Protecting your data and privacy

Memory can’t track time spent in “private” or “incognito” browser windows, unless you use Firefox (which, unfortunately, is built in a way that makes it impossible to block tracking). Memory doesn’t track the actual content of web pages or what you actually read, see, or write—it’s only built to record how long you actively spend on a specific website or application.

Timely is not an employee monitoring software. We will never support employee screenshots, keystroke monitoring or any other invasive surveillance tactics. See our Privacy Promise for a slice of our thinking.

No. Your memories are completely private to you—only you can see your private activity timeline. Your colleagues and managers can only see the time entries you publicly log to your timesheet. Even if you link memories to a public time entry, they will remain private.

Your memory data exists to help you minimize timesheet admin, create accurate invoices, and report transparently on all of your time. Our machine learning team only use encrypted, anonymized data sets to develop and improve our software. We don’t sell your data, or use it for marketing or advertising purposes. A carefully selected group of sub-processors that we partner with can require access to certain personal data. We only grant this when it is absolutely necessary to the provision of our service and only ever enter into fully GDPR-compliant data processing agreements.

Timely’s native integrations let you pull information from other work apps, like email inboxes and calendars, into your private timeline. To do this, Timely requests limited access to third-party apps. Timely’s Gmail integration, for example, will record the subject line and a snippet (the first line from the email you worked on) to your private timeline to provide a detailed log of your daily communication. Timely can only access the basic information that Gmail allows, and never sends any of your private memory data to connected third-party apps.

Your data is securely transferred and stored on IOS 27001-certified Amazon Web Services (AWS) servers in Europe. All communication between the server and your browser, mobile or desktop, and across our internal system, is encrypted using SSL/TLS encryption (HTTPS), with an SSL certificate issued by Comodo. Our database is also completely encrypted.
‍
Amazon is one of the world's largest providers of hosting software; they spend massive resources on security and conduct ongoing risk and security assessments. In the web world, they're the safety standard. AWS is Privacy Shield-certified, so the transfer of data to it is in compliance with EU law. For the long read, check out their security policies here.

Only our Chief Data Protection Officer, Deputy Data Protection Officer (DPO) and Head of Growth can access the databases used to store information from Memory products. Connecting to the database is only possible from AWS EC2 instances created and monitored by our DPO. All data is protected by an internal auditing system (SQL audit logging) and DPO approval is required for database access (which is only granted as read-only). SQL audit logging captures the name of the individual accessing data, the purpose of access, the data accessed, the date and time of access and DPO approval. Individual developers can only access a subset of the tables for the data required to perform their tasks. Specific employees are only granted access to your account whenever we receive your permission to do so for troubleshooting, or any other needs that you request or require.

Timely doesn’t process, store or transmit personal information (like your name, email, unique ID number or IP address). Card transactions are processed using Stripe’s bank-level security encryption, and passwords via a one-way hashing algorithm (Bcrypt). Memory uses Amazon S3 to store files like profile pictures, invoices and generated reports, and file paths are randomly generated SHA1 keys.

Yes. Memory backs up data every day, and each backup is kept for a period of one week before being destroyed.

Absolutely. You can delete memories either individually from your private timeline or in bulk from your Settings page, where you can also download all of your stored data at any point.

We are constantly working to fortify and update our systems based on the best security practices available. We use the latest and most up-to-date software packages and libraries to prevent any security vulnerabilities and possible attacks. All user inputs and data collection is filtered through multiple possible security attacks rules before it is received on the server for processing. We follow industry standard coding practices and review processes while developing our applications. We also follow a periodic password rotation policy for all our internal and external tokens and keys.
‍
All of our privacy program policies and procedures—including staff security training, escalation and reporting processes, and security incident response plans—are maintained and regularly reviewed by our Data Protection Officer (dpo@timelyapp.com). In the event of a system incident or breach, we have a dedicated Emergency Response Team ready, which consists of members of our QA, Support, Backend, and Operations teams.