Privacy Policy

Clockd is time tracking and billing software for law firms. This policy explains what personal data we collect, why, who we share it with, and the control you have over it. It applies to app.getclockd.com, getclockd.com, and the Clockd mobile apps.

Who is responsible for your data

There are two different relationships here, and the distinction matters:

• Your firm's account. For data about the firm and the people who work there — names, email addresses, login records — Clockd is the controller and this policy governs it.
• Your firm's client data. For the matters, time entries, invoices, notes and correspondence a firm records in Clockd, the firm is the controller and Clockd is a processor acting on its instructions. That data belongs to the firm. We do not use it for our own purposes, and if you are a client of a firm using Clockd, that firm's privacy policy governs it.

What we collect

• Account data: name, email address, phone number, job title, and the firm details supplied during signup.
• Work data: clients, matters, time entries, calls, invoices, notes and messages created in the product. This is your firm's data and belongs to it.
• Connected account data: if you connect Google, the calendar and email data described below.
• Call data: for calls placed through Clockd — the numbers involved, start time and duration. We do not record call audio.
• Device and security data: IP address, approximate location derived from it, browser and operating system, and a device identifier, so you can see and revoke your active sessions and so we can detect suspicious sign-ins.
• Billing data: subscription status and billing contact. Card details go directly to our payment processor and are never stored on Clockd's systems.

Google account data

Connecting a Google account is optional, is done per person rather than per firm, and can be revoked at any time. Clockd requests only the access needed to turn work you have already done into time entries:

• Calendar, read-only (calendar.readonly, calendar.events.readonly). We read event times and attendee email addresses, so a meeting with one of your clients can be logged as pending billable time on their matter.
• Gmail, read-only (gmail.readonly). We read message metadata, meaning the sender, recipients, subject, timestamp and thread identifier, so correspondence with a client can be logged the same way. We use this to match an email to a client and to avoid logging the same thread twice. We do not use message content for any other purpose, we do not store message bodies, and we never send, draft, modify, label or delete email on your behalf.

We store only what is needed to create and de-duplicate those entries: the connected account address, the provider's grant identifier, and the event or thread identifier we matched against. Every entry created this way is pending until a person confirms it — nothing is billed to a client automatically. Disconnecting in Settings stops all capture immediately; entries already created remain your firm's records.

Clockd's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we do not transfer this data to third parties except as necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition; we do not use it for advertising or to train generalised AI models; and we do not allow humans to read it except with your explicit consent, for security purposes, to comply with applicable law, or where it has been aggregated and anonymised.

You can review and revoke Clockd's access to your Google account at any time from your Google account permissions page, as well as from Settings here.

Why we use it, and on what basis

To provide the service, to secure accounts and investigate abuse, to bill for subscriptions, and to support and improve the product. Where data protection law requires a legal basis, ours is the performance of our contract with your firm, our legitimate interest in keeping the service secure and working, your consent where you connect an optional account, and compliance with legal obligations. We do not sell personal data, and we do not share it with third parties for advertising.

Who we share it with

We use a small number of service providers to run Clockd. Each is bound by contract to process data only on our instructions:

• Cloud hosting and database infrastructure
• Google (via Nylas) for the optional calendar and email connection
• Twilio for outbound calling
• Stripe for subscription payments
• Resend for transactional email such as verification and invitation messages
• Supabase for stored files such as firm logos and profile photos

We may also disclose data where legally required, or to protect the rights and safety of our users. If Clockd is involved in a merger or acquisition, we will give notice before data becomes subject to a different policy.

International transfers

Clockd and its providers may process data in countries other than your own. Where data leaves a jurisdiction with specific transfer rules, we rely on appropriate safeguards such as standard contractual clauses.

Security

Data is encrypted in transit (TLS) and at rest. Session tokens are held in encrypted, HTTP-only cookies that page scripts cannot read. Access is scoped per firm and enforced on every request, two-factor authentication is available and can be required firm-wide, and you can review and revoke individual devices from Settings. No system is perfectly secure, and we will notify affected users and regulators of a qualifying breach as required by law.

How long we keep it

Account and work data is retained while the account is open. On closure, personal data is deleted or anonymised within 30 days, except where we must keep records longer to meet legal, tax or accounting obligations. Security logs are kept on a shorter rolling window.

Your rights

Depending on where you live, you may have the right to access, correct, export, delete or restrict the use of your personal data, to object to certain processing, and to complain to your data protection authority. You can export or delete your own data from Settings at any time, or contact us and we will respond within 30 days. If you are a client of a firm using Clockd, please contact that firm first, as they control that data; we will support them in responding.

Children

Clockd is a product for legal professionals and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes

We will announce material changes in-app at least 30 days before they take effect, and update the date at the top of this page.

Contact

Questions, requests or complaints: hello@getclockd.com. For privacy matters you can also reach our privacy contact directly at dana@getclockd.com.