Privacy Policy
Last updated 10 November 2026
EffortFlow is a service run by AryaCode Labs ("we", "us"). This policy explains what personal data we collect when you use EffortFlow, why we collect it, who else handles it, and the choices you have.
Two roles: your workspace data and your account
When a workspace records timesheets, projects and client details, the workspace owner decides what goes in and why. For that content we act on the workspace owner's behalf, as a processor. For account, billing and security data we decide how it is used, as a controller.
What we collect
| Data | Examples | Why |
|---|---|---|
| Account | Name, email address, password (stored only as a one-way hash) | To sign you in and contact you about your account |
| Workspace content | Clients and their billing email addresses, projects, rates, time entries and notes, work items, milestones, billing periods, invitations | To provide the service |
| Approvals | The approver's decision, comment, time, and IP address | A record of who approved or disputed a month, for both sides |
| Emails we send | A copy of each notification (recipient, subject, body) | Delivery troubleshooting and an audit trail for the workspace |
| Billing | Plan, add-ons, billing currency, renewal dates, and the IDs Dodo Payments gives us | To apply your plan's limits. We never see or store card details. |
| Security | IP address of sign-in and sign-up attempts, held briefly in memory | To slow down password guessing |
Cookies and browser storage
We use no advertising or analytics cookies. We set:
- effortflow_session: keeps you signed in, for up to 14 days. Required.
- effortflow-theme: remembers light or dark mode, for a year.
Your browser's local storage also keeps a few display preferences (theme, accent colour, sidebar and dashboard layout). They never leave your device.
Website analytics
To learn how people find and use our public pages, we count visits with PostHog in cookieless mode. It sets no cookies and stores nothing on your device. It only runs on our public pages (home, pricing, sign-up and sign-in, onboarding and these policy pages), never inside your workspace, and links that contain private tokens are stripped before anything is sent. For each visit PostHog receives the page address, the referring site, campaign tags such as utm_source, and your browser and device type. Your IP address is used only to count unique visitors for the day, through a hash that changes daily, and is not stored. We do not record sessions or what you type.
Who else handles data
- Dodo Payments sells and bills EffortFlow subscriptions as Merchant of Record. When you pay, you give your payment details to them, not to us, and their privacy policy applies to that payment.
- Our hosting provider runs the servers where the app and its database live.
- Our backup storage provider keeps copies of the database so it can be restored.
- Our email provider delivers the notifications EffortFlow sends.
- PostHog measures visits to our public pages, as described above.
We do not sell personal data, and we do not share it for advertising.
How long we keep it
- Workspace content: while the workspace exists. Deleting the workspace deletes its content.
- Your account: until you delete it. Deleting a workspace also deletes the login of the admin who deletes it.
- Backups: database backups roll over and older copies are removed on a fixed schedule.
- Billing records: kept as long as tax and accounting law requires.
Your choices and rights
You can see and correct most of your data in the app, export timesheets, and delete your workspace from Plan settings. To get a copy of your data, have something corrected or deleted, or object to how we use it, write to reachus@aryacodelabs.com. If your data sits in someone else's workspace (for example you are a client approver), we will pass your request to that workspace owner. You may also complain to your data protection authority.
Security
Traffic is encrypted with HTTPS, passwords are hashed, sessions can be signed out from every device, and each workspace's data is kept separate. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.
Children
EffortFlow is a business tool and is not meant for anyone under 18.
Changes
We will post changes here and update the date above. For significant changes we will also email workspace admins. See also our Terms of Service and Refund Policy.
Questions? Write to reachus@aryacodelabs.com.