Privacy and security.

This website uses no cookies, analytics, advertising pixels or any other tracking. Fonts and images are served from the same place as the site, so visiting it doesn’t send requests to third parties.

Like any website, the service that hosts it (Cloudflare) may keep standard technical logs, such as IP address, browser type and the time of the request, for security and reliability.

The request form sends nothing from this page. It writes your request out (name and work email and, if you add them, your institution, role and a note) for you to copy into an email to hello@hourflag.com, from your own email app. The form stores nothing in your browser.

If you email HourFlag, it receives what you choose to include, usually your name, work email, institution and role. It is used only to reply, and to arrange your free check if you ask for one.

Who is responsible, and your rights

Who is responsible: HourFlag, reachable at hello@hourflag.com, is the data controller. Why: to reply to you and to arrange the free check you asked for; the lawful basis is HourFlag’s legitimate interest in answering a request you made, and the steps that come before any agreement. Who receives it: HourFlag’s email provider; no one else. How long: 12 months after the last exchange, or at once if you ask.

Your rights: to access, correct, delete or receive your details, and to object to or limit their use. Write to hello@hourflag.com. You can also complain to the CNIL (cnil.fr), the French data protection authority. A name and a work email are required for a reply; the rest is optional.

Time entries and the reports around them: who worked (by employee ID), in which work area, when, what was corrected and by whom, and, if you choose to add it, the schedule.

Names aren’t needed: everything is keyed on the employee ID, so your department can drop them before exporting if it prefers. Any other column in those reports is ignored and never kept.

It doesn’t need Social Security numbers, bank details or academic records. It never uses GPS, device or phone data, and it tracks no one during a shift.

The free check is a single file that opens in your web browser, on your computer, and makes no network requests.

The only thing it saves is a review file, and only when you click Save. It holds no student names and no pay rates, only:

• employee IDs, and which entries were flagged
• your answers, any corrected times and notes you typed, and when you entered them
• your settings (wages by work area, opening hours, thresholds) and which column of each report holds what
• your own profile, if you filled it in, and your own minutes spent, if you typed them
• a short memory of each pay period checked, in minutes, never dollars, so patterns carry over

You save it next to your exports, with your browser’s save dialog, and you keep it. The free check never writes to your timekeeping system or to payroll.

The hosted product is designed as a web application with logins for supervisors and payroll staff. Unlike the free check, it is designed to store data on a server, so that it can remember past pay periods:

• the runs and the flags
• the answers and corrected times
• settings, and who approves which work area

Where your institution agrees, it could also hold pay rates.

Before any institution licenses the hosted product, it goes through that institution’s software selection process and its IT and privacy teams’ review, which decides the requirements it must meet. The review covers three things.

1. The exports

What HourFlag is designed to receive from your timekeeping system (time entries, missed punches, corrections and, where you share it, the schedule), delivered on a schedule your IT sets up, every pay period.

Today, corrections are made in your timekeeping system from a sheet in its own words, and approval stays there. Sending them back automatically is a step your IT can approve later.

2. The sign-in

Logins for supervisors and payroll staff, through your institution’s own sign-in where it offers one. It is designed so each supervisor sees their own work areas, and payroll sees the department.

3. The safeguards

It is designed with:

• data encrypted in transit and at rest
• hosting in the United States, by a provider named in writing during your review
• a log of every view and change
• timesheet data only: the columns it needs, every other column ignored and never kept, and no GPS, device or phone data
• one retention period for the department, set in your agreement
• export at any time, and deletion when the agreement ends

Write to hello@hourflag.com. If this page changes, the date at the top changes with it. Who publishes this site, and who hosts it, is on the legal notices page.