Privacy policy

Open Work helps open source freelancers log their hours, follow their collective's finances and send invoices through Open Collective. It is built so that it keeps nothing about you on its server: your data lives in your browser, in cookies only your browser holds, and, if you choose, in your own Google Drive.

What is kept, and where

• Your work log is stored in this browser (IndexedDB). It is not sent to or kept on our server, except in passing on its way to your Google Drive when Drive sync is on.
• Your settings, such as your name, address, hourly rate, payout method and GitHub details, are kept in a cookie in your browser. The server reads it on each request to fill in invoices, and does not store it.
• Your Open Collective connection is an access token kept in a cookie in your browser. It is used only to read your profile and payout methods and to create and read the expenses you submit.
• Recently visited collectives are kept in your browser's local storage so you can return to them.
• Public Open Collective data, such as a collective's balance and contributions, is cached on the server for up to a week so Open Collective is not asked again on every visit. This contains nothing about you.

Google user data

Signing in with Google is optional. It lets the app keep a copy of your work log in your own Google Drive, so it survives clearing your browser and follows you to other devices.

• What we ask for: your basic profile (name, email address and picture), to show who you are signed in as, and the drive.appdata scope, which lets the app read and write files in a hidden folder of your Drive set aside for this app.
• How it is used: the app keeps one file there, work-log.json, holding your work log. It cannot see, open or change any other file in your Drive, and other apps cannot see this one.
• Where it is kept: your Google session and access tokens are kept in an encrypted cookie in your browser. We have no database and keep no copy of your profile, your tokens or your work log on our server.
• Sharing: we do not sell, share or transfer Google user data to anyone, and we do not use it for advertising or to train AI models.

Open Work's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Other services

When you use these features, your browser or our server talks to:

• Open Collective, to read collective data and submit your invoices.
• GitHub, directly from your browser, to list the pull requests and issues you worked on.
• Google, for sign-in and Drive sync.
• Cloudflare, which hosts the app and may log requests, such as IP addresses, to keep the service running and secure.

There are no analytics, trackers or advertising cookies.

Removing your data

• Clear all data in Settings removes your settings, the work log kept in this browser and the places you looked up, and signs you out of Open Collective and Google.
• Signing out only deletes the access token from your browser. To revoke Open Work's access itself, remove it from the authorized apps in your Open Collective settings.
• To remove the Drive copy and revoke access, open your Google account's connections, choose Open Work and remove its access, which also deletes its hidden app data.

Changes and contact

If this policy changes, the date at the top changes with it. Questions are welcome as an issue on GitHub.