TimeBoard Privacy Policy
Effective: 2026-09-05 · Controller: Society Metrics.
What we store
| Data | Source | Why | Protection |
|---|---|---|---|
| monday account id, slug, seat count | monday install webhook / OAuth | Identify your account | Encrypted database volume |
| OAuth access token (and refresh token) | monday OAuth | Read item names, post updates, maintain the Hours column | AES-256-GCM encrypted at rest; key held outside the database; nulled immediately on uninstall |
| User id, name, email, timezone, role flags | monday users API | Show who logged time; CSV export | Name and email AES-256-GCM encrypted at rest |
| Board and item ids and names, group titles | monday boards/items API | Display and CSV | Encrypted database volume; refreshed, not archived |
| Time entries (start, end, duration, note, billable) and an audit log of edits | Your users | The product | Encrypted database volume |
We do not read item column values other than names and groups, and we never capture screenshots, keystrokes, URLs, or activity outside monday.com.
Logs
Server logs contain request method, path, status code, timing and monday account id. They contain no tokens, names, emails or notes, and are retained for 30 days.
Third parties
- monday.com: the platform the app runs inside (API calls, iframe hosting of our views).
- Railway: hosts the server and database in the Netherlands (Amsterdam region).
- AI provider (OpenAI, api.openai.com): powers the optional AI features (narrative, missing-time and anomaly explanations, "Describe it"). When used, the text you typed, item names, hours, notes and activity counts for the selected range are sent to the provider's API. No tokens, emails, or account identifiers are sent; prompts and completions are not stored by TimeBoard. Admins can disable AI for the account in Settings → AI.
- Google Fonts: loads the Figtree typeface for our views.
No analytics, advertising, or tracking cookies. We set no cookies at all; authentication uses monday's signed session token on each request.
Retention and deletion
Uninstalling TimeBoard removes our access token immediately. All remaining data for the account is permanently deleted within 10 days, automatically. Email support@timeboard.agency to request earlier deletion or an export.
International transfers
TimeBoard is offered worldwide. Data is stored on Railway in the Netherlands (EU). AI requests are processed by OpenAI in the United States. Support is operated by Society Metrics in the United States (Eastern Time). If you are in the EU/UK, these transfers rely on the provider's standard contractual clauses; contact us for details or a data processing agreement.
Your rights
Depending on where you live you may have rights to access, correct, export, or delete personal data. Contact us at the address above; we respond within 30 days.
Changes
We will post changes here and, for material changes, notify account admins in the app.