Privacy policy

1. Who runs NetClock

NetClock is operated by UAB Netcode (“we”). For anything about your data, write to info@netcode.lt.

Anyone can create an account, and then an organization of their own; or an organization — usually your employer or a company you work with — invites you to join it. The organization decides which projects and tasks exist and what is recorded against them; we run the service for it.

2. What we record

• Your account: your name, your email address, and a time zone if you set one. If you sign in with a password, our authentication provider stores it only as a one-way hash; nobody, including us, can read it.
• Your work: the time entries you log (date, duration or start and end time, and the description you write) and the project, task and tags they belong to; the working hours agreed for you; and your role in each organization you belong to.
• What your organization enters: its clients, projects, tasks, tags, budgets and hourly rates, and — visible only to its owners and admins — what an hour of each person’s time costs.
• Invitations: the email address an organization invites, until the invitation is accepted or withdrawn.
• Technical records: the cookies needed to keep you signed in and to remember which organization you have open, and the request logs our hosting provider keeps (IP address, browser, time of the request).

NetClock has no advertising, no analytics or tracking scripts, and no cookies other than the ones just described.

3. Signing in with Google

If you choose “Sign in with Google”, Google tells us your name, your email address and your profile picture — the basic profile, and nothing else. We use it only to recognise your account and to show your name to the people you work with. NetClock does not ask for, and cannot read, your Gmail, Calendar, Drive, contacts or any other Google data.

We do not sell or share what we receive from Google, do not use it for advertising, and do not use it to train AI models. NetClock’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. What we use it for

• To sign you in and keep your account secure.
• To show you your timesheet, and to show your organization its projects, hours and budgets.
• To send the few emails the service needs: an invitation, a notice that you were added to an organization, confirmation of your address, and a password reset when you ask for one.

We do not sell your data, show you advertising, build profiles of you, or make automated decisions about you. Under European data-protection law we process this data to provide the service to you and your organization, and because your organization has a legitimate interest in recording the time worked on its projects.

5. Who can see it

• You see your own time, and can change your name, time zone and password on your Profile page.
• Owners and admins of your organization see everyone’s time in that organization, and its rates, costs and budgets. Moderators manage projects, clients, tasks and tags; on the projects they moderate they see how many hours each person logged, and they never see money.
• NetClock’s own administrators see the list of organizations and accounts, and can open an organization when that is needed to run or support the service. When they do, they appear in that organization’s team list like anyone else.
• Nobody outside your organization, apart from the service providers below.

6. The services we rely on

• Supabase — the database and sign-in system, including the emails that confirm an address or reset a password. The data is stored in the European Union (Ireland).
• Vercel — runs the application, also in the European Union (Ireland).
• Resend — delivers invitations and the notice that you were added to an organization.
• Google — only if you choose to sign in with Google.
• Cloudflare (Turnstile) — checks that whoever creates an account or asks for a password reset is a person, not a program. It sees your IP address and information about your browser at that moment.

These companies process data on our instructions and only to provide their part of the service. Some of them are based in the United States and may handle data there; where they do, it is under the safeguards European law requires, such as the standard contractual clauses.

7. How long we keep it

Your account and your work stay for as long as the organization you belong to uses NetClock. If you are removed from an organization, the time you logged there stays with it — it is that organization’s record of work done. When an organization is deleted, its clients, projects, tasks, tags and time entries are deleted with it. An account that belongs to no organization and has logged no time can be deleted at any time; ask us and we will do it.

How to ask for your account to be deleted, and what an organization keeps: delete your account.

8. Your rights

You can ask to see the data held about you, to have it corrected or deleted, to have its use restricted, to object to its use, and to receive it in a portable form. For the time and projects recorded by an organization, ask that organization first — it decides what is kept. For anything else, or if that does not help, write to info@netcode.lt.

You also have the right to complain to a data-protection authority — in Lithuania, the State Data Protection Inspectorate (vdai.lrv.lt).

9. Security

All traffic is encrypted in transit. Passwords are stored only as hashes, and invitation links only as hashes of their secret part. Every page and every query is limited to the organizations you belong to and to what your role there allows.

10. Changes

If this policy changes in a way that matters, we will say so here and change the date at the top. The terms of use say what we expect of the people who use NetClock.