Privacy policy
Overdraft is a personal time tracker made by one developer (nomad4tech). This page says what the service stores about you, what it is used for, who can see it and how to remove it. There are no ads, no analytics trackers and your data is never sold.
What is stored
- Your Google account details - email address and display name, received when you sign in with Google. The service never sees your Google password and asks for no other Google data.
- What you create in the app - tasks (name, description, group, daily cap, planned list), groups and their colours, and the time records of every start and stop, including sleep sessions.
- Settings - notification choices and, if you enable push notifications, the address of your browser's push channel with its keys, your time zone, the language and the browser/device name.
- Messages you send through Feedback - the text, its kind, the app language and the browser name, together with your name and email.
- A session cookie that keeps you signed in (up to a year after the last visit), and a security cookie that protects changes from forged requests.
What it is used for
To show your board and statistics, to run the timer, to send the notifications you asked for, and to read and answer your feedback. Nothing else.
Who can see it
- You, signed in with your Google account.
- The developer (the administrator of the service). The administration page shows the list of users with their name and email and activity as numbers only (registration date, when you last tracked time or created a task, tracked time for 7 and 30 days, active days, how many times you reset your data). It does not show the names of your tasks, groups or any other content of your board. Feedback messages are visible to the developer in full, with your name and email, and may be forwarded to the developer's Telegram chat.
- Service providers that carry the data: the server host (the data lives in a database on a rented server), Google (sign-in), the browser vendors' push services (notification text, which may contain a task name, passes through them) and Telegram (feedback forwarding, if enabled).
Data is sent over HTTPS. In the database the following is stored encrypted (AES-256-GCM): your email address and name, the names and descriptions of your tasks, their custom fields and the names of your groups, your feedback messages, the addresses and keys of your push-notification subscriptions, and the contents of your sign-in sessions. The encryption key is kept on the server separately from the database.
The Chrome extension
- It only talks to
app.overdraft.nomad4.techand shows and changes the same tasks you see in the app. It sends nothing to any other server, includes no analytics and loads no remote code. - It uses your existing sign-in (the service cookie). To make changes it reads the security cookie of the service (permission
cookies); it never reads cookies of other sites. - It keeps on your device only which boards you switched on (
storage) and refreshes the number on the toolbar icon once a minute (alarms).
Keeping and deleting your data
- You can export your statistics as CSV on the Stats page.
- Settings -> Reset all data permanently deletes your board, all tasks (archived ones too), groups and the whole time history at once. Your account (email and name) stays.
- Settings -> Delete account deletes everything at once: the account (email and name), the board, tasks, groups, tracked time, the feedback you sent, notification settings and devices. You are signed out on all devices. It cannot be undone. Copies of the database kept as backups may hold deleted data for a limited time.
Children
The service is not meant for children under 13 and does not knowingly collect their data.
Changes and contact
When this policy changes, the date at the top changes too. Questions or requests to see your data: alex@nomad4.tech or Settings -> Feedback in the app.