Privacy Policy

Timewix (timewix.com) is a time tracking, invoicing, payroll, and team management platform for businesses, operated by Rocky Soft Inc., a company incorporated in Alberta, Canada ("Rocky Soft", "we", "us"). This policy explains what information we collect when you use Timewix, why we collect it, who we share it with, and the choices you have. Our approach to privacy follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). If anything here is unclear, email us at support@timewix.com and we will explain it plainly.

Timewix has a personal mode for freelancers and an organization mode for teams. When you work inside an organization, the records you create there (time entries, approvals, invoices, payroll summaries) are visible to other members of that organization according to the roles and permissions its administrators configure.

Account information.When you create an account we collect your name, email address, and a password, and we verify the email address before the account is fully active. Passwords are stored hashed; we cannot read them. If we offer sign-in through a third-party provider such as Google and you choose it, we receive your name, email address, and basic profile information from that provider instead of a password, under the provider's own privacy policy.

Content you create. Timewix stores the working records you and your team put into it: organizations, projects, tasks, clients, time entries, timesheet approvals, invoices, payroll summaries, and the notes and settings attached to them. Invoices and client records can include the names and contact details of your own clients, which you are responsible for having the right to use.

Billing information. Paid subscriptions are processed by Stripe. Your card number goes directly to Stripe and never touches our servers; we do not store it and cannot see it. We keep what we need to run your subscription: your plan, its status, and the billing records Stripe shares with us. Stripe also calculates any applicable tax, which may require your billing address.

Bank account data.If you connect a bank account to reconcile invoices, the connection is made through Plaid. You log in to your bank on Plaid's own interface, so your banking username and password are never seen or stored by us. Through Plaid we receive read-only data: account details, balances, and transactions, which we use to match incoming payments to your invoices. The access tokens that authorize this connection are encrypted at rest using AWS KMS envelope encryption.

Technical information. Like most online services we keep server logs (IP address, browser type, pages requested, timestamps) and diagnostic data that help us keep Timewix reliable and secure. If you send a feedback or bug report from inside the app, it includes technical context such as the page you were on, your viewport size, browser, locale, timezone, and recently failed requests, plus up to three screenshots if you choose to attach them.

We use the information above to:

• provide and operate the service: tracking time, generating invoices, running approvals and payroll, and reconciling payments;
• manage subscriptions and billing through Stripe;
• respond to support requests and investigate bug reports;
• keep the service secure: authenticating sessions, detecting abuse, and diagnosing failures;
• send transactional email such as verification links, password resets, invitations, invoice delivery, and optional digest summaries you can turn off.

We do not sell personal information and we do not use your data for advertising.

We collect, use, and disclose personal information with your consent, or as otherwise permitted or required by applicable law. By creating an account you consent to the collection and use described in this policy for the purpose of providing the service. For more sensitive data, consent is a separate and explicit act: bank data is only received after you choose to connect an account through Plaid, and screenshots are only attached to a feedback report if you add them.

You can withdraw consent at any time: disconnect a bank account, turn off digest emails, or delete your account entirely. Withdrawing consent for data the service needs to operate may mean some features stop working for you.

Timewix uses essential session cookies only: they keep you signed in and protect your session. We do not use advertising cookies, cross-site tracking, or third-party analytics trackers. Because the session cookie is how the app knows who you are, blocking cookies will prevent sign-in from working.

We share personal information with a small set of service providers (subprocessors), each for a specific job:

• Stripe processes subscription payments and calculates tax;
• Plaid connects bank accounts and supplies the read-only transaction feed;
• Amazon Web Services hosts the service and stores its data, including the KMS key service used to encrypt bank access tokens;
• Zoho ZeptoMail delivers transactional email;
• Google provides sign-in, if you choose to use it.

Each provider receives only what its job requires. Beyond these providers, information is shared within your organization according to its roles and permissions, and we may disclose information if required by law or where necessary to protect the rights, safety, or property of Timewix, its users, or others. If Rocky Soft is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, and we will provide notice before your information becomes subject to a different privacy policy. We never sell personal information and never share it for advertising.

Timewix is hosted on AWS in Canada (the ca-central-1 region in Montreal). Some of the providers named above (Stripe, Plaid, Google, and Zoho) may process data in the United States. While information is in another jurisdiction it is subject to the laws of that jurisdiction and may be accessible to its authorities. We use contractual and technical safeguards with each provider to keep protection comparable to what this policy describes.

We keep your information for as long as your account is active. Two controls are built into the app itself: you can export your personal data, and you can delete your account, which purges your personal data from our systems. Records that belong to an organization, such as invoices it issued while you were a member, remain that organization's records, with your account no longer linked to them. Copies in encrypted backups age out on a rolling schedule rather than being individually deleted, and we may retain what applicable law requires us to keep, such as billing records for tax purposes.

We use industry-standard safeguards (encryption in transit, encryption at rest, envelope encryption for bank tokens, access controls) and make every reasonable effort to protect information, but no method of transmission or storage is completely secure and we cannot and do not guarantee absolute security.

If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you and report to the appropriate authorities consistent with applicable law, including PIPEDA, without unreasonable delay.

Timewix is a business tool and is not directed at anyone under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us at support@timewix.com and we will delete it.

You can access, correct, delete, and export your personal information:

• Access and export:request an export of your personal data from the app's settings;
• Correction: most information can be edited directly in the app; for anything else, email us;
• Deletion:delete your account from the app's settings, which purges your personal data as described above.

For any request you cannot complete in the app, email support@timewix.com and we will respond within the timelines applicable law sets. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.

We may update this policy as the service and the law evolve. If a change meaningfully affects how your information is handled, we will notify you by email or with a notice in the app before it takes effect. The date at the top of this page always states the current version.

Questions, requests, and complaints about privacy go to support@timewix.com. Timewix is operated by Rocky Soft Inc., Alberta, Canada.