Your data, your rules
We believe privacy is a right, not a feature. This page explains plainly what we collect, why, and exactly what you can do about it.
Our core privacy commitments — at a glance
Encrypted at rest
All data stored with AES-256 encryption on MongoDB Atlas.
Never sold
We never sell, rent, or share your data with advertisers.
You stay in control
Export or delete your account and all data at any time.
No tracking cookies
We use only essential session cookies — no ads, no tracking.
TLS 1.3 in transit
All connections between you and our servers are TLS-encrypted.
30-day deletion
Account deletion permanently purges all your data within 30 days.
1.Information We Collect
We collect only what is necessary to run WorkLog Pro. Here is exactly what we hold about you:
| Data | Why we collect it | How long |
|---|---|---|
| Name & email | Account creation and login | Until account deleted |
| Password hash (bcrypt) | Authentication | Until account deleted |
| Work log entries | Core product functionality & AI insights | Until account deleted |
| Profile bio & avatar | Personalisation | Until account deleted |
| Usage events | Bug detection and product improvement | 90 days rolling |
| IP address (geo only) | Local currency detection at billing | Not stored |
2.How We Use Your Information
We use your data solely to deliver and improve WorkLog Pro — never for advertising.
- Provide core functionality — logging, analytics, streaks, and reports
- Generate AI-powered insights from your work log text (via OpenAI)
- Send transactional emails — account events, password resets
- Detect and prevent fraud, abuse, or security incidents
- Improve the product based on aggregated, anonymised usage patterns
- Comply with applicable legal obligations
3.Storage & Security
All data is stored on MongoDB Atlas (AWS-backed) with encryption at rest enabled at the cluster level.
Encryption at rest
AES-256 (MongoDB Atlas)
Encryption in transit
TLS 1.3
Password storage
bcrypt (cost factor 12)
Auth tokens
Signed JWTs, 15-min expiry
Refresh tokens
HttpOnly cookie, 30-day TTL
Backups
Daily, retained 7 days
We never store raw passwords. If you sign in with Google, we receive only your name, email, and profile picture — we never see your Google password.
4.Third-Party Services
We use a minimal set of trusted third-party services. Each is bound by its own privacy policy and, where applicable, a data processing agreement with us.
| Service | Purpose | Data shared |
|---|---|---|
| Google OAuth | Sign-in authentication | Name, email, profile picture — read-only |
| OpenAI | AI-powered log parsing & summaries | Work log text — not used for model training |
| MongoDB Atlas | Database hosting | All stored data — encrypted at rest |
| Vercel | Platform hosting & CDN | Request logs for 24 h, then deleted |
| Paystack | Payment processing | Email + plan type — no card details stored by us |
| ipapi.co | Currency geo-detection | Your IP — not stored after the API call |
6.Your Rights
Under GDPR, CCPA, and similar frameworks, you have the following rights. Most can be exercised directly in the app — no need to contact us.
Access & Export
Download a full copy of your logs, profile, and settings as CSV or JSON at any time from Settings → Data.
Correction
Edit any inaccurate data directly in the app, or contact us and we'll update it within 7 days.
Deletion
Delete your account from Settings → Account. All data is permanently purged within 30 days.
Restriction
Request that we stop processing your data for analytics or AI while keeping your account active.
Portability
Receive your data in a machine-readable format (CSV / JSON) to move to another service.
Withdraw Consent
Opt out of AI processing or non-essential communications at any time from your account settings.
We respond to all rights requests within 30 days. Contact us at privacy@worklogpro.com if you cannot action a right from within the app.
7.Data Retention
We keep your data for as long as your account is active, or as required to provide the service. Specific retention periods are listed in the data table in Section 1.
When you delete your account, all associated data — work logs, profile, settings, and analytics — is permanently and irreversibly purged within 30 days. Encrypted backup snapshots may persist for up to 90 days before being overwritten.
Anonymised, aggregated usage statistics (e.g. “feature X was used 5,000 times this month”) are not linked to your identity and may be retained indefinitely.
9.Policy Changes
We may update this Privacy Policy from time to time. When we do:
- The "Last updated" date at the top of this page will change
- For material changes, we will notify you by email at least 14 days before they take effect
- Continued use of WorkLog Pro after the effective date constitutes acceptance
- You can always delete your account before a policy change takes effect
10.Contact Us
Questions, concerns, or rights requests related to this Privacy Policy can be directed to our privacy team:
Related documents
WorkLog Pro is committed to GDPR and CCPA compliance. If you believe we are not upholding our privacy commitments, you have the right to lodge a complaint with your local data protection authority.