Privacy Policy

This policy applies to the Tidly web application at usetidly.app, the Tidly desktop app for macOS and Windows, the Tidly browser extension, our websites, and the APIs behind them. We call all of these "the Service".

Tidly is sold to organisations, not to individuals. Most people who use it do so because their employer or client signed up. Tidly is a workplace tool and is not directed at children; we do not knowingly collect information from anyone under 16.

We handle two kinds of information under two different sets of responsibilities, and it is worth being clear about which is which.

Your organisation's data: we act on their instructions

Time entries, projects, clients, budgets, rates and everything else your organisation records in Tidly belongs to your organisation. We hold it on their behalf and act on their instructions. If you are a member of someone else's Tidly organisation and you want that data corrected or removed, your organisation decides. Ask an administrator there first. We will help them, and we will tell you to talk to them.

Your own account and our own business: we decide

Your sign-in credentials, our billing records, support conversations, and the technical logs that keep the Service running are ours to manage directly. For these, we are the ones responsible, and you can come to us.

Account information

• Your name and email address.
• A cryptographic hash of your password. We never store the password itself and cannot read it.
• Your role and permissions within your organisation, and the date your membership started.
• Whether you are expected to account for your working days, and your recorded absences.

Work and time information

• Time entries: the task, the duration, the date, and any note you write on them.
• Timer activity: when a timer started, stopped, or was switched.
• Timesheet submissions, approvals, rejections and locked periods.
• Clients, projects, tasks, budgets, retainers and their assignments.
• Commercial figures your organisation configures, such as billable rates, internal cost rates, budgets and margins.

Billing information

Subscription payments are processed by Stripe. Card numbers go directly to Stripe and never reach our servers. We store your organisation's Stripe customer and subscription identifiers, the plan and seat count, the subscription status, and the billing details needed for a valid tax invoice, including your ABN where you provide one.

Connected services

If your organisation connects Asana, we store the access tokens for that connection and the workspace, project and task names needed to match Asana work to Tidly tasks and to write tracked hours back.

Technical information

• IP address, browser and device type, and operating system version.
• Timestamps and diagnostic logs of requests to the Service, including errors.
• For the desktop app, the app version and the platform it is running on, so updates are offered correctly.

• To run the Service: recording time, calculating budgets and utilisation, producing reports, and routing approvals.
• To authenticate you and keep accounts and organisations separated from one another.
• To send the messages the Service is built to send: invitations, password resets, budget and retainer alerts, and timesheet reminders. These go out through Mailgun.
• To bill your organisation and collect payment through Stripe.
• To provide support when you ask for it.
• To keep the Service secure, investigate abuse, and diagnose faults.
• To meet our legal, tax and accounting obligations.

Where the law requires a lawful basis, we rely on performing our contract with your organisation, our legitimate interest in operating and securing the Service, and compliance with legal obligations.

• We do not sell your personal information, and we never have.
• We do not share it with advertisers or use it for advertising.
• We do not use your organisation's data to train machine learning models.
• We do not let one customer organisation see another's data. Every query in Tidly is scoped to a single organisation.

Industry benchmarks

We may in future offer benchmarks: anonymised, aggregated figures such as typical utilisation or realised rates across firms of a similar size, so you can see how your organisation compares. We have not built this yet.

If we do, it will work on reciprocity: your organisation opts in, and that single act is both what contributes your figures and what unlocks access to everyone else's. While you are opted out, nothing of yours is contributed and nothing is shown to you. Benchmarks will be aggregated and de-identified, never naming an organisation, a person or a client, and we will only publish a figure where enough organisations sit behind it that none can be picked out. We will tell you before any of this goes live.

Both of these run on your own machine, so it matters that we are precise about what they can and cannot see.

The desktop app

To notice when you have stepped away from a running timer, the desktop app asks your operating system a single question: how many seconds have passed since your last keyboard or mouse input. It also reacts to your machine sleeping, waking and unlocking.

That is the whole of it. The desktop app does not log keystrokes, does not take screenshots, does not record which applications or windows you use, and does not watch your browsing. It cannot tell your employer what you were doing while you were idle, only that you were idle, and only so you can decide what that time really was.

The browser extension

The extension runs on two sites and no others. On usetidly.app it reads your existing signed-in session so you do not have to log in twice. On app.asana.com it reads the identity of the task you are looking at, so it can put a timer button on it. It does not read other websites, your browsing history, or your bookmarks.

Tidly is a workplace record, and people in your organisation can see what you record. Being straightforward about this is fairer than burying it.

• Managers and administrators in your organisation can see your time entries, including your notes, and your utilisation against expectation.
• Administrators can see and change organisation settings, memberships and roles.
• Financial figures (rates, costs, revenue and margin) are restricted to people your organisation has explicitly granted financial visibility to. Not every manager has it.
• Our staff access your organisation's data only to provide support you have asked for, to investigate a fault, or where the law requires it.

We use a small number of providers to run the Service. They may process personal information on our behalf, under contract, and only for the purpose we engaged them for.

• Microsoft Azure: hosting, application infrastructure and database storage.
• Stripe: subscription payments, invoicing and tax calculation.
• Mailgun: transactional email delivery.
• A product analytics provider: usage telemetry and feature flags.
• Asana: only where your organisation chooses to connect it.

We change providers from time to time. If you need the current list for a vendor assessment, ask us and we will send it.

We may also disclose information where the law compels us to, to enforce our terms, or to protect the rights and safety of our users. If our business is sold or merged, information may transfer with it; we will tell you before that happens and before any new policy applies to you.

Tidly is hosted on Microsoft Azure in the Australia East region. Some of our providers, including Stripe and Mailgun, operate internationally, so limited information may be processed overseas. Where we transfer personal information outside Australia, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, and where European or UK law applies we rely on approved transfer mechanisms.

• All traffic to the Service is encrypted in transit with TLS.
• Passwords are stored only as salted cryptographic hashes.
• Access is scoped by organisation and by role, and enforced on the server rather than in the interface, so a permission cannot be bypassed from the browser.
• Access to production systems by our staff is restricted to those who need it, and is logged.

No system is perfectly secure, and we will not pretend otherwise. If a data breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

We keep your organisation's data for as long as their subscription is active. Time records are historical business records: your organisation may need them years later for invoicing disputes, audits or statutory record-keeping, so we do not delete them on our own initiative.

After a subscription ends, we hold the organisation's data for a maximum of 90 days so it can be exported or the account reinstated, and then delete it in full. Billing and tax records are kept for as long as Australian law requires, which is generally five years. Backups roll off on their own schedule, so deleted data may persist in backups for a short period after removal from the live system.

Essential cookies

Tidly sets cookies that are strictly necessary to run the Service: they keep you signed in and protect against cross-site request forgery. These cannot be switched off without breaking the application.

Product analytics

We record how the application is used: which screens and features get opened, how long operations take, and where errors occur. That lets us improve it and control the rollout of new features. This is telemetry about the software, not about your work: it does not include the contents of your time entries, your notes, or your client, project and rate data.

We use a third-party product analytics provider for this, and we may change providers as our tooling changes. Whoever it is at the time is bound by the same limits, and we will tell you who we currently use if you ask.

What the application does not carry

The signed-in application contains no advertising cookies, no marketing pixels, no cross-site tracking scripts, and no Google Analytics. Our public marketing website does use Google Analytics to understand how people find us; that is separate from the application, and covers visitors to the site rather than people using the product.

Under the Australian Privacy Principles, and where they apply to you the GDPR and UK GDPR, you can ask to access the personal information we hold about you, have it corrected, have it deleted, receive a portable copy, or object to or restrict certain processing.

One practical point: if your employer or client runs the Tidly organisation you belong to, most of this data is theirs, not ours to give away or erase. Send your request to an administrator there. If you send it to us, we will pass it on and support them in answering it.

For your own account information, contact us using the details below. We do not charge for reasonable requests, and we aim to respond within 30 days.

We will update this policy as the Service changes. The date at the top always reflects the current version. If a change materially affects how we handle your information, we will give notice in the app or by email before it takes effect, rather than changing it quietly.

Tidly is operated by Koben Digital Pty Ltd (ABN 21 616 465 340), 10/42 Bundall Road, Bundall QLD 4217, Australia.

Privacy enquiries: privacy@usetidly.com

If you are not satisfied with how we have handled a privacy matter, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. If you are in the EU or UK, you may complain to your local supervisory authority.

See also our Terms of Use.