Privacy Policy

This policy covers the HourMill website, web app and AI assistant connections, and any mobile apps we offer in the future. HourMill is currently a web app. Contact Make Industry LLC through the contact form linked below.

Account information includes your name, email address and sign-in provider identifier, along with profile settings. We also store organizations, team membership, roles, settings and invitations.

Work information includes clients, projects, time-entry descriptions, start and end times, project assignments, billable flags, hourly rates and rate snapshots. We calculate billable amounts from recorded time and rates.

Connection information includes connection names, callback addresses, permissions, approval and usage history, and which person or connected assistant created an entry. Entries can include issue IDs and URLs from tools such as Linear, Jira or GitHub. Storing a reference does not mean we sync with that tool or fetch its issue contents.

We receive aggregate usage and performance measurements, basic browser and request information needed to operate and secure the service, and information you provide when contacting us.

When an admin enters client or project rates, we store those rates. Human time entries can hold the applicable rate, and HourMill calculates billable amounts from rates and recorded time. Only organization admins can see rates and amounts in HourMill. Connected assistants do not receive them, even when their owner is an admin.

You can connect compatible assistants, such as Claude or ChatGPT, through OAuth. A connected assistant can record its own agent time. If you opt in to Track my time, it can also start and stop your human timer, create completed human time entries and read your recent human entries. It cannot edit or delete existing entries or access another person's time.

Entries created through a connection record its source. Connection names and verification labels on past entries remain historical records. You can revoke access in Settings. To remove human-time permission, revoke the connection or re-approve it without Track my time. Revocation stops future access but does not erase entries or recall information an assistant already received.

HourMill receives information that you or your assistant sends to it. Connecting an assistant does not give HourMill access to your conversations with that assistant. Do not include private conversation content in a description or other field unless you intend to share it. The assistant provider's own terms and privacy policy apply to its service.

When an admin invites someone, we store the invited email address, organization, role, inviter and invitation status. We use Resend to deliver invitation emails when delivery is available. The email identifies the inviter and organization and includes a sign-up link. Invitations expire after seven days and can be resent.

We use information to provide, secure and support HourMill, manage accounts and teams, and send service emails. Where EU or UK law applies, our basis is performance of our contract with you, or steps you ask us to take before entering that contract.

We use aggregate usage and performance information to understand and improve the product, relying on our legitimate interests in operating a useful, reliable service. Where required, we rely on consent instead. We also use information where needed to meet legal obligations.

Allowing an assistant to track your human time is a separate choice based on your consent. You can withdraw that permission by revoking access or re-approving without Track my time. Withdrawal does not undo earlier lawful processing. Connecting an assistant is not blanket consent for unrelated uses.

We do not use your information for advertising.

We do not sell personal information or share it for advertising. We do not use your data to train AI models. These statements describe HourMill's practices, not the separate practices of an assistant you choose to use.

HourMill does not passively monitor work. We do not record screens, keystrokes or GPS location. Time comes from entries a person makes or a connected assistant explicitly reports.

Clerk provides sign-in and account verification and receives the account and sign-in information needed for those services.

Replit hosts HourMill and provides its managed PostgreSQL database, which stores account, organization, work and connection records.

Resend is our invitation email delivery provider. Invitation messages include the recipient's email address, inviter, organization, role and sign-up link.

Cloudflare Web Analytics provides aggregate traffic and performance measurements. Google serves the website's fonts and receives browser and network information when fonts load. If you choose Google sign-in, Google also handles that sign-in.

Our linked Make Industry contact form is on a separate website and uses Google reCAPTCHA, as disclosed there. Information you submit is used to respond to your request. Review that site's notices and Google's policies when using the form.

Assistants you authorize receive information within their permissions. We may also disclose information when legally required, to protect rights or safety, or in connection with a business transfer subject to applicable privacy obligations.

Cloudflare Privacy Policy

About Cloudflare Web Analytics

Google Privacy Policy

HourMill and Clerk use essential cookies for sign-in, security and approving connections. We use local storage for your theme and session storage for invitation context and recovery from page-loading errors. Blocking cookies or clearing storage can interrupt these functions.

Cloudflare Web Analytics does not use analytics cookies or fingerprinting to identify visitors across websites. It reports aggregate visits and technical performance information, including page and referring URLs without query strings or fragments, browser and device information, loading and interaction measurements, element selectors and resource paths. These measurements are more than simple visit counts.

Our analytics integration does not intentionally send account names, email addresses, time-entry descriptions or timer-derived page titles. We do not include advertising or session replay.

For team workspaces, the organization controls its members' work records, and HourMill processes that information on the organization's behalf. Admins manage membership, rates and organization data. Members see their own time; admins can see time across their organization. Removing a member can also delete that member's HourMill records.

If you belong to a team, some requests may need to go through its admin. We may need to coordinate with the organization before providing or deleting shared records, while respecting your rights under applicable law.

We keep account and work information while the account is active and as needed to provide the service, maintain organization records, meet legal obligations, resolve disputes and address security issues. Stopping use or revoking a connection does not automatically delete historical records.

To request account closure, deletion or a copy of your information, use the contact form below. We verify the request and handle it as required by applicable law. Account closure is not currently available as an in-app feature. Organization records, other people's rights and legal obligations may limit deletion; we will explain applicable limits.

Deleted information may remain in backups or provider-held records until those copies expire under the providers' retention schedules. Deletion timing depends on the records and applicable legal obligations.

You can delete your own human time entries in the app and export selected completed human time as CSV. That CSV is not a complete copy of all personal information or agent records.

We use encryption in transit, access controls and reasonable safeguards designed to protect information. No system is perfectly secure. Keep your sign-in methods secure and contact us if you suspect unauthorized access.

Depending on applicable law, you may request access, correction, deletion or export of your personal information, object to or restrict certain uses, and withdraw consent. Use the contact form below to exercise these rights. We may need to verify your identity and authority.

EU and UK residents may complain to their local data protection authority. California residents will not be discriminated against for exercising their privacy rights. Withdrawing consent does not affect earlier lawful processing.

Make Industry LLC is based in the United States. Information may be processed in the United States and other countries where our providers operate. Privacy laws may differ from those where you live. Contact us with questions about the arrangements that apply to your information.

HourMill is for people 18 and older and is not directed at children. If you believe a child has provided personal information to HourMill, contact us so we can address it.

We update the date at the top when this policy changes. We will give notice of material changes by email or in the app. Contact Make Industry LLC through the form below with questions about this policy.