Privacy Policy

Account information

When you create an account, we collect your name, email address, company name, and password (stored hashed using bcrypt). Optional fields include phone number, profile picture, and job title.

Usage data from the desktop agent

While the desktop agent is running, we collect:

• Active time — minutes of keyboard and mouse activity per session
• Idle periods — when no input is detected for 5+ minutes
• Screenshots — at random intervals during active work sessions (typically 5–25 minutes apart)
• Session timestamps — start time, end time, breaks

We do not log keystrokes, capture audio, scan files, monitor URLs, or track activity outside the work session.

Payment information

Billing is processed by Stripe. We do not store credit card numbers — only the last 4 digits and expiration for display purposes.

• To provide the core Service (time tracking, dashboards, reports)
• To send transactional emails (password resets, payment confirmations)
• To diagnose technical issues and improve performance
• To enforce our Terms of Service and detect abuse

We do not sell your data. We do not use your data to train AI models. We do not share your data with advertisers.

• Screenshots: Auto-deleted after 30 days (configurable on Enterprise)
• Activity logs: Kept for 1 year for reporting purposes
• Account data: Retained while your account is active; deleted within 30 days of account cancellation upon request

All data is encrypted in transit using TLS 1.3 and at rest using AES-256. We use industry-standard practices, conduct regular security reviews, and limit data access to authorized personnel only. Passwords are hashed with bcrypt using a cost factor of 12.

If you're in the EU, UK, or California, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion ("right to be forgotten")
• Export your data in a portable format
• Object to certain types of processing

To exercise these rights, email privacy@dutybay.com. We respond within 30 days.

We use cookies for authentication (session cookies) and basic analytics. We do not use third-party advertising cookies. You can disable cookies in your browser, but parts of the Service may not work without them.

We use the following service providers to operate DutyBay:

• Hostinger — web hosting and database (EU servers)
• Cloudflare R2 — screenshot storage (optional)
• Stripe — payment processing
• Resend — transactional email delivery

Your data may be transferred to and processed in countries outside your own. We use Standard Contractual Clauses to ensure your data remains protected wherever it goes.

DutyBay is not intended for users under 16. We do not knowingly collect data from children.

We may update this policy occasionally. We'll notify you of material changes via email or in-app notification at least 30 days before they take effect.

Questions about this policy? Reach out:

• Email: privacy@dutybay.com
• General: contact form