Extension privacy policy

Last updated 14 October 2026.

This policy covers the Clockoli extension for Chrome and other Chromium browsers, Firefox and Safari, which share the same code and data flows. The clockoli.com website has its own privacy policy.

In short

  • Clockoli has no server. The extension talks directly to GitHub, and your time records are stored in private GitHub repositories you choose.
  • We, the people who make Clockoli, never receive your time records, your GitHub credentials, or the pages you track.
  • The extension contains no analytics, advertising or tracking code.

What the extension reads

  • The task you track. On GitHub issue and pull-request pages, the extension reads the page address and title to show its stopwatch. On any other site, it reads the current tab’s address and title only after you click the Clockoli toolbar button.
  • Site icons for the tasks in your lists.
  • Clockify reports, only for a migration you start. The Clockify add-on stays off until you turn it on in Settings, which also asks your browser for access to app.clockify.me. When you start a migration from a Clockify Detailed Report you opened, the extension reads the report data that page loads, or a CSV export you select. That data includes projects, tasks, descriptions, times, and the names and email addresses of the Clockify users in the report, which you match to GitHub users before importing. The extension never collects Clockify passwords, tokens or cookies.

Where your data is stored

In your GitHub repositories

Each tracked session records the task address and title, the start and end times, the local date and time zone, an optional description, your GitHub identity, and the Clockoli version that wrote it. Completion commits name you, the tracked duration and the task.

Everyone with read access to a repository can see what is in it. Access, retention and deletion follow that repository’s GitHub settings, which you or your organization control.

In your browser

Everything else stays in the extension’s own local database (IndexedDB), which web pages cannot read: your GitHub sign-in tokens, setup choices and settings, changes waiting to sync, caches, hourly rates and invoicing details. Hourly rates, invoices and invoicing details are never written to GitHub.

A settings backup is a file you download yourself. It contains your rates and invoicing details, but never your tokens.

Who receives data

  • GitHub (api.github.com and github.com/login), to sign you in and to read and write the repositories you connect. The default connection can access only the repositories you grant to the Clockoli GitHub App. An optional personal-access-token connection is limited to that token’s permissions. GitHub’s own privacy statement applies.
  • Frankfurter (api.frankfurter.dev), only when a report converts between currencies. The request contains currency codes and a date range, never your identity, tasks, rates or durations.

No one else receives data from the extension, including us. We do not sell it, use it for advertising, or use it to decide creditworthiness.

The use of information received by Clockoli complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

Permissions

  • activeTab and scripting: show the tracker panel on the current tab after you click the toolbar button.
  • alarms: retry changes that have not reached GitHub yet.
  • favicon: show site icons next to your tasks.
  • Access to api.github.com and github.com/login: sign-in and your time repositories.
  • Access to api.frankfurter.dev: exchange rates for reports.
  • A script on github.com: the stopwatch on issues and pull requests.
  • Scripts on Clockify Detailed Report pages, and optional access to app.clockify.me: the migration add-on.

Your choices

  • Revoke access at any time from GitHub’s authorized apps settings, and remove the Clockoli GitHub App from repositories it no longer needs.
  • Delete time records in Clockoli or directly in the repository. Earlier versions stay in Git history until a repository administrator rewrites it.
  • Uninstall the extension to remove everything it stored in your browser. Wait until pending changes have synced and resolve any conflicts before uninstalling.

Who we are

Clockoli is made by Manticore Software Ltd. Email contact@clockoli.com with any question about this policy.

Changes

If the extension starts handling data differently, we update this page and its date before releasing that version.