TimeTag

TimeTag Privacy Policy

Effective 26 October 2026

TimeTag shows prices in hours of your own work. It is built so that your pay and your spending stay on your phone. This policy explains, in plain words, what the app does with information, what leaves your phone (very little, and mostly only if you choose), and your rights.

TimeTag is made by Bytangle Ltd, company number 17287853 ("we", "us"), 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We are the controller of the small amount of data described in section 4. Contact: hello@bytangle.dev.

1. The short version

• Your pay, your log, your habits and your settings stay on your phone, in an encrypted database. We have no TimeTag server and never receive them.
• The camera is read on your phone. Camera frames are never saved and never uploaded.
• Receipts and payment messages you share to TimeTag are read on your phone and deleted once read. Only the entry you confirm is kept, on your phone.
• Anonymous usage statistics and crash reports are off until you turn on "Share anonymous usage". They never contain prices, pay or item names.
• Purchases go through Apple or Google, with RevenueCat checking what you bought under a random, anonymous app user ID.
• Backups are optional and go to your own iCloud or Google Drive, encrypted on your phone first. We never receive a backup or its key.
• We don't sell your data, show ads or track you across other apps or websites.
• Delete everything at any time in Settings › Data › Delete all data.

TimeTag gives perspective, not financial advice.

2. What stays on your phone

The database is encrypted with a key kept in your phone's secure hardware (Android Keystore or the iOS Keychain). It is deliberately left out of normal Android and iPhone device backups and device-to-device transfers; TimeTag's own encrypted backup (section 6) is the way to move it to a new phone.

Export. If you use Export data, TimeTag creates a JSON or CSV file of your log and habits (your income only if you tick it) and hands it to the share sheet. Where it goes next is your choice.

Share cards. Cards you make are images created on your phone. They show hours only by default; showing the price is your choice and the app warns you that it reveals your hourly pay. A card is saved or shared only when you tap Save or Share.

Notifications (monthly report, habit nudges) are scheduled on your phone. No push server is involved.

App lock uses your phone's own Face ID, Touch ID, fingerprint or screen lock. TimeTag never sees your biometric data.

Read hours aloud uses your phone's text-to-speech.

3. Camera, photos and shared receipts

• Live camera. Frames from the camera are read on your phone by Google ML Kit's on-device text recognition to find prices. Frames are processed in memory and never saved or uploaded. The text recognition model is built into the app, so it works offline.
• Photos you pick or frames you freeze are read the same way, on your phone. TimeTag keeps a photo only if you add it to a share card and save or share that card yourself.
• Receipts, invoices, PDFs and payment messages you share to TimeTag (or pick with "Import a receipt") are read on your phone. The copy TimeTag receives, and any page rendered from a PDF, is deleted once read. Only the entry you confirm (amount, currency, name, date and whether it came from a receipt or a transfer) is saved, in your encrypted log. Nothing from the document is uploaded.
• Google ML Kit diagnostics. Google's ML Kit may send Google limited technical information so Google can maintain and improve the feature, such as device model, operating system version, app identifier, ML Kit performance metrics and error codes. It does not send the camera images, photos, documents or the text that is read. See the Google ML Kit terms.

4. What leaves your phone

4.1 Anonymous usage and crash reports (off unless you turn them on)

"Share anonymous usage" is off by default. You can turn it on from the camera screen ("Help improve TimeTag") or in Settings › Privacy, and off again at any time. While it is off, nothing is sent to PostHog or Sentry.

When it is on:

• Usage statistics (PostHog, EU hosting). A short, fixed list of events, for example "onboarding completed", "price locked", "decision logged", "paywall shown". Values are rounded into broad buckets (for example "1 to 4 hours"). The events never contain prices, pay, item names, habit names, receipt contents or anything you type. They are tied to a random identifier created by the app, not to your name, email or advertising ID, and no profile of you is built. PostHog also receives standard technical details (app version, operating system, device type, language) and, as with any internet request, your IP address, which we do not use to identify you.
• Crash reports (Sentry). If the app crashes or hits an error, a report with technical details (stack trace, app version, device model, operating system). Before it leaves the phone, TimeTag removes user, request and extra fields and replaces every number and currency sign with "#", so amounts can't appear. No screenshots or screen layouts are attached.

Why (lawful basis): your consent (UK/EU GDPR Art. 6(1)(a); Nigeria Data Protection Act 2023 s. 25(1)(a)). Withdrawing consent (turning the switch off) stops collection straight away. "Delete all data" also resets the anonymous identifier.

How long: usage events are kept for up to 12 months and crash reports for up to 90 days, then deleted.

Because these records are anonymous and not linked to you, we usually cannot find "your" records to send you a copy or delete them individually. If you want us to try, email us (section 9).

4.2 Purchases (TimeTag Pro)

Purchases are made through the Apple App Store or Google Play, under their terms and privacy policies. We never see your card or bank details.

We use RevenueCat to confirm what you bought and restore it. RevenueCat receives your store purchase records (product, price, currency, dates, receipt or purchase token) and a random app user ID created by RevenueCat, plus basic technical details (app version, operating system, country of the store) and your IP address as part of the request. We do not log you in or link this ID to your name or email. Why: to provide what you paid for (performance of a contract, GDPR Art. 6(1)(b); NDPA s. 25(1)(b)) and to keep tax and accounting records (legal obligation). Purchase records are kept by Apple, Google and RevenueCat for as long as the law requires.

4.3 Backup (off unless you turn it on)

See section 6. Backups go only to your own storage; we never receive them.

4.4 Nothing else

There is no TimeTag account, no TimeTag server, no advertising and no third-party tracking. We do not sell, rent or share your personal data for advertising.

5. Service providers

Where a provider processes data outside the UK, EEA or Nigeria, the transfer relies on adequacy decisions, the EU-US Data Privacy Framework (and UK extension) or Standard Contractual Clauses, as applicable.

6. Encrypted backups to your own iCloud or Google Drive

Backup is off until you turn it on (Settings › Data › Backup).

• What: an encrypted copy of your income, log, habits and settings.
• Encryption: the copy is encrypted on your phone with AES-256-GCM before it leaves the phone.
• Where it goes: only to your own iCloud (on iPhone, in TimeTag's hidden iCloud folder) or your own Google Drive (TimeTag's hidden app folder, which TimeTag can see but nothing else in your Drive), or to a file you save yourself. If you connect Google Drive, TimeTag asks Google only for access to its own app folder, and shows your Google account email on the phone. TimeTag keeps the newest 3 backups in each place and deletes older ones.
• The key: a random key made on your phone and kept by your own account: iCloud Keychain on iPhone, or Google's Block Store on Android. Both are end-to-end encrypted by Apple and Google, so neither they nor we can read the key. A new phone signed in to the same account can unlock your backups.
• Optional passphrase: you can add a passphrase as a second lock. TimeTag never stores the passphrase. If you forget it, the backup can't be opened, not even by us.
• When Apple or Google could read a backup (the honest fallback):
  • Android without a screen lock (or without Google backup): Google can't keep the key end-to-end encrypted, so TimeTag keeps the key on the phone and stores a key copy next to your backups in your Google Drive. Google could then read those backups. The Backup screen tells you ("Key kept on this phone") and asks you to set a screen lock; once you do, the key moves into your Google account and the copy is deleted.
  • iPhone, if you turn on "Key copy in iCloud" (off by default, for when iCloud Keychain is off): a copy of the key sits in your iCloud Drive. Unless you use Apple's Advanced Data Protection, Apple could then read those backups.
  • Adding a passphrase protects against both cases.
• Who can restore: anyone who can sign in to your Apple or Google account on a phone can restore a backup, unless you added a passphrase.
• Turning backup off stops new backups. Existing backups stay in your iCloud or Google Drive until you delete them there.

We never receive a backup, a key or a passphrase.

7. Deleting your data

• Settings › Data › Delete all data erases the database, its key and your settings on the phone and resets the anonymous analytics identifier. It cannot be undone.
• Uninstalling the app also removes its data from the phone.
• Backups in your iCloud or Google Drive: delete them in iCloud settings (Manage Storage) or Google Drive (Manage apps › TimeTag › Delete hidden app data). Disconnecting Google Drive in TimeTag revokes its access.
• Purchases: your purchase history stays with Apple or Google. Ask us (section 9) if you want RevenueCat's record for your anonymous ID deleted; we'll need the ID from a restore or a receipt to find it.

8. Children

TimeTag is for people aged 13 and over and is not directed at children. If you are under the age at which you can consent to data use in your country (13 in the UK, between 13 and 16 in EU countries, 18 under Nigerian law for consent), please don't turn on "Share anonymous usage" or make purchases without a parent's or guardian's permission. If you believe a child has given us data, contact us and we will delete what we can find.

9. Your rights

Under the UK GDPR, the EU GDPR and the Nigeria Data Protection Act 2023 you may have the right to access, correct, delete, restrict or object to the use of your personal data, to data portability, and to withdraw consent at any time (without affecting what happened before). Because almost everything stays on your phone, you can exercise most of these rights yourself: view and edit in the app, Export data, Delete all data, and turn off "Share anonymous usage".

For anything else, email hello@bytangle.dev. We reply within one month. You can also complain to a data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), in the EU your local supervisory authority, and in Nigeria the Nigeria Data Protection Commission (ndpc.gov.ng). We'd appreciate the chance to help first.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

10. Security

The database on your phone is encrypted and its key is held by the phone's secure hardware. Data sent to PostHog, Sentry, RevenueCat, Apple and Google travels over encrypted connections (HTTPS). Backups are encrypted on the phone before they leave. Discreet mode hides pay values on screen, and App lock (Pro) asks for your face, fingerprint or screen lock to open the app. No system is perfectly secure; keep your phone locked and your Apple or Google account protected with two-factor authentication.

11. Changes

If we change this policy, we will update the effective date above and, for important changes, tell you in the app before they apply. Previous versions are available on request.

12. Contact

Bytangle Ltd, company number 17287853, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Email: hello@bytangle.dev