Privacy Policy

Kairos is a time-tracking and invoicing service operated by ParallelTPA LLC (“we”, “us”). This policy explains what we collect when you use Kairos, why, and what you can do about it. It is written to be read. If anything is unclear, write to tyler@paralleltpa.com.

What we collect

Your account

You sign in with Google or Apple. We receive and store the email address, name and profile picture that provider gives us, plus its identifier for you. We never see or store a password.

What you put in

The workspace you create and its business profile (name, address, tax ID), your clients and their billing details, your projects and hourly rates, the time entries you track (start, end, a description), invoices, planned hours, and who you invite. This is your data; we process it only to run the service for you.

Connected services, only if you connect them

• Stripe. If you connect your Stripe account, we store the identifier of that account so we can create customers and draft invoices in it on your behalf. We never see your Stripe login or your clients’ card details.
• Google Calendar. If you connect it, we read your calendar (read-only) to suggest past meetings you might want to track. We store the OAuth tokens Google issues, encrypted, and we do not store your calendar events — we fetch them when you open the dashboard and show them to you.

Access tokens and the browser extension

You can create personal access tokens in Settings to let an assistant, a script, or the Kairos browser extension start, stop, and log time for you. We store a hash of each token rather than the token itself, its first few characters so you can tell your tokens apart, its scopes, and when it was last used. Revoking it in Settings stops it immediately.

The Kairos extension for Chrome keeps the token you paste into it, the Kairos server address, and the projects you used most recently in your browser’s local extension storage, on that device only. It has no access to the pages you visit: it does not read, record, or send anything about your browsing. The only data it sends is the timer request you make, to the Kairos API. Removing the extension deletes what it stored.

Billing

Subscriptions are handled by Stripe. We store your Stripe customer and subscription identifiers and the status of your plan. Card numbers are entered on Stripe’s pages and never reach us.

Technical data

Standard server logs (IP address, browser, the request made, timestamps) for security and debugging, kept briefly. We do not run advertising trackers and we do not sell data to anyone.

How we use it

• To run Kairos: show you your time, build your invoices, sync with the services you connected.
• To bill the workspace for its plan and to send receipts.
• To send you emails you triggered: an invite you created, a receipt, a notice that a payment failed. No marketing email without your consent.
• To keep the service secure and to fix problems.

Google API Services

Kairos’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar data is used only to show you suggestions inside Kairos; it is never transferred to others, used for advertising, or read by a human except with your permission for support or for security purposes as the policy allows.

Who else sees it

We use a small number of providers to run the service. Each receives only what it needs:

• Render — hosts the API and the database (United States).
• Vercel — hosts the web app, and, if you accept analytics in the cookie banner, counts page views and a handful of milestones (a sign-up, a first timer, a first invoice, a subscription) without cookies or any identifier for you.
• Stripe — payments, subscriptions, and the invoicing integration you may connect.
• Google — sign-in, and the calendar integration you may connect. And, only if you accept analytics in the cookie banner, Google Analytics on our pages: which pages are visited, from where, and the same handful of milestones, under a random cookie id. Nothing you type into the app — no clients, hours or invoices — is sent to it, and it is off until you choose.
• Apple — sign-in on iOS.
• Resend — sends the emails described above.
• Meta — marketing analytics, only if you accept it in the cookie banner: a pixel on our public pages and the first sign-in screen that tells us which ad brought you here and whether you signed up, and a server-side note to Meta when an account that came from an ad signs up or later subscribes. That note carries a hashed account id and Meta's own click id, never your email or name. The pixel never runs inside the app, and none of your clients, hours, or invoices are sent to Meta. If you came from an ad, we also keep the ad's campaign and name on your account so we know which ads work. Decline, and none of this happens.
• Us — with the same yes, we count one visit per browser per day on our public pages, keyed by a random cookie and tagged with the ad that brought you, if any. No IP address, no browser details, nothing that names you.

Beyond these, we disclose data only when the law requires it or to protect the rights and safety of our users and the service.

Your team

If you join someone else’s workspace, its owners and admins can see the time you track there, the clients and projects, and your name and email. If you own a workspace, you are responsible for who you invite.

Keeping and deleting

We keep your data while your account exists. You can delete your account from Settings at any time; it removes your account and every workspace you own, including all clients, projects, entries and invoices, disconnects Stripe and Google, and cancels the subscription. This is permanent. Data you created in a workspace someone else owns stays with that workspace, with your name removed from it. Backups roll off within 30 days.

Security

Traffic is encrypted in transit. OAuth tokens are encrypted at rest. Access is limited to what is needed to run the service. No system is perfectly secure; if we learn of a breach affecting your data we will tell you.

Children

Kairos is not directed at children under 16 and we do not knowingly collect data from them.

Changes

If this policy changes in a way that matters, we will say so in the app before it takes effect. The date at the top is the date of the current version.

Contact

ParallelTPA LLC, St. Petersburg, Florida, United States. tyler@paralleltpa.com.