Hoursbox

Privacy Policy

Last updated: 25 August 2026

Hoursbox is built to respect your attention — and your data. This page explains, in plain language, what we collect and what we don't. If anything here is unclear, email hello@hoursbox.com.

What we do not do

• We do not monitor your keystrokes, take screenshots, or watch which apps or websites you use.
• We do not sell your personal data.
• We do not run third-party advertising trackers on this site or in the app.

What we collect

• Account information — the email address (and name, if provided) you use to sign in, so we can keep your data with your account.
• Content you create — your Big 3 priorities, the focus sessions you choose to start, reflections, and the resulting Focus Score. This data is yours.
• Anonymous usage analytics — this site and app use Google Analytics for Firebase to understand aggregate usage (e.g. page views and which buttons are tapped). This helps us improve the product. It does not identify you personally to us.

Cookies & analytics

We use Google Analytics for Firebase, which may set cookies or use local storage to measure usage anonymously. You can block these with your browser settings or an extension without losing any core functionality of the landing page.

Google sign-in & Google Calendar

If you sign in with Google, we receive your basic Google profile — your name, email address, and profile picture — to create and identify your account.

Hoursbox also offers an optional Google Calendar integration. Only if you turn it on and grant permission, Hoursbox uses Google Calendar access to create, update, and delete the calendar events that match the time blocks you choose to sync, and to send invitations to any guests you add. We act only on the events you ask us to sync — we do not read, store, or analyze the rest of your calendar. You can disconnect Google Calendar at any time from Settings, which immediately revokes our access.

Limited Use disclosure. Hoursbox's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Calendar data for advertising, and we never sell it or share it with third parties except as strictly needed to provide the integration you requested.

Where your data lives

Sign-in is handled by Google Firebase Authentication. Your account and the content you create (priorities, focus sessions, reflections) are stored in a secure database on infrastructure we operate. We keep your data only as long as your account is active or as needed to provide the service — the specific periods are set out in How long we keep your data below.

Your choices

• You can export your tracked hours to CSV from the Timesheet page in the web app, for any date range. That is the only export we offer today — it covers hours by activity and date, not your reflections, notebooks or priorities. Email us if you need those and we will send you what we hold.
• You can delete your account, and everything in it, yourself — from the web app or the Android app, without asking us. See Account & data deletion below.
• You can disconnect Google Calendar at any time from Settings, which immediately revokes our access.

Account & data deletion

Deleting your account is something you do yourself, in the app: Settings → Account → Delete account on the web, or Settings → Danger zone → Delete account on Android. It takes effect immediately and it cannot be undone — there is no grace period and no archive we can restore from. Export your data first if you want to keep it.

Deletion erases your account and everything tied to it: your priorities, categories, time blocks, timer sessions, manual time entries, goals, checklists, reflections, notebooks and notes, drink, sit and prayer logs, your Focus Score history, and your stored Google Calendar tokens — with the Google grant itself revoked at Google first, so a permission we forgot locally cannot keep working. Your Google sign-in identity is deleted too. Any remaining Pro time is forfeited.

If you cannot reach the app, email hello@hoursbox.com from the address on the account and we will do it for you within 30 days.

Full step-by-step instructions, and the complete list of what is erased: hoursbox.com/delete-account.

How long we keep your data

• Your account and content — for as long as your account exists. When you delete it, this is erased immediately, not marked inactive.
• A record that the deletion happened — your email address, the date, how you confirmed your identity and the IP the request came from, and nothing else. Kept up to 12 months so we can show the request was honoured, then deleted.
• Security-log entries — up to 12 months. When you delete your account, your name, email address and account id are stripped from every one of these entries.
• Database snapshots — one snapshot, taken automatically before each deployment for disaster recovery. Only one exists at a time: each deployment replaces the previous one, and none is kept beyond 30 days. A snapshot is never used to bring back a deleted account.
• Analytics — Google Analytics keeps event-level data for at most 14 months (Google's maximum); aggregate reports do not expire. None of it is joined to your account.
• Password-reset links — expire within an hour of being issued, and are deleted with your account.

Changes

If this policy changes, we'll update the date above. Material changes will be communicated in the app or by email.

← Back to Hoursbox