Privacy Policy

Last updated 18 August 2026. Effective from that date.

Timelo is a product of Blue Wind (bwnd). This page says what we collect, who can see it — including who inside your own company can see it, which is the part people actually want to know — who we share it with, and how to get it deleted. There is no analytics, no advertising and no tracking on this site or in the app.

1. The short version

We collect your name, email address and a hashed password so you can sign in.
We hold the work data you put in: jobs, site addresses, visits, hours, time off, notices, and who confirmed reading each notice.
One cookie, and it exists only to keep you signed in. No analytics, no advertising, no third-party trackers.
We do not sell your data and we do not use it to train machine-learning models.
Email us at [email protected] to get a copy of your data or to have it deleted.

2. Who is responsible for your data

Blue Wind (bwnd) operates Timelo and is the controller of your account data — your name, email and sign-in records.

For the work data inside a company — the schedule, hours, time off and notices — the company that signed up is the controller and Blue Wind is its processor. In plain terms: your employer decides what goes in and who sees it, and we hold it and run the software on their behalf. If you are crew and want your hours changed or removed, ask your manager first; if that goes nowhere, write to us.

3. What we collect

We collect only what the product needs to work. There is no hidden profiling layer.

What	Specifically	Where it comes from
Account	Name, email address, password (stored only as a scrypt hash — we never hold the password itself), your role (manager or crew), the company you belong to, when you signed up, and when you last signed in.	You, at signup — or your manager, if they invited you by email.
Company	Company name, time zone, and the join code used to add crew.	The manager who created it.
Work data	Jobs, client names, site addresses, visits and their times, who is assigned to each visit, reported hours and their approval status, and booked time off.	Managers and crew, as they use the app.
Notices	The notice text, and — for a must-read notice — which person confirmed reading it and the time they confirmed.	Managers post them; crew generate the confirmations.
Invitations	The invited email address, the role offered, and a hashed invite token. Never the raw token: it exists only inside the link we email.	The manager sending the invite.
Session	A hashed session token, its expiry, and the browser user-agent string recorded when the session was created.	Generated when you sign in.
Server logs	Ordinary web-server records — IP address, timestamp, requested URL, status code — kept briefly for security and debugging.	Generated automatically by the hosting platform.

We do not collect location or GPS data. Timelo records the times a person reported, not where their phone was. We do not collect payment details, because we do not currently take payments. We do not ask for date of birth, national insurance or social security numbers, or any other identity document.

4. Who can see it inside your company

This is the part that matters most day to day, so it is spelled out rather than implied.

Managers see everything in their own company: every person's contact details, the full schedule, every reported and approved hour, all time off, and — for a must-read notice — exactly who has confirmed it and who has not.
Crew see the schedule, including who else is assigned to a visit, and the time off other people have booked (as unavailability). They see only their own reported hours — never another person's.
Nobody sees data belonging to a different company. Companies are separated at the database level, and every request is scoped to the signed-in user's company.

A read confirmation is deliberately visible to your manager — that is the feature. If you confirm a notice, your manager will see that you did and when.

5. Cookies

Timelo sets one cookie. It is strictly necessary, so there is no cookie banner to click through — there is nothing optional to consent to.

Cookie	Purpose	Lifetime
`jobclock_session`	Keeps you signed in. It holds a random token and nothing else — no name, no email, no readable content. The server stores only a SHA-256 hash of it, so a copy of our database yields no usable sessions.	12 hours, or 30 days if you tick “remember me”. Signing out deletes it immediately, on your device and on the server.

There are no analytics cookies, no advertising cookies, and no third-party scripts on this website or in the app. Nothing loads from an ad network, a tag manager or a social network.

6. Why we hold it

Purpose	Basis
Running the service — signing you in, showing the schedule, recording hours, delivering notices.	Performance of the contract with you or your company.
Sending service email — invitations, and messages about your account.	Performance of the contract.
Keeping the service secure, preventing abuse, and fixing faults.	Our legitimate interest in a service that works and is not attacked.
Meeting a legal obligation, if one applies to us.	Legal obligation.

We do not do marketing email. If we ever want to, we will ask first, and it will be easy to say no.

We do not sell personal data, we do not rent it, and we do not share it for advertising. We share it only with the services needed to run Timelo:

Hosting. The provider that runs our servers and stores the database.
Email delivery. The provider that sends invitations and account email (currently Resend, or an SMTP provider). They receive the recipient address and the message, and nothing else.
If the law requires it. A valid legal order. We will tell you unless we are forbidden from doing so.
If the business changes hands. Data could transfer as part of a sale or merger. You would be told before it happened, and this policy would continue to apply until you were given notice of a new one.

These providers act on our instructions and are not permitted to use your data for their own purposes.

8. How long we keep it

Account data — for as long as your account exists.
Work data — for as long as the company's account exists, or until a manager deletes it.
Sessions — deleted when they expire or when you sign out. Expired rows are cleared out automatically.
Invitations — deleted after they expire or are accepted.
Server logs — a short rolling window, kept for security and debugging.

When an account or a company is deleted, the associated data is removed from the live database. Backups roll over on their own schedule, so a copy may persist there for a short time before it ages out.

9. How it is protected

Everything is served over HTTPS.
Passwords are stored as scrypt hashes with a per-user salt. We cannot read your password, and neither can anyone who steals the database.
Session tokens and invite tokens are stored hashed, never in the clear.
The session cookie is HTTP-only and same-site, so page scripts cannot read it and another site cannot ride on it.
Every API request is scoped to the signed-in user's company and checked against their role before anything is returned.

No system is perfectly secure. If a breach affects your data, we will tell you and the relevant regulator as quickly as we reasonably can.

10. Your rights

Wherever you live, you can ask us to:

Access — give you a copy of the personal data we hold about you.
Correct — fix anything inaccurate.
Delete — remove your account and your personal data.
Export — hand your data over in a portable format.
Object or restrict — stop or limit a particular use.

Email [email protected] from the address on your account and we will respond within 30 days. There is no charge.

If you are crew: your work data belongs to your company's records, so a request to delete hours or a schedule generally has to go to your manager. We will help you reach them, and we will act ourselves where the law says we must.

US residents. Several states — including California, Colorado, Connecticut, Virginia and others — grant rights to know, delete, correct and port personal information, and to opt out of its sale or of targeted advertising. We honour these for everyone, not only for residents of those states. We have no sale or targeted advertising to opt out of: we do neither.

UK and EU residents. You have the rights above under UK/EU GDPR, and you may complain to your national data protection authority — in the UK, the Information Commissioner's Office.

We will never discriminate against you for exercising any of these rights.

11. Children

Timelo is a tool for workplaces and is not intended for children. Do not create an account for anyone under 16. If we learn that we hold data about a child under 16, we will delete it.

12. Where your data is held

Timelo is operated from Idaho, United States, and your data is processed in the United States. If you are using it from outside the US, that means your data is transferred to and stored in a country whose data protection law may differ from your own. Where a transfer out of the UK or EEA is involved, we rely on the standard contractual clauses approved for that purpose.

13. Changes to this policy

We will update this page when what we do changes. The “last updated” date at the top always reflects the current version. For a change that materially affects how we handle your data, we will give notice by email or in the app before it takes effect.

14. Contact

Blue Wind (bwnd) — [email protected]

Privacy questions, data requests and security reports all reach us at that address. A real person reads it.