Who we are#
@Work is made by Tom Wheatley, a sole trader in the United Kingdom, trading as @Work (“we”, “us”). We are the controller of the personal data described here under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Questions, requests and complaints go to support@useatwork.com.
What stays on your computer#
The @Work app stores what you enter in a database file on your computer. It works fully without an account or a connection. Without an account, none of the following is ever sent to us:
- Your working time. Sessions, breaks, daily totals, notes, and how you split your hours across booking codes.
- Your booking codes. Project, task and other codes you add.
- Your leave. Bookings of annual leave, flexi, unpaid leave, bank holidays and sick leave, plus your allowance and working pattern.
- Where you worked. Whether a day was in the office or remote, if you set it.
- When your computer was in use. To fill in your first login and last log-off for recent days, @Work reads your computer’s own sign-in and sleep records: the system power and login logs on a Mac, and the Windows security log on a PC. It keeps only the earliest and latest time for each day.
- A change history. A record of edits on this computer, so changes can be traced. It never leaves your computer.
- Backups. A copy of the database once a day and before every upgrade, keeping the newest seven, in the app’s own folder. You can also save a backup wherever you choose.
- A log file. Technical messages and errors, kept in your computer’s logs folder and limited to a few megabytes. It stays on your computer unless you choose to send it to us when asking for help.
The database and backups are ordinary files protected by your computer’s own account and disk encryption. Anyone who can use your computer account can read them. Signing out of @Work or deleting your account leaves this data in place. To remove it, uninstall @Work and delete its folder.
What we receive, and why#
Update checks#
Shortly after @Work starts, it asks our server whether a newer version exists. The request includes your operating system, processor type and the version of @Work you have, and, like any internet request, your IP address. We use this only to answer with the right update. We don’t keep a record of these requests.
You can turn this off in Settings → Check for updates automatically. You can still check by hand. Our server fetches update files from GitHub on its own behalf, so GitHub never sees your request.
Lawful basis: legitimate interests. Keeping the app secure and working needs updates to reach you.
If you create an account#
An account is optional. It lets your Mac and PC stay in step. When you create one, we hold:
- Your email address, to identify your account.
- Your name, only if you add one. It's shown in the app and used to greet you in our emails.
- A password, if you set one. It is stored only as a one-way hash (Argon2), never as the password itself.
- Your Google or Microsoft account ID and email, if you sign in with one of them. We don’t receive or keep your name, photo, contacts or access to anything else in those accounts.
- Passkeys, if you use one. We store only the public key and an identifier; the private key never leaves your device.
- Sign-in sessions, so you stay signed in. The app keeps a renewal token in your computer’s keychain or credential manager. Access tokens last 15 minutes and renewal tokens up to 30 days.
- A label for each session, so you can see where you're signed in and sign out a computer you no longer use: the computer's name as its system reports it (for example "Pat's MacBook Pro"), its operating system, the app version, and when it was last active. A sign-in from the @Work web app is labelled with the browser and operating system the browser reports about itself (for example "Chrome on macOS"), or just "Web browser" if it doesn't say. We don't record IP addresses for this.
- Recent account activity: sign-ins (and which method was used), wrong passwords, and changes to your account such as a new password, email address, passkey or connected Google or Microsoft account, each with its time and the session it came from. You can see this list in the app. It helps you spot anything you don't recognise.
Lawful basis: contract. We need this to provide the account you asked for.
Sync#
Once you’re signed in, @Work syncs automatically in the background. It sends a copy of:
- your sessions, daily totals and allocations to booking codes
- your booking codes
- your leave bookings, including sick leave
- each day’s office or remote setting, and its first login and last log-off times
- the settings that decide your hours and balances: your working pattern, leave allowance and leave year, carry-over and adjustments, your quick actions and entry defaults, and whether you’ve finished first-run setup
Each synced change also carries a random identifier for the computer it came from, so changes don’t bounce back. Settings that only describe one computer (appearance, launch at login, the backups folder, update choices) and your change history are not synced.
Using @Work in a web browser#
At app.useatwork.com you can use @Work in a browser. It needs an account. It keeps its own copy of your data in that browser's storage (IndexedDB) on that device, works from that copy, and syncs it the same way as the app. Its sign-in is kept in the same storage, never in a cookie; it lasts 24 hours unused and 14 days at most, then you sign in again. Signing out keeps the copy in the browser; clear the site's data in your browser settings to remove it. Reminders about sessions left running use your browser's notifications, and only if you allow them.
We use synced data only to store it and return it to your other computers. We don’t read it, analyse it, or use it for anything else. Sick-leave entries can say something about your health, so we treat them with particular care. They are stored and synced only because you entered them, and are used for nothing else.
Lawful basis: contract. Syncing is the service you signed up for.
Bug reports and suggestions#
When you choose Report a bug or Suggest a feature, we receive what you write and, if you give one, the email address to reply to (when you're signed in, we use your account's address instead). Every report also carries the app's version and whether it's the desktop app (and which operating system) or a web browser.
A bug report also includes, unless you untick it:
- app details: the screen you were on, window size, light or dark appearance, language, time zone, whether you're online, sign-in and sync status, and, in a browser, the browser's name and version
- a recent activity log: the app's own messages from the last while, such as "sync failed" or an error, so we can see what went wrong
Before anything is sent, the app removes sign-in details and email addresses from the log, and you can read exactly what will be sent first ("See what's included"). Reports never include your entries, notes, codes or leave. We use reports only to fix problems and improve @Work, and we reply only if you'd like us to. The report is saved on our server and emailed to us (through Resend).
Emails we send#
We only email you about your account:
- a 6-digit code when you create an account, to check the address is yours
- a link to choose a new password, when you ask for one
- a notice when your password changes, so you'd know if it wasn't you
- when you change your email address: a code to the new address, and a notice to the old one
- a notice if someone tries to create an account with an address that already has one
Codes expire after 15 minutes and links after 30 minutes. We store only a scrambled (hashed) form of each, and delete them within a day of expiring. We use Resend to deliver these emails; it handles your email address and the message.
Lawful basis: contract, for the account you asked for, and legitimate interests, for security notices.
Security and abuse protection#
To slow down password guessing and abuse, our server counts requests from each IP address for a few minutes. Normal requests aren’t recorded. If an address goes over the limits or keeps failing to sign in to the server itself, its IP address and the time are written to the server’s security log and it’s blocked for a while, from an hour up to a week for repeat offenders. Those log entries are deleted after 14 days. If something goes wrong, the server also writes an error log, which can include technical details of the request; we use it only to fix the problem.
When you choose a password, we check it hasn’t appeared in a known data breach using Have I Been Pwned. Only the first five characters of a scrambled (hashed) form of the password are sent, which can’t be turned back into your password or linked to you; your password itself never leaves our server.
Lawful basis: legitimate interests, in keeping accounts and the service safe.
Cookies#
This website sets no cookies and uses no tracking or analytics. The web app keeps your data and sign-in in your browser's storage (see "Using @Work in a web browser"); that is not a cookie and is never sent to us except as the synced data and sign-in described above.
When you sign in, our sign-in service at api.useatwork.com sets a few cookies that make sign-in work: _session, _interaction and _interaction_resume, each with a signature cookie. They are strictly necessary, so they don’t need your consent. They expire when sign-in finishes or your sign-in session ends, at most 14 days.
What we don’t do#
- No analytics, tracking pixels, advertising or profiling.
- No selling or sharing of your data for anyone else’s purposes.
- No marketing email or newsletters. We only email you when you need it (see below).
- No automated decisions about you.
Who else is involved#
We use a few providers to run @Work. They process data only on our instructions, or, for Google and Microsoft, under their own terms when you choose to sign in with them.
- DigitalOcean
- What they do: Runs our server and the database that holds accounts and synced data, and keeps weekly backups of the server
- Where: London, UK
- Vercel and Netlify
- What they do: Serve this website and the sign-in pages. They handle your IP address to deliver pages.
- Where: Global network
- Better Stack
- What they do: Checks from outside that our website and server are up. It receives no data about you.
- Resend
- What they do: Delivers our account emails (codes, password links and security notices), and passes bug reports and suggestions to us
- Where: United States and EU
- Google, Microsoft
- What they do: Confirm who you are, only if you choose to sign in with them
- Where: Under their own privacy policies
- GitHub
- What they do: Stores the app’s update files. It receives nothing about you.
- Namecheap
- What they do: Runs our domain names
Some of these companies are based in the United States and may handle data there. Where they do, they rely on safeguards recognised under UK law, such as the UK Extension to the EU–US Data Privacy Framework or standard contractual clauses.
How long we keep things#
- Account and synced data: until you delete your account. When you delete an entry in the app, the server keeps a small marker that it was deleted, so your other computers remove it too. The entry’s content goes with it when you delete your account.
- Deleting your account removes your account, sign-in methods, passkeys, sessions and all synced data from our live database straight away.
- Server backups: we back up the database every night so we can recover from a fault, and keep those copies on the server for 14 days. Once a week our hosting provider (DigitalOcean, London) also takes a copy of the whole server, kept for 28 days. So a deleted account is gone from the live database straight away and from every backup within six weeks. We never restore a backup to bring back an account you deleted.
- Sign-in sessions: up to 14 days; renewal tokens up to 30 days. A session's label goes when the session is signed out or expires.
- Recent account activity: 90 days.
- Bug reports and suggestions, with their app details and logs: 12 months, then deleted. If you delete your account, reports you sent stay for the rest of that time but are no longer linked to you. Ask us and we'll delete them sooner.
- Update checks and request counts: not kept.
- Security log entries for blocked IP addresses: 14 days.
- Email codes and password links: until they expire (15 and 30 minutes), then deleted within a day.
- Error logs: only as long as needed to fix the problem.
- Data on your computer: until you delete it. It’s yours, and we can’t reach it.
Security#
- Every connection to our server is encrypted (HTTPS).
- Passwords are hashed with Argon2.
- Passkeys and sign-in tokens use modern public-key cryptography.
- The database isn’t reachable from the internet; only our server can talk to it.
- Access to the server is limited to us.
No system is perfectly secure. If a breach affected your data, we would tell you and the Information Commissioner’s Office where the law requires it.
Your rights#
Under UK data protection law you can:
- see the data we hold about you, using Settings → Your account data → Download in the app, or by asking us
- correct it, by editing in the app or asking us
- delete it, using Delete account on your account page (Settings → Ways to sign in → Manage…), or by asking us
- take it with you, since the download is a standard JSON file
- object to or ask us to restrict how we use it
Email support@useatwork.com from your account’s address and we’ll reply within one month.
If you’re unhappy with how we’ve handled your data, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Children#
@Work is a tool for working adults. You need to be 16 or older to create an account. If you think a child under 16 has created an account, tell us and we’ll delete it.
Changes to this policy#
If we change what we collect or how we use it, we’ll update this page and the date at the top. If a change matters, we’ll say so here before it takes effect, and tell signed-in users in the app where we can.