Privacy Policy — Hour Hand

A crew lead adds each crew member by name, with a phone number if they want, and sends that person an invite. The crew member’s phone joins the crew from the invite and then stays signed in. Each clock-in and clock-out is recorded with its time, and with a customer, a job and a note when they are chosen. The crew lead can see and change every shift on the crew, and each change the crew lead makes is kept. At the end of every pay period, Hour Hand emails the timesheets to the address the crew lead chose. Hour Hand never asks for your phone’s location, and it does not use your contacts or your photos. The apps also send us usage analytics and automatic error reports, which are built to leave out names, notes and invite links. A crew lead can delete their Bravely Account in the app, under Settings; 30 days later, that deletes every crew they run, with its crew members, jobs and shifts. Otherwise nothing is deleted automatically, apart from the short-lived records described under "Data Retention"; to have something deleted sooner, email privacy@bravely.dev.

A crew lead signs in with a Bravely Account, which is covered by its own policy at bravely.dev/privacy/bravely-account. That policy also covers the records our account service keeps of sign-ins. Hour Hand receives the account’s identifier and email address from our account service. For each crew, Hour Hand keeps: • the crew’s name, its time zone, the length of its pay period and the day pay periods start; • which Bravely Accounts run the crew; • the address timesheets are sent to. It starts as the crew lead’s own email address. Any other address is used only after someone confirms it from a link we email to that address, and we keep each address that was asked for, which account asked, when, and whether it was confirmed; • the jobs and the customers the crew lead sets up. A customer is just the name the crew lead types in; • a record of each timesheet email: the pay period, the address it went to, when, how many shifts it held, and whether it was sent. Crew members never see the crew lead’s email address or account details.

Crew members do not make an account, and Hour Hand never asks them for an email address, a password or their age. The crew lead adds each crew member with: • the name the crew lead types in; • a phone number, if the crew lead adds one. Hour Hand stores it for the crew lead and does not call or text it; • the jobs they do, if the crew lead picks them. For each shift, Hour Hand keeps when it started and ended, the customer, the job and the note if any, any photos added to it, whether it was recorded from the crew member’s phone or by the crew lead, and when it was created and last changed. The crew lead can see every crew member’s shifts and notes. A crew member’s phone shows only their own shifts and hours, the crew’s name, and the jobs the crew lead picked for them (or all of the crew’s jobs, if the crew lead picked none). Clock-ins and clock-outs carry the time on the phone when they were tapped. If the phone has no signal, it keeps them and sends them when it can.

A crew lead can bring in shifts kept somewhere else, such as another time clock or a spreadsheet, from a CSV or Excel file, on the web at hourhand.bravely.dev: • the browser reads the file. The file itself is not uploaded or kept; • the browser sends us the file’s rows, as text, so we can check them: for example for duplicates, and for shifts that overlap ones already in Hour Hand. We use them to answer the check and do not keep them; • to work out which column holds what, we send the column names and up to 20 rows, each cell cut to 100 characters, to Anthropic, which reads them for us and tells us how the file is laid out. If the crew lead types a correction, such as which time zone the file uses, that text goes with them. For each such request we keep when it was made, by which crew lead, and how much it used, and none of the file’s contents; • when the crew lead imports, we keep the shifts like any shift the crew lead adds, each with a line in its history saying it was imported and from which file, and a record of the import: the file’s name, who imported it, when, how many shifts it held, which crew members, jobs and customers it added, and whether it was removed. The crew lead can remove an import, which removes its shifts the same way a deleted shift is removed.

To bring a crew member’s phone onto the crew, the crew lead makes an invite, which the app shows as a link to share and as a QR code. The crew lead chooses how to send the link, for example by text message, and that message then goes through the service the crew lead picked, not through us. An invite can be used once, expires after 7 days, and is replaced when the crew lead makes a new one for the same person. Anyone who has the link can use it to join as that crew member until then, so send it only to them. We store only a scrambled form of each invite, which cannot be turned back into the link, with who made it and when it was made, used, replaced or expired. When a phone joins, it makes a key that stays on the phone, in its secure hardware where the phone has it, and sends us only the public half. We keep, for each phone: that public key, whether it is an iPhone or an Android phone, the model name the phone reports (on iPhone this is the kind of device, such as "iPhone", not the name you gave it), when it joined and when it was last used. The crew lead sees whether a crew member’s phone is signed in, its kind, and when it was last used. A crew lead can also turn on a shop code: one QR code for the crew to print and post, for people who use Hour Hand in their phone’s web browser instead of the app. Anyone who scans it can ask to join by typing their name, and nothing reaches the crew until the crew lead allows that phone, as one of the crew members or as someone new. For each ask we keep the name typed, the browser’s public key and the kind of device it reports, when it asked, and whether the crew lead allowed it or said no; we keep each ask, including ones the crew lead said no to or that ran out, until the crew is deleted. We keep the shop code itself so the crew lead can show and print it again, and turning it off or making a new one stops the old one working. A phone stays signed in until the crew lead signs it out or archives the crew member, or until a new invite for the same person is used or the crew lead allows another phone as them. A signed-out phone stays listed as signed out. To keep anyone from replaying a phone’s requests, we briefly keep an identifier from each request it sends, as described under "Data Retention". The camera is used to read an invite’s QR code and, when you choose, to take a photo for a shift. A QR code’s picture is read on the phone and is not kept or sent. A photo you add is sent and kept as described under "Photos on Shifts".

The crew lead can add a shift, change its start, end, job and note, and delete it, and can clock a crew member in or out. Every change the crew lead makes is kept: which field changed, what it was before and after, the reason if one was given, when, and which crew lead’s account made it. A shift with any such change is marked "edited" in the apps and in the timesheets. A deleted shift disappears from the apps and the timesheets but is kept, with its times, its note and its history. A crew member can change the note on their own shift from their phone. That replaces the note, and the earlier note is not kept. A crew member can also ask the crew lead to change the start or end of one of their own shifts, with a note saying why. Hour Hand keeps each request: the shift’s times when it was sent, the times asked for, the note, whether the crew lead accepted or declined it, any note the crew lead added, and when it was sent and answered. The crew lead sees every request on the crew; a crew member’s phone shows only their own. An accepted request changes the shift as the crew lead’s own change, kept as described above, with the crew member’s name and note as its reason. A new request for the same shift replaces one that is still waiting, and the earlier one is kept. A request for a deleted shift is declined automatically.

A crew member can add photos to their own shifts, and the crew lead can add photos to any shift on the crew, from the camera or from the phone’s photo library. The app sends a smaller copy of each photo, at most 1,600 pixels on its longest side; making the copy leaves out the location and the other details the camera stored with the original. Hour Hand keeps each photo with its shift, with who added it and when. A shift holds at most 20 photos. The crew lead sees every photo on the crew. A crew member’s phone shows only the photos on their own shifts. A crew member can delete the photos they added, and the crew lead can delete any photo. A deleted photo disappears from the apps but is kept, like a deleted shift. Photos are not part of the timesheets.

Hour Hand also works in a web browser at hourhand.bravely.dev, with the same crews, shifts and records. A crew lead signs in with their Bravely Account. A crew member’s browser joins from an invite the same way a phone does: it makes a key that stays in that browser’s storage and sends us only the public half, and we record it as a web browser with a short description such as "Android browser". The web version sends no usage events and no error or diagnostic reports, and it keeps in the browser only what it needs to work: the sign-in or the browser’s key, which side of the app it is set up for, and your Feedback mode setting. Clearing the browser’s data signs that browser out.

After each pay period ends, Hour Hand emails the crew’s timesheets to the crew’s timesheet address, from hourhand@bravely.dev. The crew lead can also send them at any time with Email now, or download them to share from the phone. The email holds the crew’s name, each crew member’s name and hours for the period, and two files: one lists every shift with the crew member’s name, the date, the start and end times, the hours, the job, the note, whether it was edited and an identifier for the shift; the other lists each crew member’s weekly hours. The email delivery provider named under "Sub-processors" receives the whole email to deliver it and keeps its own log of it. Once a timesheet has been sent or downloaded, its copy belongs to the person who received it. We cannot recall or delete it. The confirmation email for a new timesheet address holds only fixed text and a link, never the crew’s name or anything the crew lead typed.

On a crew member’s phone, Hour Hand keeps its key, the identifier for the phone’s place on the crew, the crew member’s name and crew, the jobs and recent hours, and any clock-ins, clock-outs and notes that have not been sent yet. Reminders, such as "Still on the clock?", are scheduled on the phone itself and are not sent through us. When the phone is signed out, it keeps any clock-ins and clock-outs it had not sent, so they are not lost and the crew lead can add those shifts by hand. Deleting the app removes everything it kept on the phone. On a crew lead’s phone, Hour Hand keeps the Bravely Account sign-in, and timesheets you download are saved on the phone so you can share them.

Both apps send usage events to the analytics provider named under "Sub-processors": for example, that the app was opened, a crew was set up, a crew member was added, an invite was made or used, someone clocked in or out, a note was saved, a shift was edited, a change was asked for, accepted or declined, or timesheets were sent. Each event carries the app’s name, version and platform and, on iPhone, the iOS version, plus a few fixed details, such as whether a job was chosen or which sign-in method a crew lead used. The provider’s library also adds details of the phone, such as its model and operating system. Events never carry a name, a note, a phone number, an email address or an invite link. Each event records when it happened, so a clock-in or clock-out event shows when someone clocked in or out on that phone. Events from a crew member’s phone carry only an identifier for that installation of the app, never anything that names the crew member. Events from a crew lead’s phone carry an identifier for the installation and, after the crew lead signs in, their Bravely Account identifier, which also links the events sent before signing in. The analytics provider estimates an approximate location (country, region and city) from the network address each event comes from, and keeps it with the event. Usage analytics are on until you turn them off with Share usage analytics: on a crew lead’s phone under Help & Diagnostics in Settings, and on a crew member’s phone under Help & About. The choice is kept on that phone. While it is off, the app sends no usage events from that phone, and its diagnostic reports leave out the record of your activity, as described under "Error Reports and Diagnostic Reports". Events already sent are not deleted. The switch does not change the records our account service keeps of a crew lead’s sign-ins, which the Bravely Account policy describes.

Hour Hand sends the error reports and diagnostic reports described under "Error Reports and Diagnostic Reports". Both kinds of phone send automatic error reports. Only a crew lead’s phone sends diagnostic reports. They are sent with the crew lead’s Bravely Account, so each one is linked to that account. A crew member’s phone has no account, so it sends no diagnostic reports and has no Send Diagnostic Report. On a crew lead’s phone, Help & Diagnostics has Send Diagnostic Report, the switch for automatic diagnostic reports (Send diagnostic reports when something goes wrong) and Verbose diagnostics, which records more detail in the app’s log for 24 hours, with details removed in the same way, and then turns itself off. The switch for automatic diagnostic reports is separate from the switch for automatic error reports and from the question the app asks in the European Economic Area and the United Kingdom. It is on until the crew lead turns it off, there too. In Hour Hand, a diagnostic report’s counts and settings include which side of the app the phone is set up for and how many clock-ins and clock-outs are waiting to send or did not go through, and its log entries are the app’s latest 200. Like the rest of the report, they are built to leave out names, notes and invite links.

While Hour Hand is being tested, Settings can show a Feedback mode switch. With it on, pressing and holding anything in the app opens a short form to tell the Hour Hand team what should change. Nothing is sent until you press Send. Then the app sends us your note, the name of the screen, the label of what you pressed and where on the screen you pressed it, the app’s version, your operating system version and your phone’s model, and, from the iPhone and Android apps, a picture of the screen as it was when you pressed. No picture is sent from a screen that shows an invite, and the web version sends no picture. A crew lead’s note is sent with their Bravely Account and their crew; a crew member’s note is sent with their name and crew. The Hour Hand team reads each note and its picture in our own tools to decide what to change. We keep notes and pictures until the crew lead’s Bravely Account is deleted, when we delete them with the crew, or until we are asked to delete them. You can turn Feedback mode off at any time in the same place.

Hour Hand never asks for your phone’s location, and it does not read your contacts or your files. It reads a photo from your library only when you pick one to add to a shift. (Our analytics provider estimates an approximate location from your network address, as described under "Usage Analytics".) The only permissions its apps ask you for are the camera, to read an invite’s QR code and to take photos for shifts, and notifications, for the reminders. Hour Hand has no advertising, and we do not sell your data or share it for advertising. Our server writes short technical log lines that name an event and its result, never a web address, an invite or confirmation link, a name or a note.

Here is how long each kind of record is kept: • Crews, crew members, jobs, shifts and the history of changes are kept until the crew lead’s Bravely Account is deleted, as described below, or until we are asked to delete them. The apps have no control that deletes a single crew, crew member or job. Archiving a crew member signs out their phone and cancels their invites; their name, phone number and shifts are kept. A deleted shift is kept with its history, as described under "Changes to Shifts". • Records of signed-out phones, used and expired invites, timesheet addresses that were asked for and timesheet emails are kept with the crew, and so are the crew’s customers, the photos on its shifts and its Feedback mode notes and pictures. • The identifiers we keep to stop a phone’s requests being replayed are deleted once they are more than 10 minutes old, by a cleanup that runs every hour. • Error reports and diagnostic reports are kept as described under "Error Reports and Diagnostic Reports". Usage events are kept by our analytics provider; we have not set an end date for them. • Copies of the crew’s records are in our backups, described under "Backups", until those copies expire. A crew lead can delete their Bravely Account in the app (Settings, then Delete account) or at bravely.dev/delete-account. The account can be restored by signing in again within 30 days. When the 30 days end, we delete every crew that crew lead runs, with its crew members, their phones and invites, its jobs, its shifts and the history of changes, its timesheet addresses and the record of its timesheet emails. Until then the crew keeps working: crew members can still clock in and out, and timesheet emails keep going to the crew’s timesheet address. To have a crew, a crew member, shifts or anything else in Hour Hand deleted sooner, the crew lead can email privacy@bravely.dev from the address on their account and tell us what to remove. A crew member can email privacy@bravely.dev too; because the shifts are the crew lead’s work records, tell us the crew lead’s name so we can find them. What happens to the Bravely Account itself follows the Bravely Account policy at bravely.dev/privacy/bravely-account.

Crew members can be teenagers who work for the crew lead, sometimes their own children. Hour Hand is not directed at children under 13, and it does not ask anyone’s age. A crew lead should add only people 13 or older, and, where 16 is the relevant age for information-society services, only people 16 or older. A crew member under the age of majority should use Hour Hand with a parent’s or guardian’s knowledge. Crew leads need a Bravely Account, which is intended for adults. If you believe Hour Hand holds information about a child under 13, email privacy@bravely.dev and we will delete it.

Hour Hand can send us two kinds of technical report, which you control from Help & Diagnostics in Settings (on a crew member's phone, which sends only error reports, from Help & About). Automatic error reports do not carry your Bravely Account identifier or your email address. Diagnostic reports carry your Bravely Account identifier. We use both only to find and fix problems, and we do not sell them or use them for advertising. Automatic error reports When the app records an error or a warning, it can send us a short report about it. It collects these on your device and sends them in small batches, about once a minute while problems are happening. A report names the app, the platform, the app version and your operating system version. For each problem it gives: • its category and type, and a short description of it with details removed • how many times it happened, and when it was first and last seen • whether you were signed in, whether you had an active plan, and whether the device was online Some apps also add how long the app had been running, the names of up to three functions in the app's code where the problem happened, and up to ten of the app's own log entries from just before it, with details removed. Before a report leaves your device, the app removes details such as email addresses, account identifiers and file paths from its text. Our server removes those details again before the report is stored, and also removes network addresses, long strings of hexadecimal characters and sign-in tokens in the common JWT format. Error reports do not contain your Bravely Account identifier or your email address, and our server does not record your IP address with them. Our apps are built to keep the contents of your crew's records out of error reports. Instead of a device identifier, each report carries a code that the app works out from a random identifier it keeps for its installation and from the date, so the code changes every day. We use the code to count how many devices ran into a problem on a given day and to limit how many reports one device can send. When you first open Hour Hand, it asks our server which country your connection comes from, and the server answers without storing the answer. If the country is in the European Economic Area or the United Kingdom, automatic error reports are off until you turn them on, and the app asks you once whether to turn them on. Everywhere else, they are on until you turn them off. Until the answer arrives, Hour Hand for iPhone sends reports, and it keeps sending them if no answer comes; Hour Hand for Android waits for the answer, and if none comes, goes by the region in the phone's language settings. You can turn automatic error reports on or off at any time: on a crew lead's phone under Help & Diagnostics in Settings, and on a crew member's phone under Help & About. The first time you turn them off, the app shows a short note and asks you to confirm. We delete each report after 30 days, and the hourly counts we make from reports after 7 days. We keep a summary of each kind of problem with no set end date: its category, type and description with details removed, the app versions it happened in, how many times it happened, on how many devices it happened each day, when it was first and last seen, and a recent example of the log entries that led up to it. Diagnostic reports A diagnostic report is a fuller report about one problem. The app sends one when you press Send Diagnostic Report. Unless you turn automatic diagnostic reports off under Help & Diagnostics, it also sends one when the app stops responding for 5 seconds or more, or the next time you open it after it closed unexpectedly, at most once an hour for the same kind of problem. Automatic diagnostic reports are on by default wherever you are. Diagnostic reports are sent only while you are signed in. A diagnostic report contains the app version, your operating system version, a few counts and settings from the app (for example, how many documents are open, or whether sync is on) and, where the app keeps them, its own recent log entries. In versions of Hour Hand that send the newer reports, a report can also contain: • A record of your recent activity in the app: the names its code gives to its screens and to events such as signing in, changing a setting, the network going offline or a key press the app ignored, with details limited to numbers, yes-or-no values and fixed words that the app's code defines, such as a count or which part of the app something started from. Any other word is left out, so the record is built to leave out names, what you typed, which keys you pressed, file names, addresses, identifiers and the contents of your crew's records. The app keeps this record, up to its latest 200 entries, only in its memory while it runs, and it leaves your device only inside a diagnostic report. • The state of the app when the report was made. For example: the screen, dialog and tool you were using, what kind of control your typing would go to, what kind of item was selected and how many, and which kinds of window were open. It also shows the state of the network, whether you have an active plan or trial, how long the app had been running and, in apps that sync, the state of sync. In some apps, it shows whether the app has the system permissions it uses. In apps with system-wide keyboard shortcuts, it can show up to eight of them, with the keys each is set to and whether it is working, and how long ago the app last noticed any key being pressed. Like the record, it holds only numbers, yes-or-no values and fixed words, never titles, names or text. • Your display and time zone: the size in pixels and the scale of the display the app is on, and the difference between your time zone and UTC; on a computer, how many displays you have; on Windows and Linux, the version of the software framework the app runs on; and on Linux, which desktop you use and whether it runs on X11 or Wayland. • Up to 50 recent warnings and errors, each with a description with details removed and, where it has one, a short code, and how many warnings and errors the app had recorded. • How the app's previous session ended (normally, in a crash, or unexpectedly, for example because it was forced to quit), with its version, how long it ran and the main steps it recorded, such as starting up. To know this, the app keeps a list of those steps in a file on your device, which it starts again each time it opens. If you have turned off usage analytics in the app, its newer reports leave out the record of your activity and the previous session's list of steps. In their place they carry a note that the record was left out and a few counts: how many entries the app recorded, combined or dropped to stay within its limit, how many event names or details its filter refused or replaced, and how many times the signed-in account changed. The rest of the report, including the state of the app and the previous session's last step, is still sent, because it describes the problem rather than how you use the app. When a different account signs in, the app first discards everything it recorded for the newer reports until the previous account signed out (or, with no sign-out, until the switch), keeping only a count of how many times the account has changed since the app started. What it recorded while no one was signed in, such as the steps of signing in, can appear in the new account's reports. The app removes details such as email addresses, file paths, and keys or tokens from log entries before they go into a report, and our apps are built to keep the contents of your crew's records out of a report. In the newer reports, the app also removes text in common quotation marks, network (IP) addresses, the names of document and media files it recognizes by their endings, and your user and computer names, though some details, such as a name it does not recognize, can still appear. Some apps have a switch that records more detail in their own log for 24 hours and then turns itself off. That log stays on your device, apart from the entries that go into a report. With each diagnostic report we record your Bravely Account identifier, the user agent of the app or browser that sent it, the country your connection came from and when it arrived. When you send a report yourself, the app shows you a short code, such as DIAG-7K2QM, to give to support so we can find it. A report's log file, which holds its log entries and, in the newer reports, the record of your activity, the recent warnings and errors and any steps from the previous session, is deleted automatically after 90 days. We keep the rest of the report with no set end date, so we can see patterns across reports: its short code if it has one, your account identifier, the app and its versions, why it was sent, the counts and settings, the user agent and country, when it arrived, and, in the newer reports, the state of the app, your display and time zone details, how many warnings and errors the app had recorded and, if it had recorded any, a short label for the most recent error (or, if there was none, the most recent warning), and, where the app records it, how the previous session ended and its last step. Deleting your Bravely Account deletes your diagnostic reports from our live systems. Our data warehouse keeps its copy of what we keep from each report, without the user agent and country, under your account identifier, as the Bravely Account privacy policy describes. To have a report deleted sooner, email privacy@bravely.dev. Where reports are kept Both kinds of report are stored in database and file storage that Cloudflare runs for us, and copied into a data warehouse that we run ourselves. Diagnostic reports, apart from their log files, are also copied each night into our encrypted backups, described under "Backups" below. When our team looks into a problem, they can attach a diagnostic report to an issue in our own issue tracker, whose data Google stores for us. The issue keeps the report's short code (or its number), the app and platform, the app and operating system versions, whether the report was sent by hand or automatically, when it arrived and, for a newer report, a one-line summary of what it shows, such as the screen in use and the most recent problem. It stores the sender only as "customer account", not their account identifier or email address (for a member of our team, it stores their name or email address and their account identifier), and it keeps all of this after the report itself is deleted. While the report and the sender's account exist, our team can see the sender's email address when they view the issue.

We keep backups so that we can recover our customers' data if it is ever lost. Each night we copy the databases that hold accounts, purchases and the content our apps and services keep for their users, including sign-in records and the protected form of passwords, and we copy the files stored with us, such as documents, screenshots and attachments. Unless a section above says otherwise, the account, purchase and content records this policy describes, and the files you store with us, are in these backups. Where backups are kept Backups are kept in two places, both in the United States: on storage equipment that we own, and in Amazon S3, a storage service run by Amazon Web Services. Every copy of a database or of sign-in records is encrypted, with a key that only we hold, before it is stored in either place. The copies of stored files that we keep in Amazon S3 are also encrypted with a key that only we hold, file names included; the copy of those files on our own equipment is not separately encrypted. Amazon does not have our keys, so it cannot read your data in the backups. How long backups are kept Each night's copy of our databases and sign-in records is deleted after 90 days and fully purged within 30 days after that, so it is kept for about four months at most. One copy each month is kept for up to 12 months instead, and fully purged within 30 days after that, so it is kept for about 13 months at most. The backup of stored files keeps each file for as long as it is stored with us; when a file is deleted or replaced, the backup keeps the earlier version for 90 days and then deletes it. Separately, Cloudflare, which runs most of our databases, keeps a recovery history of each of them for 30 days. How backups are used We use backups and that recovery history only to restore data after it has been lost, for example in an outage, through a mistake or in an attack, and we also use backups to test that restoring works. Deleting something, or deleting your account, does not remove it from backups made before the deletion or from the recovery history: those copies stay until they are deleted on the schedules above. If we restore data from a backup or from the recovery history, we re-apply the deletions made after the point we restore to, including account deletions, so that the restore does not bring back data that had been deleted.

Depending on where you live, you have rights over the personal data we hold about you. We honor these rights for everyone who asks, regardless of where you live. • Access — ask what personal data we hold about you and get a copy. • Correction — ask us to fix data that is wrong or incomplete. • Deletion — ask us to delete your personal data by emailing privacy@bravely.dev from the address on your account. Where a product has a built-in Delete Account control you can use that instead; bravely.dev/delete-account explains what applies to each product. • Portability — ask for your data in a portable, machine-readable format. • Objection and restriction — ask us to stop or limit certain processing. • Withdraw consent — where we rely on consent (for example, marketing email), you can withdraw it at any time without affecting processing that already happened. • Non-discrimination — we will not degrade your service or charge you more for exercising any of these rights. EEA and UK residents also have the right to lodge a complaint with your local supervisory authority. California residents may use an authorized agent; we may verify the agent's authority and confirm the request with you first. Other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as they take effect) have equivalent rights, including a right to appeal a denied request — reply to our decision email with "Appeal" and we will respond in writing within the period the law requires. Canadian residents have access, correction, and consent-withdrawal rights under PIPEDA; Australian residents have access and correction rights under the Australian Privacy Principles. To exercise any right, email privacy@bravely.dev. We respond within the timeframe the applicable law requires — generally 30 days under GDPR and 45 days under the CCPA, with an extension where the law permits one. We may need to verify your identity before acting, usually by confirming control of the email address on the account.

If you are in the EEA or UK, we rely on these lawful bases under the GDPR and UK GDPR: • Performance of a contract — creating and securing your account, delivering the features you paid for, syncing your content, processing purchases, and providing support. • Legitimate interests — keeping the service secure and reliable, preventing fraud and abuse, understanding how our products are used through usage events tied to an installation or to your account, and improving the product. We balance these against your rights and do not use them to justify intrusive tracking. Where an app lets you turn its usage analytics off, doing so is one way to object. • Consent — marketing email, and anything else we ask your permission for before we collect it. You can withdraw consent at any time. • Legal obligation — keeping tax, accounting, and consent records, and responding to lawful requests.

Bravely Studios LLC is a US company. We and our sub-processors process data in the United States and in other countries where they operate. For personal data originating in the EEA, UK, or Switzerland, we rely on appropriate transfer safeguards in our processor agreements — such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum — where those safeguards are required. Email privacy@bravely.dev if you want more detail about the safeguards that apply to you.

For California residents, the categories of personal information we collect for this product are: • Identifiers: a crew lead’s Bravely Account identifier and email address, and the timesheet address the crew lead chooses; each crew member’s name and, if the crew lead adds one, phone number; for each phone a crew member uses, its public key, its kind and model, and when it joined and was last used; and identifiers for each installation of the app. • Professional or employment-related information: the jobs a crew lead gives each crew member and the customers a crew lead adds; each shift’s start and end times, its customer, job and note, its photos, the hours that follow from them, the changes the crew lead makes to shifts, the changes crew members ask for with their notes, and the timesheets made from them. • Audio, electronic, visual or similar information: photos added to shifts, and pictures of the app’s screen sent with a note in Feedback mode. • Internet or other electronic network activity: usage events and automatic error reports from the apps, diagnostic reports from a crew lead’s phone, and request details such as your network address. • Coarse geolocation: a country-level signal derived from your network connection, used to decide whether automatic error reports start on, recorded with a diagnostic report, and kept with your Bravely Account for consent rules; and the approximate location (country, region and city) our analytics provider estimates from the network address of each usage event. We collect this from you, your device, and our own systems, and we use it to run the product, honor what you have bought, keep the service secure, and support you. We disclose it to the service providers listed under "Sub-processors," each for a business purpose under a written contract. We do not sell your personal information and we do not share it for cross-context behavioral advertising, as those terms are defined by the CCPA and CPRA, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for any purpose that would trigger the right to limit. If that ever changes we will update this policy and provide the required opt-out before the practice begins. Retention is described under "Data Retention" and "Backups" above and, for account-level data, in the Bravely Account privacy policy.

We use the following service providers to run this product. They receive only what they need to perform their service for us, and each is bound by the data-processing terms that apply to our use of their service. Where a provider is not yet covered by a written data-processing agreement with us, its entry below says so. If you need a data-processing agreement in place before you use this product, email privacy@bravely.dev: • Cloudflare, Inc.: hosting for hourhand.bravely.dev, bravely.dev and our account service, including the database that holds your crew’s records. See cloudflare.com/privacypolicy. • Google LLC: Firebase Authentication, which backs Bravely Account sign-in (including Sign in with Google); Google Play, which delivers the Android app; and the issue tracker described under "Error Reports and Diagnostic Reports". See policies.google.com/privacy. • Apple Inc.: Sign in with Apple, when a crew lead chooses that sign-in method, and the App Store and TestFlight, which deliver the iPhone app. See apple.com/legal/privacy. • RevenueCat, Inc.: keeps the purchase records for Bravely Accounts. Hour Hand sells nothing, so it holds no purchase for Hour Hand, but the first time a Bravely Account signs in with Apple or Google, and on some other sign-ins, our account service sends it the account’s identifier, email address, name (when the sign-in provides one), country and the app the sign-in came from. Crew members’ information never goes to it. See revenuecat.com/privacy. • PostHog Inc.: product analytics. Hour Hand’s apps send it the usage events described under "Usage Analytics", and our account service sends it records of crew leads’ sign-ins. It receives the network address each event was sent from and estimates an approximate location from it. See posthog.com/privacy. • Resend Inc.: sends Hour Hand’s timesheet emails and timesheet address confirmations, which it receives in full, attachments included, and the email for your Bravely Account, such as sign-in codes and password resets. See resend.com/legal/privacy-policy. • Anthropic, PBC: reads the column names and up to 20 rows of a file a crew lead imports, and any correction the crew lead types, to work out how the file is laid out (see "Importing Past Shifts"). See anthropic.com/legal/privacy. • Amazon Web Services, Inc.: Amazon S3, which stores our backups in the United States, as described under "Backups". The copies of your data that we keep there are encrypted, with a key that only we hold, before they leave our systems, so Amazon cannot read them. See aws.amazon.com/privacy. If we add or change a sub-processor in a way that materially changes how your data is processed, we will update this policy and give additional notice where the law or our data-processing commitments require it.

We protect your data with authenticated accounts, encryption in transit, access controls on our backend systems, and a deliberately small number of people who can reach production. No system is perfectly secure, and we do not claim guarantees we have not built and verified. Where a product makes a specific security claim, that claim appears in the app-specific sections above and is limited to what we have actually shipped. If we become aware of a breach affecting your personal data, we will notify you and the relevant regulators as required by law.

We may update this Privacy Policy from time to time. If we make a material change — a new category of data, a new sub-processor, a new purpose, or a new legal basis — we will update the "Last updated" and "Effective" dates and give additional notice where the law requires it. Where a change requires fresh consent under the GDPR, UK GDPR, CASL, or a similar regime, we will ask for it before relying on the new purpose. Non-material changes (typos, clarifications, link fixes) are reflected by updating the "Last updated" date.

Bravely Studios LLC Privacy and data rights: privacy@bravely.dev Product support: support@bravely.dev Website: https://bravely.dev Postal address: available on request to privacy@bravely.dev.