Privacy Policy
Who we are
TapBill is run by Joel Hart, operating as TapBill, from British Columbia, Canada. If you have a question about anything here, email [email protected].
The short version
We collect what the product needs to work and nothing else. We do not sell your information, we do not run advertising, and we do not use third-party analytics or tracking. You can export your data or delete your account yourself, at any time.
What we collect
- Your account. Your name, email address, whether that address is verified, your timezone, and your display preferences. If you sign up with a password we store a cryptographic hash of it, never the password itself.
- Sign-in through Google or GitHub, if you choose it. We receive your name, email address and profile image from that provider, and we store the access tokens that keep you signed in.
- Google Calendar, if you choose to connect it. We keep a small working copy of events from the calendars you select, so we can draw optional suggestions in your Time calendar. That copy holds an event's title, its start and end times, its calendar and event identifiers, and when it last changed. We also store the names of your calendars so you can choose which ones TapBill reads. We do not store attendee data, conferencing details, reminders, attachments, or event descriptions.
- Your business details. The business name, address, currency and invoice numbering you enter to appear on invoices.
- Your work. The clients you add — including their names, email addresses and billing addresses — along with your projects, rates, time entries, notes, planned time, and the invoices you create.
- Technical information. Each sign-in records an IP address and a browser user-agent string alongside the session, so we can keep sessions secure and end them when they expire.
Please note that the client details you enter are information about other people. You are the one deciding to record them, and you are responsible for having a reason to.
Usage information
We do not currently use any third-party analytics or tracking service. Nothing on TapBill reports your browsing to an outside company, and we do not use advertising or tracking cookies. If we add a product analytics tool in future we will update this policy and name the service here before it goes live.
Google Calendar
Connecting Google Calendar is optional. TapBill requests only thehttps://www.googleapis.com/auth/calendar.readonly scope, and uses it only to sync selected calendar events into the Calendar sync view, which is shown by default and can be hidden at any time. The working copy covers six weeks before today and ten weeks ahead; TapBill refreshes the week you view when it is missing or out of date, and you can resync that visible week in Calendar settings. You can choose which calendars to include and hide the visual layer without stopping sync. An event that has finished can become a time entry; one still ahead can become planned time. Nothing is added until you choose and confirm a project. TapBill never creates, changes, deletes, or shares Google Calendar data, and never uses it for advertising, profiling, or any purpose unrelated to this feature.
You can remove any suggestion you do not want. Removing one records that you did so and hides it from your Time calendar; because we refresh the working copy from Google, that record is what keeps the suggestion from coming back. It applies to a single occurrence of an event, it can be undone from Calendar settings, and it never changes, deletes, or is sent to your Google Calendar.
Unapproved copied events are removed as soon as they leave that working window. Turning off an individual calendar stops its sync and removes its unapproved copied events immediately. You can disconnect Google Calendar from Calendar settings at any time; disconnecting revokes TapBill's access and removes the connected account, calendar list, and all unapproved copied events. Time entries and planned time you chose to create remain part of your TapBill records. We retain only a content-free identifier for events you already tracked, planned, or removed, so reconnecting does not ask you about the same event twice. Deleting your TapBill account revokes this access and removes those identifiers.
TapBill's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Cookies
We use a cookie to keep you signed in. If you connect Google Calendar, we also use a short-lived, strictly necessary cookie to protect the connection handoff from another website. Neither is used to track you across other websites.
Why we hold it
To run your account, to show you your own time and invoices, to generate and send invoice PDFs when you ask us to, to send you service email such as verification and password resets, and to keep the service secure.
Who else sees it
- Railway hosts the application and the database.
- Resend delivers our email — verification, password resets, and the invoices you choose to send.
- Google and GitHub, only if you use one of them to sign in, and only to confirm who you are.
- Google, only if you connect Google Calendar, to provide the calendar data described above and to revoke that access when you disconnect it.
Invoice PDFs are generated on our own server, so no third party sees the contents of an invoice. We do not sell or rent your information to anyone. We may disclose information if the law requires it.
Where it is stored
On servers in the United States, in the US West (California) region. If you are outside the United States, this means your information is transferred there and handled under the laws that apply in that country.
How long we keep it
For as long as your account is open. When you delete your account we immediately end your sessions and stop sending you email, then keep the data for 30 days so you can change your mind by signing back in. After 30 days it is permanently deleted and we cannot recover it. Please export anything you want to keep before then — invoices in particular may matter at tax time, and we will not be holding a copy.
What you can do
- Export your data as CSV files from Settings, at any time, without asking us.
- Delete your account yourself from Settings.
- Correct your information by editing it in the app.
- Ask us anything about what we hold, at [email protected].
Security
Traffic is encrypted in transit. Passwords are hashed. Access tokens from Google or GitHub sign-in are encrypted before they are stored. No service can promise perfect security, but if a breach occurs that puts you at real risk we will tell you, and notify the authorities where the law requires it.
Age
TapBill is a tool for running a business and is not intended for children. You need to be old enough to enter a contract where you live.
Changes
If this policy changes we will update the date at the top. If a change materially affects what we collect or what we do with it, we will email you rather than rely on you noticing.
Contact
Joel Hart, operating as TapBill — British Columbia, Canada. [email protected]