How HoursLeft handles your data

This policy explains what information HoursLeft collects when you use hoursleft.shabsand.com, why, who processes it on our behalf, how long it is kept and how you can delete it. It describes what the product actually does.

To sign you in we store your email address, an optional business or display name, your time zone and session records. We don't use passwords: sign-in uses one-time links sent by email. Sign-in links and session ids are stored only as one-way hashes. When a sign-in link is requested we store the requesting IP address with it, only to limit abuse; these records are deleted within two days.

You enter or import client names, retainer start dates, contract terms (hours, fees, rollover and overage rules) and time entries (date, duration, and the description, person and project fields your time tracker exports). Some of this can be personal data about you, your team or your clients. You decide what to upload; we process it only to run HoursLeft for you.

When you upload a CSV file, we keep the parsed rows only until you finish or abandon the import (abandoned uploads are deleted within two days). The original file itself is not stored.

A statement link shows one client's balance history to anyone who has the link. Links are long random tokens, are marked not to be indexed by search engines, and stop working as soon as you turn them off or create a new one. We don't run analytics on statement pages and don't identify the people who view them.

To understand how HoursLeft is used and improve it, we use Atlas, a first-party analytics system that SHABSAND runs on its own infrastructure. No third-party analytics or advertising service receives your activity, and we don't use advertising cookies.

Atlas records the pages you visit, the site that referred you and campaign tags in the link, device type, browser, operating system, screen size, language, an approximate location derived from your IP address (the IP address itself is not stored), a random visitor id kept in your browser's local storage, time on page, scroll depth, clicks on links to other sites, and product events such as "client created" or "import completed". Events never include client names, entry descriptions or the contents of your files. When you are signed in, this activity is linked to your account id and email so we can support you.

Atlas is not loaded on statement pages or on the sign-in confirmation page. If your browser sends a Global Privacy Control or Do Not Track signal, Atlas is not loaded at all.

• Railway hosts the application and its database (region: Amsterdam, Netherlands).
• Resend delivers sign-in emails; it processes your email address and the message.
• PayPal processes Pro subscription payments. HoursLeft never sees your card or bank details; we store the subscription id, plan, status and renewal date PayPal returns to us.
• Cloudflare provides DNS for our domain, and traffic may pass through its network for security and performance.

Traffic between your browser and HoursLeft is encrypted (HTTPS).

Account and retainer data stay until you delete them or your account. Sessions expire after 30 days and are then removed. Database backups are taken daily and kept for seven days. Server logs, which can contain request metadata such as IP addresses, are kept for a limited period for security and debugging. Analytics are kept as long as they are useful for understanding product usage.

In Account → Your data you can download everything in your account as a JSON file, and delete your account. Deletion is immediate and permanent: every client, contract term, time entry and import is removed and every statement link stops working. An active Pro subscription is cancelled first. Copies in backups disappear as backups rotate, within seven days. To also remove analytics linked to your account, email hoursleft@shabsand.com.

We don't sell personal data, use it for advertising, or use your data to train AI models. We don't claim any security or compliance certification; we apply reasonable technical measures for a small service and describe them honestly here.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict its processing. You can do most of this yourself in the product. For anything else, email hoursleft@shabsand.com and we'll respond within a reasonable time. HoursLeft is not intended for anyone under 16.

If this policy changes in a way that matters, we'll update the date above and, for significant changes, tell account holders by email.