Track Your Time add-on: privacy policy

The full policy for the whole service is at https://trackyourtime.dev/privacy/. This part covers the Firefox add-on.

What the add-on stores on your computer
- Your session token, your settings, the server address and any changes made offline until they are sent, in the add-on's own storage.
- With activity capture on (off by default): the site name of the active tab, in IndexedDB on your computer. The page title only if you also switch on page titles. Activity is deleted after 14 days, or after the period you set. Private windows and sites you exclude are never recorded.

What the add-on sends, and where
- Your account sign-in details and your time entries, projects, clients, tasks and tags, to the Track Your Time server: api.trackyourtime.dev by default, or the server you choose in the popup. That data is what the service exists to store.
- Captured activity is never sent. Only an entry you accept reaches the server, and that entry carries no site data.
- This version sends no error reports, analytics or advertising data, and no data goes to any third party.

Permissions
- storage: keeps the session, settings and unsent changes.
- alarms: updates the running time on the toolbar badge and runs activity capture's once-a-minute check.
- idle: notices when you leave the computer with a timer running, so the add-on can ask what to do with that time. Idle state is not sent anywhere.
- cookies and access to api.trackyourtime.dev: reads the Track Your Time session cookie to offer the account you are signed in with at trackyourtime.dev. Nothing is signed in until you confirm in the popup; the add-on then gets a separate session of its own. It reads no other cookies.
- tabs (optional): activity capture only. Firefox asks for it when you turn capture on. It reads the address and title of the active tab, never page content.
- A content script runs on trackyourtime.dev only, so the web app can offer its signed-in account to the add-on. It runs on no other site.

Your control
Sign the add-on out in its popup, or revoke its session in the web app under Settings > Devices. Removing the add-on deletes everything it stored locally. Contact: privacy@trackyourtime.dev.