FRFrançaisSign in

Privacy

Last updated:

In short: no tracking cookies, no analytics, no advertising, no data sold or shared with third parties. A single cookie, strictly necessary to keep you signed in.

Data controller

Maxence Bonnici, publisher of this site. Contact: contact form on mbonnici.fr. This policy covers the public instance time-manager.mbonnici.fr. A company running Time Manager on its own servers is the controller of its own processing.

Data processed

  • Account: name, email address, role, weekly target and language; where relevant, the password (stored only as a PBKDF2-SHA512 hash, never in clear) or your Google account identifier.
  • Working time: start and end of each session, an optional note and its origin (punched or added by hand).
  • Session: a random token, kept on the server, that keeps you signed in.
  • Security: to slow down password guessing, the IP address and the email typed during a failed sign-in are counted in memory for at most 15 minutes, then forgotten; likewise, guest sandboxes created are counted per IP address for one hour. Server logs contain no IP address.
  • Sign in with Google: if you choose "Continue with Google", Google authenticates you and sends us your name, your verified email address and an account identifier. Only addresses allowed by the administrator can sign in; for anyone else, nothing is stored.
  • Guest mode: a private sandbox with a fictional team is created for you alone. What you enter there is visible to you only.
  • Access requests: the "Request access" form stores your name, email address and password hash. An administrator approves or refuses the request; once approved, the account joins the shared space. Administrators see each account's name, email address and hours; other accounts only see their own hours.
  • Feedback: a message sent through the contact form is only used to answer you. A GitHub issue is public and governed by GitHub's terms.

Purposes and legal bases

  • Providing the time-tracking service you use (GDPR article 6.1.b).
  • Securing the service and preventing abuse (legitimate interest, GDPR article 6.1.f).

Retention

  • Guest sandboxes: deleted automatically, with everything in them, 24 hours after they were created.
  • Access requests: a refused request is deleted at once; a request left unanswered is deleted after 14 days.
  • Accounts: until deleted, by yourself (Profile page) or by an administrator, who may delete abusive accounts. An account that never recorded any time is deleted after 30 days. Deletion immediately erases the account and all its hours.
  • Sessions: 30 days at most, or until you sign out or change your password.

Cookies and local storage

  • __Host-tm_session: encrypted and signed session cookie, HttpOnly, Secure, SameSite=Lax, 30 days at most. Strictly necessary for authentication, so it is exempt from consent.
  • Your browser's local storage remembers your theme and whether you have signed in on this device before. This never leaves your device.

Third-party resources and processors

Fonts and icons are served by the site itself: no CDN, no Google Fonts, no third-party script is loaded. Traffic goes through Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, which acts as firewall and CDN and may process IP addresses, including outside the European Union. Google is involved only if you choose to sign in with Google, under its own privacy policy.

Your rights

You can access, correct, delete, object to the processing of, or port your data. The Profile page lets you download it as JSON and delete your account yourself. For anything else: contact form on mbonnici.fr. You may also lodge a complaint with the French data protection authority, the CNIL.