Timevolt Privacy Policy

Effective 30 October 2026. Last updated 30 October 2026.

1. Who we are

Timevolt is run by Tabberstein, LLC, a California limited liability company ("Timevolt", "we", "us"). We decide how your personal information is used. In GDPR terms, we are the "controller". You can contact us at privacy@timevolt.com or 830 S Olive Street #310, Los Angeles, CA 90014.

This policy covers the Timevolt website, apps, receipts, templates and API. When a business uses our API for its own customers, that business decides how its customers' data is used. Its own privacy policy applies, and we act on its instructions under a data processing agreement with that business. We still use some data for our own purposes, such as billing that business.

2. The short version

• Your files never leave your device. During normal receipt creation, your device sends us only a randomised code made from the file's fingerprint (a short code calculated from the file), plus encrypted recovery data, never the fingerprint itself. That code can't be turned back into the file. But anyone holding your receipt could test guesses about a short or predictable file, so share receipts with care. In normal use we don't receive the plain fingerprint, so we can't.
• We collect as little as we can. Most of the site works without an account.
• We don't sell your personal information, and we don't use it for advertising.
• We use no advertising cookies or tracking pixels. Our payment provider sets fraud-prevention cookies on checkout pages only. We use no analytics service.
• Some proof data goes into the public Bitcoin blockchain, which can't be erased. It's a summary of fingerprints that doesn't directly show names, emails or file contents.
• You can ask to see, correct, download or delete your data. Email privacy@timevolt.com.

3. What stays on your device

When you make a time receipt, your device reads the file and calculates its fingerprint (a SHA-256 hash). The file itself is never sent to us. Nor is a copy of it, a preview or a thumbnail.

What we never receive: your file's contents, previews or thumbnails, or its file name, size or type. The exceptions are a name you type into a receipt label yourself, or a file you choose to send us, for example in a support email.

Your browser also stores the following on your device, so you can pick up where you left off:

• your checklist ticks and notes
• the links you add and your worksheet entries
• fingerprints and receipt progress

We can't see this information unless you choose to put it in a receipt label or send it to us. If you turn on encrypted backup, we store an encrypted copy we can't read (section 4). Anyone with access to your device or browser may be able to see it. Clearing your browser data deletes it, so keep your own copies.

4. What we collect, and why

About fingerprints. A fingerprint doesn't directly display what's in your file. Because every receipt adds a random value, someone who only has the same file can't use our service to find your receipt. Whether a fingerprint identifies you can depend on other things linked to it, such as your internet address or the file's content. So we treat all fingerprints as personal information. During normal receipt creation we don't receive the plain fingerprint: your device sends only a randomised code made from it, and that code is what we and the timestamp authorities hold. If you choose to send us a complete receipt (for example, in a support email), it can reveal the fingerprint and random value to us. We offer no way for anyone to look up whether a fingerprint has been stamped. But the random value doesn't stop guessing by anyone who has your receipt: they could test guesses about a short or predictable document, such as a filled-in template. In normal use we don't receive them, so we can't.

What you must give us. You can make a receipt without giving us any personal details. You only need an email for an account, for updates or for buying something; without one, those features won't work. Payment details are needed to buy. Nothing else is required.

Other uses.

• "Email it to me" opens your own email app or share sheet with your receipt image and receipt file attached where your device supports it, or downloads them for you to attach yourself. We don't send that email or see it. Once sent, it's held by your email provider and anyone you forward it to; our encrypted backup doesn't cover it. It never adds you to a mailing list. Updates are a separate, unticked opt-in, and every update email has an unsubscribe link. We keep your updates subscription until you unsubscribe, and ask you to confirm it every 24 months, removing you if you don't. After an opt-out or deletion request, we keep a minimal do-not-contact record (your email address and the date) only to stop further marketing, unless you later sign up again yourself with a fresh, recorded opt-in. Reimporting a list, a service message, reopening an account, or someone else entering your address doesn't count. The legal basis is consent for updates, and legitimate interests for the do-not-contact record.
• Deadline reminders, if you turn them on, use your email address and the date you set. We keep them until the reminder is sent or you turn it off.
• Improving the service: we use aggregated usage counts that identify no one. The legal basis is legitimate interests.
• Case stories summarise public court and regulator decisions without names. If you think one could identify you, you can object and we'll review it (section 10).

Encrypted backup (Pass). If you turn on backup, its contents (your receipts, notes, worksheet entries, checklist progress, links and journey folders) are encrypted on your device, with a key we never receive, before upload. We store the encrypted copy and can't read it. We can see its size, when it was updated and which account it belongs to. This encryption doesn't hide the information we separately receive to issue receipts (above). The backup never includes your photos or files. Resetting your account password doesn't restore a lost backup key, and without the key we can't restore the backup. The 90-day download period starts when your paid Pass access ends (see our Terms, section 13), and we show the scheduled deletion date in your account. If you close your account or ask us to delete your backup, we delete it from our active systems within 30 days of your request, and from our system backups within 35 days of your request.

API statements. Our apps never send file contents. At launch, the API doesn't accept document contents either, only randomised codes (commitments). If that changes, we'll update this policy first.

We don't ask for sensitive information (such as health, religion or immigration status), and we don't need it. Notes you write are fingerprinted like files: their text stays on your device (and in your encrypted backup, if you use one) and isn't sent to us. Receipt labels are different. They're short names that we, and anyone you share the receipt with, can read. Don't put sensitive information about you or anyone else in a label. If we learn a label contains sensitive information about someone else, we may restrict or remove it. We don't intend to process sensitive information (such as health, religion, sex life or criminal records). If it reaches us anyway, for example because you send it in a support message, we use it only to deal with your request and delete it when we're done.

We don't make decisions about you by purely automated means that have legal or similarly significant effects.

Purposes and legal bases for our other activities (EU/UK):

Case stories never name private individuals, and never include health or criminal-offence details about anyone who could be identified. We summarise only decisions that are already public, and we remove a story if someone shows it identifies them.

5. Who we share it with

We share personal information only as needed to run the service, and only with these kinds of recipient:

Our processors handle information under our instructions. Some recipients, including our payment provider (Stripe) and the timestamp authorities, also process information independently for the purposes in their own policies, such as fraud prevention and legal compliance. Our provider list shows each recipient's role and what it receives. Timestamp authorities are independent. They may keep their own records of the combined batch codes they sign, under their own published policies. We keep a current list at timevolt.com/providers.

We may also share information:

• if the law requires it, such as a valid court order. Where allowed, we'll tell you first.
• to protect people's safety, or to stop fraud or abuse
• with a buyer or successor if Timevolt is sold or merged. This policy would still protect your information, and we'd tell you.

The free reader. When you or anyone else checks a receipt, the reader needs Bitcoin data. The reader checks your receipt on your own device first, without contacting anyone. An online check is optional. It goes straight from your browser to a Bitcoin source you pick, such as your own node or a public block explorer, and never through us. The reader names that source before contacting it. The source sees your internet address and which transaction you looked up.

6. Bitcoin is permanent

To make receipts permanent, we combine many fingerprints into one summary code (a Merkle root) and write it into the Bitcoin blockchain. Once written, no one can change or remove it, including us.

That code doesn't directly show names, emails, files, labels or any individual fingerprint. Your receipt holds the link from your fingerprint to that code.

If you ask us to delete your data, we delete what we hold: your account, email, labels and our copies of your receipts. The exceptions are records the law requires us to keep (such as invoices), records of what you agreed to, the minimal record needed to remember your marketing opt-out, and anything we must hold for security or a legal dispute. We keep those only for that purpose, for the periods in section 7. We delete from our active systems within 30 days of your request, and from our system backups within 35 days of your request. If we ever restore a backup, we re-apply deletions first. For a receipt made without an account, we normally verify control of its private deletion key, which your device creates with the receipt and keeps separately from the shareable receipt file. An email address helps only where our records already link it to the receipt. If you can't use that key, contact us and we'll assess the request. Holding someone else's receipt isn't enough to delete their data. If information about you appears in someone else's receipt label, contact us to identify it. We assess your rights separately from ownership of the receipt and may verify your identity; this doesn't let you access or delete the creator's whole account. The summary code stays in Bitcoin. But a receipt, or other information, can link it to you, and a small batch (for example, a single Fast receipt) may contain few fingerprints. Deleting our copies doesn't erase copies of your receipt held by people you shared it with, and it can't remove the public anchor. It also means we can no longer recover or refresh that receipt, so keep your downloaded copy; we warn you before you delete. Timestamp authorities may keep their own records of the randomised code, and we can't delete those. We show a short notice before your first receipt explaining that the public anchor is permanent.

7. How long we keep it

Also:

• Encrypted backup (Pass): until you delete it (turning backup off only stops syncing); 90 days after paid Pass access ends; or within 30 days of a request to close your account or delete the backup (35 days for system backups).
• Records of what you agreed to (the notice shown, the terms version, renewal consent): while your account is open, plus 6 years. If you never open an account, 6 years from the day you agreed.
• Our system backups: 35 days, after which deleted data is gone from them too.
• Updates subscription: until you unsubscribe. We ask you to reconfirm every 24 months, which is our own policy, not a legal deadline, and remove you if you don't.
• Do-not-contact record (email address and opt-out date): kept while we send marketing, and used only to stop marketing to you. We review it every 24 months.

When we no longer need information, we delete it or make it anonymous.

8. Keeping it safe

We protect information with encryption in transit and at rest, limited staff access, multi-factor authentication and separate keys for separate jobs. We keep independent backups so receipts can be recovered.

No system is perfectly secure. If a breach affects your personal information, we'll tell you and any regulators as the law requires.

9. Cookies, browser storage and analytics

• Cookies. We don't use advertising or tracking cookies. If you log in, we use one essential cookie to keep you logged in. On checkout pages only, our payment provider (Stripe) sets cookies to prevent fraud. We turn off open and click tracking in our emails.
• Browser storage. We use your browser's local storage to save your checklist progress and receipts on your device (section 3). It stays on your device and isn't sent to us, unless you turn on the Pass's encrypted backup (section 4).
• Analytics. Today we use no analytics service. If we add one, it will be privacy-friendly, with no cookies and no cross-site tracking, and we'll update this section first. Search-engine reports we may look at contain only totals, not data about you.
• Global Privacy Control. We don't sell or share personal information for advertising, so there's nothing to opt out of. We will still honour GPC browser signals as an opt-out if that ever changes.

Tracking across other websites (California). Timevolt doesn't collect information about your online activity over time and across other websites. Because we don't, browser "Do Not Track" signals don't change what we collect. On checkout pages only, our payment provider, Stripe, may collect information about your device and how you use the page, including signals it uses across sites that use Stripe, to prevent fraud. See Stripe's privacy policy. No other third party collects this kind of information on our site.

10. Your rights

Wherever you live, you can ask us to:

• see the personal information we hold about you
• correct it if it's wrong
• download it in a portable format, such as your receipts
• delete it (see section 6 for what can't be deleted)
• stop marketing emails, using the unsubscribe link or by emailing us

Email privacy@timevolt.com. We may need to check it's really you first, usually by confirming your email address. We'll confirm we've received your request, and complete it within one month, or sooner where the law requires. We won't treat you differently for using your rights.

California and other US states.

• Residents of California and states with similar laws have the rights above, and the right to know what categories of personal information we collect and why (section 4).
• We do not sell or share personal information for cross-context behavioural advertising.
• We don't use or disclose sensitive personal information for purposes that would require a right to limit.
• You can use an authorised agent to make a request.
• If we turn down your request, you can appeal by replying to our decision.
• We give these rights to everyone, whether or not a state privacy law requires it.

EU, UK and Switzerland. You also have the right to:

• object to processing based on legitimate interests
• restrict processing
• withdraw consent at any time
• complain to your local data protection authority, or in the UK, the Information Commissioner's Office

Your right to object. Where we rely on legitimate interests, such as security logs or answering messages, you can object at any time and we'll stop unless we have a strong legal reason to continue. Withdrawing consent, such as unsubscribing from updates, is always as easy as giving it.

Complaints (including UK). You can also complain about how we handle your information at privacy@timevolt.com. We acknowledge privacy complaints within 30 days, investigate, keep you informed, and explain the outcome without undue delay. A complaint doesn't replace a rights request in the same message; we handle both.

We don't currently direct our service at people in the EU or UK, so we haven't appointed a representative there. If that changes, we'll name our representative here first.

Canada. You can access and correct your information, and withdraw consent, subject to legal limits. You can complain to the Office of the Privacy Commissioner of Canada. In Quebec, our person in charge of protecting personal information is Lincoln Gasking, Head of Privacy, privacy@timevolt.com.

Australia. You can access and correct your information under the Australian Privacy Principles. You can also use Timevolt without telling us who you are: a receipt needs no account. You can complain to the Office of the Australian Information Commissioner if you're not happy with our answer.

11. Children

Timevolt is not meant for children under 13 (or under 16 in EU countries that set that age), and we don't knowingly collect personal information from them. Free receipts are for ages 13 and up (16 where local law requires it). Accounts and purchases are for ages 18 and up, as our Terms say. A parent or guardian can create an account or buy for a younger person, and is then the account holder and operates the account; children under 13 don't use accounts themselves. If we learn that we've collected personal information from a child under 13, including contact details or device identifiers, we'll delete it.

If you think a child under 13 has given us personal information, email privacy@timevolt.com and we'll delete it.

12. Data stored outside your country

We're based in the United States, and our providers may process data in the US and other countries. When we move personal information out of the EU, UK or Switzerland, we use legal safeguards. Examples are the European Commission's Standard Contractual Clauses, or providers certified under the EU–US Data Privacy Framework. You can ask us for details. Our provider list shows, for each provider, where it processes data and which safeguard applies.

13. Features we're still building

Some planned features would collect more information. These include place receipts (proving you were somewhere at a time), device checks and shared records with other people.

We'll explain exactly what each one collects before you use it. Anything sensitive, such as your precise location, will be off by default and used only if you turn it on. We'll update this policy before those features launch.

14. Changes to this policy

If we make a significant change, we'll tell you by email or in the service at least 30 days before it applies. Earlier versions stay available at timevolt.com/legal/versions. We won't use information in a significantly new way without telling you first and, where the law requires, asking you.

15. Contact us

Tabberstein, LLC (Timevolt) · 830 S Olive Street #310, Los Angeles, CA 90014 · privacy@timevolt.com

For privacy questions or requests, email privacy@timevolt.com with "Privacy request" in the subject line.