Privacy policy

Last updated October 27, 2026

Hours Truly runs Hours Truly. This page says what personal information we hold, why, who else handles it, and your rights under Canada's privacy law (PIPEDA).

What we hold, and why

• Your account: your email address and a scrambled form of your password (we can't read it), and if you turn it on, your two-step sign-in key. To let you sign in and keep your account safe.
• Sign-in records: when and from which browser and internet address you signed in. To alert you to new sign-ins and protect against misuse.
• What you put in: your business details, your clients' names and contact details, time, invoices, expenses and receipts. We hold it only to provide the service to you; for your clients' information, we act on your behalf.
• Billing: Stripe handles payments. We keep only your Stripe customer number and whether your subscription is active, never your card number.

We don't sell personal information, show ads, or use tracking or analytics cookies. The only cookies are the one that keeps you signed in and one that remembers light or dark mode.

Who else handles it

• Railway hosts the service and its data on its servers.
• Stripe processes subscription payments. If you turn on card payments, your clients pay you on Stripe's page, into your own Stripe account; we only ask Stripe whether each payment went through.
• Postmark sends the emails the service sends for you (invoices, reminders, sign-in alerts).
• Anthropic reads the receipt photos you snap (with its Claude AI model) to fill in the expense for you to check. It gets only the photo, not your other records, and doesn't use it to train its models.
• An off-site storage provider keeps copies of the nightly backups, sent to it over an encrypted connection.

Because some of these providers are outside Canada, your information may be stored or processed in other countries and be subject to their laws. Each provider may use it only to provide its service to us.

How long we keep it

While your account is open. When you delete your account it is removed for good 30 days later, and from backups within a further 30 days. We keep records we're required to keep by law (such as of payments received) for as long as the law requires.

Keeping it safe

Every business has its own separate database. Connections are encrypted (HTTPS), passwords are stored scrambled, two-step sign-in is available, and new sign-ins are emailed to you.

Your rights

You can see and correct your information in the app, download all of it (Settings → Backups → Export everything), and delete your account (Settings). For anything else, or a question or complaint about privacy, contact us. If we can't resolve it, you can complain to the Office of the Privacy Commissioner of Canada.