Who is responsible for your information
SideThread is operated by CGEMellen Direct Holdings, based in Michigan, USA. We are responsible for the personal information processed to provide SideThread. For privacy questions or requests, email [email protected].
Our commitments
We never sell customer data. SideThread has no ads. We do not use customer data to train AI models. Optional crash reporting is planned. When introduced, it will require your affirmative opt-in and will be off by default.
Information used to provide the service
Account information includes your username, password hash, time zone, account approval status and account settings, together with any email address you provide when requesting access or contacting us. We use it to approve and manage access, authenticate you, recover accounts and deliver important service notices. We store a password hash rather than your readable password.
Your time records include timer names, start and stop times, entries you edit and related settings. We use this information to run timers and present your history across supported SideThread interfaces.
Device and session information includes device names, sign-in sessions, token hashes and session expiry information. We use it to keep you signed in and manage access. Network requests also expose technical information such as an IP address; we process necessary security information to help prevent abuse and protect the service.
If you contact support, we receive your email address, message and anything you choose to attach. We use this information to answer your request. Avoid sending passwords, complete card details or unnecessary sensitive information.
Payments when you subscribe
When paid subscriptions become available, they will be processed through Authorize.net. Payment processing requires information about the payment method and transaction. For paid subscriptions, we will retain billing records such as your billing identity and email, subscription charges, dates, amounts, transaction references and refund history. Payment processors may also retain information under their own legal obligations and privacy terms.
Optional crash reporting
When optional crash reporting becomes available, we will collect technical diagnostic information only if you opt in, to investigate errors and improve reliability. Reports may include an error description, application version, device or operating-system information and the time of the error. Reports will be stored on our own server and individual reports deleted after 30 days.
Crash reports are designed to exclude passwords, payment details and the contents of your time records, including timer names. When introduced, crash reporting will include a switch to turn it off in settings. Turning it off stops future optional reports; it does not require you to stop using SideThread.
Future connections
Connections to external services are not currently available. If we introduce them, we will explain the information involved and request the necessary authorization before you connect a service.
Why we process information
We process account and time information to provide the service you request. Where a legal basis is required, necessary service processing is based on performing our agreement with you; required tax and accounting records are based on applicable legal obligations; proportionate security and service administration are based on our legitimate interests. Optional crash reporting is based on your consent. We will identify another lawful basis if a different use requires one.
Who receives information
SideThread is hosted on a server we operate. Access is limited to what is needed to operate, secure and support the service. Authorize.net and the payment providers involved in your transaction process payment information when you subscribe. Email sent to our current support address is processed through Gmail. Essential service providers may receive information necessary to perform their role.
We may disclose limited information when legally required, to respond to a valid legal process or where lawfully necessary to protect accounts and the service. We do not provide customer data to advertisers or AI model-training services.
Account deletion
You can request deletion by emailing us. We may verify your identity before accepting an email request. We ask you to confirm that deletion is permanent. Once you confirm, we immediately delete your account, time records and other operational account data. This includes optional crash reports that can be linked to your account. Export any records you want to keep first.
We do not postpone deletion while reviewing a refund. Deleting a paid account cancels renewals and automatically creates a refund request. The limited information needed to review that request is kept with the separate billing records described below, rather than preserving your time records or active account.
The billing-record exception
When a customer with billing history closes an account, we email a printable PDF of the complete billing history to the account email address. We retain a copy in a separate billing database for seven years after account closure for accounting, payment administration and refund records. The PDF does not contain time entries, timer names, passwords or full payment-card details.
Necessary billing identity, contact details, transaction references and refund decisions remain with that record. A refund issued after deletion is added to the billing history and a confirmation is emailed to you. Access to this archive is restricted to these purposes. It is not used to recreate your account, track your activity or market to you.
At the end of seven years, we delete the archived records unless a specific legal obligation requires us to keep particular records longer. Any such extension is limited to the affected records and required period. The same retention limit applies to any paper copies we make.
Other retention
We keep account and time records while your account remains open, subject to the deletion process above. Individual optional crash reports are deleted after 30 days. Independent payment providers may have their own recordkeeping duties; deleting a SideThread account does not erase records they must keep.
Your choices and rights
You can view and export your recorded time while your account remains open, including after a paid subscription ends. You can correct your time records and account information and can request account deletion. When optional crash reporting is introduced, you will be able to opt in and turn it off again at any time.
Depending on where you live, you may also have rights to request access, correction, erasure or a portable copy of personal information, restrict certain processing, object to processing based on legitimate interests and withdraw consent. Withdrawing consent does not change whether earlier consent-based processing was lawful. Some requests may be limited by applicable recordkeeping obligations.
Email [email protected] to exercise these rights. We may request proportionate information to confirm your identity and will respond within the period required by applicable law. You may also complain to the data protection authority responsible for your location.
Security and international processing
We use safeguards appropriate to the information we process and restrict access to operational and billing records. No system can guarantee absolute security. SideThread is operated from the United States; providers involved in support and payment processing may process information in other countries.
Adults only
SideThread is intended for adults aged 18 or older who can legally agree to its terms where they live. We do not knowingly provide accounts to children. Contact us if you believe a child has supplied personal information so we can investigate and remove it as appropriate.
Changes to this policy
We will update this policy when our practices change and notify you of material changes before they take effect. We will request new consent when required for a new optional use. Contact us at [email protected] if you have questions.