Privacy policy

Against All Odds · TimeTracker

Last updated 16 October 2026

This policy covers the free test phase of TimeTracker. It will be revised before general release.

Who is responsible

Your account belongs to Against All Odds, which is responsible for the information about its workers in this app. It decides who gets an account, and its office manages the accounts and approves the hours.

The service is provided by Tomasz Michalczewski, as an individual, during the test phase. He runs the app, its database and its servers for Against All Odds and keeps them working.

What the app keeps, and why

Unless a section says otherwise, everything below is stored in this service's database, on the hosting service named under "Other services involved".

Your account and profile

• What: your name, username, role, email address and phone number (the last two only if they have been entered), and whether two-step sign-in is set up.
• Why: so you can sign in (with your username, not your email address) and so your office knows who you are and how to reach you. The app sends no email and no text messages.
• Who sees it: you, on your Settings screen, where you can also change your name, email address and phone number. The office (Office role and above) sees your name, username, role and whether two-step sign-in is set up. Your email address and phone number are shown only to people who can edit accounts (Admin and above, by default), and only for accounts below their own role.
• How long: while your account exists. Nothing deletes it after a set time. If the office deactivates or deletes your account, the record is kept (see "Your requests").

Each change to your name or phone number is written to the activity log, and each change to your email address to the security log. Both logs are permanent.

Your hours and work records

• What: the time you record (date, job, task, minutes and any note you add, up to 500 characters), a running timer, your day and week submissions and their approvals, and the jobs and crews you are assigned to.
• Why: to record the work you do, so Against All Odds can approve it and report it by job.
• Who sees it: you see your own. The office (Office role and above) sees it on the approvals screen, in reports and exports, and on the calendar.
• How long: while your account exists. Nothing deletes your hours after a set time. Deleting a time entry hides it but keeps the record. Some working records end with the work: a running timer when it stops, and job assignments from that day on when the job closes.

Every time an entry is added, changed or deleted, a line is written to the permanent activity log with your username, the date, the job, the task and the minutes. Your note is not copied there.

Your devices and how the app recognises them

• What: a name for each device you sign in on (from the browser's description of itself, or the name the iPhone app sends), and details the browser gives every website: IP address, browser and operating system, language, platform, time zone, screen and window size, number of processor cores, and whether it has a touch screen. The app reads no drawing, graphics or sound fingerprint, no location and no battery state.
• Why: to recognise a device you have used before, to ask for a code on a new one, and to limit how many devices an account can use.
• Who sees it: you see your devices' names and when they were first and last used. The office (Office role and above) sees your devices, can read the stored details of each, including its IP address, and approves new devices when asked.
• How long: a device's record is deleted when the device is removed, when your two-step sign-in is reset, or when your account is deactivated. A request to approve a new device is deleted once it is answered. The record of each iPhone app sign-in, with the device's name, is kept.

Separately, each sign-in is recorded in the permanent security log with its time, IP address and browser, and the full device details are copied there when a device is registered, recognised again or checked.

IP addresses, the security log and the activity log

• What: the security log records sign-ins and other account events: when, the IP address, who acted, on whose account, and the device. A failed sign-in records the username that was typed. The activity log records changes to work records and to people, without IP addresses.
• Why: to keep accounts safe and to show who changed what.
• Who sees it: by default, the security log is open to the Owner and above, and the activity log to Admin and above. An Admin who unlocks a locked account sees the IP address of the failed attempts.
• How long: permanently. The database is set up so that nobody can change or delete these logs.

Server logs

• What: the server writes a running log of its work. A request refused for coming too often is logged with its IP address, at most once a minute per address. Requests from the iPhone app are logged with the address they asked for and the app's name, without an IP address. A few error lines name an account's internal number.
• Why: to run the service and find faults.
• Who sees it: the provider, who runs the server.
• How long: as long as the hosting service keeps them. The app does not control this.

Crash reports

• What: when something fails, the app records the time, your user number and username if you were signed in, the address of the page or request, the error and its technical trace, and the app version. It records no IP address and nothing you typed into a form.
• Why: to find and fix faults.
• Who sees it: in the app, only the app-support account; this access cannot be given to anyone else. The provider can also read the crash files on the server.
• How long: reports in the database are removed after 90 days. A copy of each report, with the username, is also written to a monthly file on the server, and those files are not deleted.

The iPhone app sends no crash reports to this service.

Blueprint files

• What: drawings the office uploads to a job, with the file name, who uploaded it and when.
• Why: so the crew on a job can see its drawings.
• Who sees it: office staff who can see jobs, and workers who are or were assigned to that job.
• How long: a file is deleted when it is removed or replaced, or when its job is closed. Deleting a job, instead of closing it, keeps its files.

The files are stored on the hosting service's disk, beside the database.

Backups

• What: copies of the database, which hold everything above except blueprint files, server logs and crash files. They include the permanent logs and records that were deleted (hidden).
• Why: to bring the service back after a failure.
• Who sees it: the provider.
• How long: a self-hosted copy of the app keeps its 14 newest daily copies. Copies kept by the hosting service, and the encrypted copies stored with Backblaze B2, are kept as those services are set up; the app does not set this.

Cookies and browser storage

The app sets only the cookies it needs to work: your sign-in (it ends after 6 days without use for workers, and after 8 hours for office roles and above), a device cookie that lets the app recognise this browser (400 days), a short re-check cookie (5 minutes), a cookie that holds a sign-in while you enter your code, a security cookie that protects forms, and a short-lived cookie used once to show you new recovery codes. The browser itself remembers the app theme you picked, and which notices you have already seen. There are no advertising or tracking cookies.

Other services involved

• Render hosts the app, its database and its file storage.
• Cloudflare sits in front of the app and passes your requests on to it.
• Backblaze B2 stores encrypted backup copies of the database.

The app sends no email, so no email service receives your information. It uses no analytics, advertising or crash-reporting service, and it serves its own fonts and its own document viewer. The app reports its health to the provider's own dashboard: counts and status only, never a name, username, email address, device or IP address.

Your requests

Privacy contact at Against All Odds: tomasz@michalczewski.ca

Your account is held by Against All Odds, so ask its office to see, correct or remove your information. Today:

• You can change your own name, email address and phone number on your Settings screen, and remove your own devices.
• The office can correct your details and remove a device.
• The office can deactivate your account (Admin and above, for someone below their own role). You can no longer sign in and your devices are removed. Everything else is kept, and the account can be turned back on.
• Only the app-support account can delete an account. Deleting hides you and your hours but keeps the records, removes you from crews and job assignments, and can be undone. A copy of your details, including your email address and phone number, stays in the permanent activity log.
• The app has no download of your own information. The office can export reports of hours.

The app cannot erase a person's information completely today. The security and activity logs, including the device details and IP address of each sign-in, are kept permanently, and crash files are not deleted.

Questions about the service

Write to Tomasz Michalczewski at tomasz@michalczewski.ca.

Changes to this policy

This text is part of the app, so every change to it ships with a new app version. The date at the top shows the last change.