Privacy Policy
5pm is a work hour tracker made by Roshan Mahapatra. This page explains what 5pm keeps about you, why, and what you can do about it. In short: we keep only what the app needs to work, and we never sell it or use it for ads.
What we collect
- Your account. Your email address, your name, and how you sign in (password, Google, GitHub or a passkey). If you sign in with Google or GitHub, we receive your name and email from them.
- Your work data. The times you start and end work, hours worked, breaks, day types such as half days, leave and holidays, plans, notes you write, and your settings such as work hours and time zone.
- Your devices. For each device you use 5pm on: the name you give it, the browser and operating system, and when it was last active. This powers Saved Logins.
- Security details. Your passkeys (a public key, their name, and when they were added and last used), whether you have an authenticator app set up, and your backup codes, which we store only in scrambled (hashed) form.
What we don't do
- We don't sell or rent your data.
- We don't show ads or share your data with advertisers.
- We don't use analytics or tracking tools to follow what you do.
How we use it
Only to run 5pm: to sign you in, keep your hours in sync across your devices, show your reports and reminders, and keep your account secure. Reminder notifications are created on your own device.
Where it's stored
Your data is stored by Supabase, which runs our database and sign-in. The app itself is served by Vercel. Fonts load from Google Fonts, which means your browser contacts Google to fetch them.
If you leave feedback when deleting your account, it's stored in Supabase. Once your account is removed, that feedback is no longer linked to you. Some features load files from other services, which see your IP address and browser type, never your account or your hours: Cloudflare for PDF exports and the Contribute QR code, GitHub for the Windows download and desktop app updates, and Framer for the developer photo in About.
These providers handle data only to provide their service to us.
Your browser or the 5pm desktop app also keeps a copy on your device so it works offline. That copy is cleared when you log out.
Your choices
- See and change your data any time in the app.
- Take a copy from Settings › Security › Backup & Restore › Export.
- Sign out other devices from Settings › Security › Saved Logins.
- Delete your account from Settings › Security › Delete Account. Your data is kept for 48 hours in case you change your mind, then removed for good.
Keeping it safe
Each account can only reach its own data. You can add a passkey or an authenticator app, and when two-factor is on, your data stays locked until you complete the second step. All connections are encrypted.
Children
5pm is meant for working adults and isn't intended for children under 13.
Changes
If this policy changes, we'll update this page and the date at the top.
Contact
Questions or requests about your data: roshankanhu@gmail.com.