Privacy Policy

1. Introduction

Clockd ("Clockd", "we", "us", or "our") provides time tracking and billing software for law firms, delivered as a web application, mobile apps for iOS and Android, and a client portal (together, the "Services"). This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, and the control you have over it.

It applies to getclockd.com, app.getclockd.com, and the Clockd mobile apps. Clockd is operated from Manhattan, New York, United States. By using the Services, you agree to this Policy.

2. Who is responsible for your data

There are two different relationships here, and the distinction matters:

• Your firm's account. For data about the firm and the people who work there, such as names, email addresses and login records, Clockd is the controller and this Policy governs it.
• Your firm's client data. For the matters, time entries, invoices, notes and correspondence a firm records in Clockd, the firm is the controller and Clockd is a processor acting on its instructions. That data belongs to the firm. We do not use it for our own purposes. If you are a client of a firm that uses Clockd, that firm's privacy policy governs it, and you should contact the firm directly.

3. What we collect

• Account data: name, email address, phone number, job title, and the firm details supplied during signup.
• Work data: clients, matters, time entries, calls, invoices, notes and messages created in the product. This is your firm's data and belongs to it.
• Connected account data: if you choose to connect a Google account, the calendar and email data described in section 4.
• Call data: for calls placed through Clockd, the numbers involved, the start time and the duration. We do not record call audio.
• Device and security data: IP address, approximate location derived from it, browser and operating system, app version, crash logs, and a device identifier, so you can see and revoke your active sessions and so we can detect suspicious sign-ins.
• Billing data: subscription status and billing contact. Card details go directly to our payment processor and are never stored on Clockd's systems.

4. Google account data

Connecting a Google account is optional. It is done by each person for their own mailbox and calendar rather than for the whole firm, and it can be revoked at any time. Clockd requests read-only access only, and only the access needed to turn work you have already done into draft time entries.

• Calendar, read-only (calendar.readonly and calendar.events.readonly). We read event times and attendee email addresses, so that a meeting with one of your clients can be logged as pending billable time against the right matter.
• Gmail, read-only (gmail.readonly). We read message metadata, meaning the sender, recipients, subject, timestamp and thread identifier, so that correspondence with a client can be logged the same way. We use this to match an email to a client and to avoid logging the same thread twice. We do not store message bodies, we do not use message content for any other purpose, and we never send, draft, modify, label or delete email on your behalf.

We store only what is needed to create and de-duplicate those entries: the connected account address, the provider's grant identifier, and the event or thread identifier we matched against. Every entry created this way is a pending suggestion until a person at your firm reviews and confirms it. Nothing is billed to a client automatically. Disconnecting in Settings stops all capture immediately, and entries already created remain your firm's own records.

Limited Use. Clockd's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we do not transfer this data to third parties except as necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition; we do not use it for advertising; we do not use it to develop, improve or train generalized artificial intelligence or machine learning models; and we do not allow humans to read it except with your explicit consent, for security purposes, to comply with applicable law, or where it has been aggregated and anonymized.

You can review and revoke Clockd's access to your Google account at any time from your Google account permissions page, as well as from within Clockd's own Settings.

5. Why we use it, and on what basis

We use personal data to provide and operate the Services, to authenticate users and secure accounts, to sync entries across devices and with your client portal, to bill for subscriptions, to provide support, to detect and prevent fraud or abuse, and to comply with legal obligations.

Where data protection law requires a legal basis, ours is the performance of our contract with your firm, our legitimate interest in keeping the Services secure and working, your consent where you connect an optional account, and compliance with legal obligations. Service communications such as receipts and security alerts are necessary to the Services. Marketing email is opt-in and carries an unsubscribe link.

We do not sell personal data, and we do not share it with third parties for advertising.

6. Who we share it with

We use a small number of service providers to run Clockd. Each is bound by contract to process data only on our instructions:

• Cloud hosting and database infrastructure
• Nylas, which brokers the optional Google calendar and email connection
• Twilio, for calls placed through the app
• Stripe, for subscription payments
• Resend, for transactional email such as verification and invitation messages
• Supabase, for stored files such as firm logos and profile photos

We also share data with your firm or account owner, since an administrator may access entries and usage within that firm's account, and with your clients where you invite them to the client portal, who see only the entries and invoices you choose to share. We may disclose data where legally required, by subpoena, or to protect the rights and safety of our users. If Clockd is involved in a merger or acquisition, we will give notice before data becomes subject to a different policy.

7. International transfers

Clockd and its providers may process data in countries other than your own. Where data leaves a jurisdiction with specific transfer rules, we rely on appropriate safeguards such as standard contractual clauses.

8. Security

Data is encrypted in transit using TLS, and at rest. Session tokens are held in encrypted, HTTP-only cookies that page scripts cannot read. Access is scoped to each firm and enforced on every request. Two-factor authentication is available and can be required across a firm, and you can review and revoke individual devices from Settings.

No system is perfectly secure. Please use a strong, unique password and enable two-factor authentication. We will notify affected users and regulators of a qualifying breach as required by law.

9. How long we keep it

Account and work data is retained while the account is open. On closure, personal data is deleted or anonymized within 30 days, except where we must keep records longer to meet legal, tax or accounting obligations, resolve disputes, or enforce our agreements. Data obtained from a connected Google account is deleted when the connection is revoked or the account is closed, whichever comes first. Security logs are kept on a shorter rolling window.

10. Your rights & choices

Depending on where you live, you may have the right to access, correct, export, delete or restrict the use of your personal data, to object to certain processing, and to complain to your data protection authority. You can export or delete your own data from Settings at any time, or email us and we will respond within 30 days.

California residents have additional rights under the CCPA and CPRA. Residents of the EU and UK have rights under the GDPR and UK GDPR. We do not sell or share personal information as those terms are defined under California law.

If you are a client of a firm that uses Clockd, please contact that firm first, as they control that data. We will support them in responding.

11. Children's privacy

Clockd is intended for legal professionals and is not directed to individuals under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us so we can delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, notify you through the app or by email at least 30 days before the change takes effect.

13. Contact us

Questions, requests or complaints? Contact our team:

Clockd
Lower East Side, Manhattan
New York, NY, United States
hello@getclockd.com

For privacy matters specifically, you can also reach our privacy contact directly at dana@getclockd.com.