Chrome Extension Privacy Policy

This policy explains how the Invoice My Clients: Time Tracker extension for Google Chrome, published by Invoice My Clients, LLC ("we", "us"), handles your information. The extension’s single purpose is to track billable time for your Invoice My Clients account and turn that tracked time into invoices for your clients. It needs an Invoice My Clients account, so our main Privacy Policy also applies to everything in your account; this page covers what is specific to the extension.

Where the extension sends data

The extension talks only to Invoice My Clients’ own servers on Amazon Web Services, in the US East (Ohio) region (us-east-2): our GraphQL API (AWS AppSync), the same one our web app uses, and our sign-in service (Amazon Cognito). It sends nothing to any other server, and every connection uses encrypted HTTPS.

It keeps your timer in step with your other devices by checking our API once a minute while a timer is running and every 15 minutes otherwise, and also when you open it or switch to a browser window. What it sends and reads:

• Sign-in: your session tokens, with every request, to prove it is you. Cognito also uses them to refresh your session, confirm this browser as a device on your account when you connect, and revoke the session when you disconnect.
• What it reads from your account: your account settings (such as currency, hourly rate and plan), your clients and projects, your time entries from the last 120 days, and your account email, which it shows in its settings.
• Time you track: timer starts and stops and the time entries you log (description, date, duration, client, project, rate and whether it is billable). Entries made in the extension are tagged “chrome-extension”.
• Clients and projects you add from the extension: the client’s name and email address, and the project’s name, rate and budget hours.
• Invoices you create and send: the entries you pick, how the lines are grouped and the client’s email address. When you send an invoice it also sends your browser’s time zone and language, so the email and its dates are right. Afterwards it checks that invoice’s viewed and paid status.
• A header naming the extension and its version on each request, so our servers can tell its requests apart from the web app’s.

Signing in

The extension has no password form and never sees your password. When you connect, it opens our connect page on app.invoicemyclients.com, where you sign in the way you usually do and approve the connection. The page then starts a separate session just for the extension and hands it only that session’s tokens; your web session’s tokens never leave the page. The extension accepts the handoff only from app.invoicemyclients.com and only for the connection it started. The connect link carries utm_source=chrome-extension and utm_medium=browser_extension, which tell us, and only us, that a new sign-up came from the extension.

What it stores on your computer, and for how long

The extension keeps its data in Chrome’s storage for extensions on this computer. Web pages cannot read it, and only the extension’s background service worker holds your session.

• Until you close the browser, or the extension is updated or turned off (memory only): the short-lived access and ID tokens, which expire after one hour; a cached copy of your timer, recent time entries, clients, projects and settings; a description drafted from text you selected; and the state of an idle-time prompt.
• Until you disconnect or remove the extension: the refresh token, your account’s sign-in username and the confirmed device key, which keep you connected. A refresh token is valid for at most 365 days and is replaced with a new one each time it is used.
• Invoices you sent from the extension: the 50 most recent (invoice number, client name, payment link, when it was sent, and whether it has been viewed or paid), so it can tell you when your client views or pays. It checks each one every 5 minutes until it is paid or 45 days old. Cleared when you disconnect or when a different account connects.
• Budget alert levels per project, so each 80% and 100% alert is shown once. Cleared when you disconnect or when a different account connects.
• Offline queue: timer starts, stops and time entries you made while offline, up to 500, each marked with the account it belongs to. They are sent in order when you are back online and removed once sent, or if our server refuses one, in which case the extension tells you. Queued time is only ever sent for the account that made it.
• Your reminder and alert settings, and an identifier for the last account that connected, so that a different account starts without the previous account’s data.

Page title and selected text, only when you ask

• “Start timer for this page”: when you right-click a page (or a link on it) and choose this, Chrome’s activeTab permission gives the extension that one tab. The extension reads only the tab’s title, uses up to 200 characters of it as the timer description, which is saved to your account like any timer, and shows it in the “Timer started” notification. It does not read the page’s address (URL) or anything on the page, and it reads nothing until you choose the menu item.
• “Log time”: when you select text, right-click and choose this, Chrome passes the selected text (up to 200 characters) to the extension, which uses it to pre-fill the description in the log-time form. It is saved to your account only if you then log the entry.
• The extension has no access to the websites you visit: it has no permission for any website other than our API and sign-in service, and it puts no scripts into pages, so it cannot read or change them. It does not collect your browsing history.

Idle detection

Chrome’s idle permission tells the extension only whether your computer is active, idle or locked. While a timer is running, the extension notes when you went idle (after a threshold you choose, 5 to 60 minutes, 10 by default) and, when you come back, asks whether to keep or discard that time. Only your choice reaches your account, as the timer’s stop time. The extension records no keystrokes, mouse movement, clicks or scrolling, and nothing about which apps or sites you use.

Notifications

The extension shows Chrome notifications on this computer. It builds them itself from your account data; no push messaging service is involved. It can show:

• Timer started or stopped, when you use the keyboard shortcut or the right-click menu.
• Idle time detected, with buttons to keep or discard it.
• A project reaching 80% or 100% of its budget (can be turned off in the extension’s settings).
• Your client viewing or paying an invoice you sent from the extension (can be turned off).
• Reminders: a timer still running at the end of the day (6 pm by default), a weekly summary of unbilled time (Fridays at 3 pm by default) and nothing logged on a weekday (off by default). Each can be changed or turned off.
• Problems, for example offline time that could not be saved or a timer that could not start.

What the extension does not do

• No analytics, tracking, advertising or crash-reporting code, and no ads.
• We do not sell the data, and we do not use or transfer it for advertising, to determine creditworthiness or for lending.
• No remote code: all of its code ships in the package published on the Chrome Web Store. It loads no scripts from the internet and runs no downloaded code; it only exchanges data with our API and sign-in service.
• It does not read your browsing history, page addresses (URLs), page content, location, keystrokes or passwords.

Chrome Web Store Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

For this extension, that means we use the data it handles only to provide its single purpose described above. We transfer it only as needed for that purpose (to our own servers, and to the service providers listed in our main Privacy Policy, such as the email provider that delivers the invoices you send), to comply with the law, or to protect against malware, spam, fraud or abuse. No person reads it unless you agree to it for specific data, it is needed for security, or the law requires it.

Disconnecting, removing the extension and deleting your data

• Disconnect: open the extension, go to its settings and choose Disconnect. It revokes the extension’s session with Amazon Cognito, removes this browser from your account’s devices where it can, and deletes the session, cached data, sent-invoice list and budget alert levels from this computer. Your reminder settings and any offline time not yet sent stay on this computer, so that time can still be saved when you connect the same account again. Signing out everywhere from your account also ends the extension’s session.
• Remove the extension: in Chrome, open chrome://extensions and choose Remove on Invoice My Clients: Time Tracker, or right-click its toolbar icon and choose Remove from Chrome. Chrome deletes everything the extension stored on this computer, including any offline time not yet sent. Removing the extension does not delete your account or the time and invoices already saved to it.
• Delete your account data: the time, clients, projects and invoices the extension saved are part of your Invoice My Clients account. You can delete your account and its data at any time from your account settings, or, without signing in, request deletion on our data deletion page. Some records may be kept longer where the law requires it (for example tax and payment records), as described in our main Privacy Policy.

Security

All data the extension sends travels over encrypted HTTPS connections. Its session lives only in its background service worker and Chrome’s extension storage, never in a web page. Your account data is stored on AWS in the United States.

Children

The extension is a business tool for adults and is not directed to children under 18.

Changes

If the extension starts handling data in a new way, we will update this page and its date before the change ships.

Contact

Questions or requests about your privacy: privacy@invoicemyclients.com. Invoice My Clients, LLC.

Read our main Privacy Policy · Request data deletion