What we collect
- Account details: your name, email address and password. Your password is handled by Amazon Cognito and is never visible to us.
- What you record: your activities, hours, dates, categories, notes and the evidence files you upload (photos, PDFs, certificates).
- Group data: if you create or join a group, your membership and role, invitations, events and sign-ups, check-ins and clock-in and clock-out sessions, chat messages, the hours the group approved for you, and reports generated for that group.
- Payments: handled by Stripe. We receive a payment confirmation and a Stripe customer reference. We never see or store your full card number.
- Messages to us: the name, email and message you send through our contact form.
- Technical data: IP address, request logs and error logs that our hosting provider records so we can keep the service secure and working, and which link or website you came from when you signed up (for example a post or an ad). We also count visits to our site without cookies: which page was viewed, the website a visit came from and whether it was on a phone, kept only as daily totals, never with your IP address or account. We do not use advertising trackers or pixels.
How we use it
- To run the service: store your records, show your hours and your group's totals, and generate the reports a group asks for.
- To send account and service email: a welcome message, group invites, a few tips for a new group's leaders, and notices about hours that were approved or need a decision. Every tip email has an unsubscribe link.
- To process a group's payment and manage its plan.
- To answer your messages and provide support.
- If you ask someone to confirm your hours, to email that person the activity's title, organization, date and hours, plus your name and optional note.
- To protect the service from abuse and fix problems.
Who can see your data
Your own record is private to your account. If you join a group, its leaders (owners, admins, managers and moderators, according to their role) can see your membership, the hours you send to the group and the hours it approves for you, your check-ins and clock sessions, your event sign-ups, and the messages you post in its channels. Other members see your name and your messages in the channels they can read.
We use these service providers to operate HourRally:
- Amazon Web Services (United States, us-east-1 region) for hosting, database, file storage, sign-in and email delivery.
- Stripe for payments.
We share information beyond this only if the law requires it or to protect the safety of our users.
Phone notifications
If you turn on notifications, we store your device's push address (provided by Apple, Google or Mozilla) so we can send you approved hours, confirmations and group news. Messages are encrypted end to end. Turn them off any time from your account page; we delete the address right away.
How long we keep it
- Your account, record, activities and evidence: until you delete them yourself, and for up to 3 years from the last time a group's plan covered you (or from when you opened your account, if none did). After that we delete all of it. We email you 30 days before, with a link to download a copy.
- Group chat messages: 30 days by default, or the retention period the group sets.
- Raw check-in and clock-in and clock-out sessions: 90 days. Daily totals: about 2 years.
- Generated report files: 7 days.
- Notifications: 30 days. Activity history (audit log): 1 year.
- Contact-form messages: 1 year.
- Server logs: 14 days.
Security
Data is encrypted in transit and at rest. Evidence files are stored in a private bucket and are only reachable through short-lived links. Each account's records are isolated from other accounts. How we keep groups safe.
Children
Children under 13 may not create their own account. Members under 18 should use the service with the knowledge and permission of a parent or guardian, and a group's leaders are responsible for inviting only members their organization allows. If you believe a child under 13 has given us personal information directly, contact us and we will delete it. We collect only what is needed to keep the record of hours and delete it on the schedule above.
Your choices
- You can view and edit your records at any time in your dashboard.
- You can download a copy of your data or delete your account at any time from Dashboard, Account, Your data. If you can't sign in, email team@hourrally.com and we help within 30 days.
- You can stop a group's messages and notices by leaving the group.
Changes
If we make material changes to this policy, we will update the date above and let account holders know by email or in the app.
Contact
Questions about privacy? Email team@hourrally.com or use our contact form.