Privacy Policy

This policy explains what Twine Track (a TwineApps product) collects, why, and the choices you have. Twine Track is used by businesses to turn their team's work time into invoices; the business that invites you controls its workspace and decides how the data is used.

What we collect

• Account details — name, email address and sign-in provider (Google, Microsoft, Xero, Intuit, Twine Biller or email and password, which we store hashed).
• Activity metadata — from the desktop agent and browser extension: application names, window and tab titles, website addresses, folder paths and active time. No screenshots, keystrokes or file contents. In Gmail and Outlook on the web, the browser extension also reports the names and email addresses of the people on the open message (your own address is left out), and the tab title usually includes the subject. Message bodies are never read.
• Mail metadata — if you connect Gmail or Microsoft 365, message headers such as sender, recipients, subject and date are used to match work to customers. Gmail access uses the metadata-only scope, which cannot read message bodies.
• Accounting data — when an admin connects Xero, QuickBooks Online or Twine Biller: company name, customers and contacts, and sales invoices.
• Billing details — subscription status and seat count. Card details are collected and held by Stripe, never by us.

How we use it

• To record time, match it to customers and projects, and draft invoices.
• To let you review and correct your own time before it's shared or billed.
• To send invites, get-started emails and service notices.
• To run the subscription, prevent abuse and fix problems.

We don't sell personal information or use it for advertising.

Who can see it

• You can always see your own activity, and pause recording from the agent.
• Workspace admins see time that has been sorted and approved for billing, and the customer and invoice data of their workspace.
• Our staff access workspace data only to provide support or keep the service secure.

Service providers

We share data only with providers that help us run Twine Track:

• Neon (database hosting) and our application hosting provider.
• Stripe (subscription payments).
• Replicate (AI inference) — activity descriptions are sent to draft categories, matches and invoice notes. They aren't used to train models.
• Xero, Intuit, Twine Biller, Google and Microsoft — only when you connect them, and only to do what you asked.
• Our email delivery provider, for invites and notices.

Some of these providers process data outside Australia, including in the United States.

Security

Data is encrypted in transit. Accounting and mail access tokens are encrypted at rest, device tokens are stored hashed, and access inside a workspace is limited by role.

Retention

Raw activity events are pruned on a rolling schedule once they've been summarised into sessions. Workspace data is kept while the workspace is active and deleted within 30 days of a closure request, apart from records we must keep by law.

Your choices

• Ask for a copy of your data, or for it to be corrected or deleted.
• Disconnect Gmail, Microsoft 365 or accounting systems at any time.
• Uninstall the agent or extension to stop recording.

If you're an employee, your employer is usually the first point of contact for requests about workspace data; we'll help them respond.

Contact

Privacy questions or requests: support@twineapps.com. See also our Terms of Service.