duration, category, date)
- Productivity and focus scores
- Extension settings (categories, goals, blocklist, focus mode preferences)
- Authentication state (e.g. signed-in email, user identifier, subscription status)
This local data is used to display your dashboard and analytics. We do not upload your browsing history or time entries to our servers. Sign-in is optional and used for account management and Pro subscription only.
2.2 Account and authentication data
If you create an account or sign in, we may collect:
- Email address
- Password (stored as a one-way hash; we never store plain-text passwords)
- One-time verification codes sent to your email (processed and not retained after use)
- Google account information when you use Google Sign-In (such as email and basic profile information provided by Google)
- An internal user identifier linked to your account
2.3 Payment and subscription data
If you subscribe to TimeFlow Pro, payments are processed by Stripe. We receive subscription status, Stripe customer identifiers, and billing-related metadata. We do not receive or store your full credit card number.
2.4 Technical and service data
Our backend may log limited technical information when you use authenticated features:
- API request metadata (timestamps, endpoints, error logs)
- IP address and user agent (standard server logs, retained for a limited period)
We do not collect geolocation. The extension does not use the Geolocation API or IP-based location lookup. IP addresses in server logs are used only for security and debugging, not to determine your physical location.
3. Chrome extension permissions
TimeFlow requests permissions required for its core functionality. We use each permission only for the purpose described:
- tabs, webNavigation, idle: detect the active tab and measure time spent on websites
- storage: save settings, time entries, and account state locally
- alarms: schedule periodic sync and background tasks
- notifications: optional reminders (e.g. focus or limit alerts)
- identity: Google Sign-In via Chrome's identity API
- declarativeNetRequest: Pro site blocker — block or redirect requests to domains on your blocklist (no broad host permission required)
- tabs & webNavigation: read active tab URLs for time tracking and redirect tabs when Pro blocking rules apply
We do not sell your browsing data. Blocklists and focus settings are controlled by you.
4. How we use information
- Provide time tracking, analytics, and Pro features
- Authenticate users and manage subscriptions
- Send transactional emails (e.g. verification codes) via our email provider
- Improve reliability, security, and support
- Comply with legal obligations
5. Third-party services
We use trusted processors to operate TimeFlow:
- Google — OAuth sign-in (subject to Google Privacy Policy)
- Stripe — subscription billing
- Resend — delivery of email verification codes
- Vercel — hosting our API and this website
- Neon — PostgreSQL database for account and subscription records
These providers process data on our behalf under their own privacy terms and our instructions.
6. Data retention
- Local extension data: retained until you clear extension data or uninstall the extension
- Account data: retained while your account is active; deleted or anonymized upon account deletion request where applicable
- Server logs: retained for a limited period for security and debugging
- OTP codes: short-lived; deleted after verification or expiry
7. Data sharing
We do not sell, rent, or trade your personal information. We may disclose information only:
- To service providers listed above
- When required by law or valid legal process
- To protect our rights, users, or the public
- With your consent
8. International transfers
Our infrastructure may process data in the United States and other countries where our providers operate. By using TimeFlow, you acknowledge that data may be transferred internationally with appropriate safeguards where required.
9. Your rights and choices
Depending on your location, you may have the right to:
- Access, correct, or delete personal data we hold about you
- Withdraw consent where processing is consent-based
- Object to or restrict certain processing
- Export your data where applicable
- Lodge a complaint with a supervisory authority (EEA/UK users)
To exercise these rights, email support@apkaagent.tech. You can also uninstall the extension and clear its data from Chrome at any time.
10. Children
TimeFlow is not directed at children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.
11. Security
We use industry-standard measures including HTTPS, hashed passwords, and access controls. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date. Continued use after changes constitutes acceptance of the updated policy.
13. Contact
Questions about this Privacy Policy: support@apkaagent.tech
See also our Terms of Service.