Privacy Policy

Neonfair (the “Service”) is a time tracker for freelancers at neonfair.com. In this policy, “we” and “us” mean the people who operate the Service.

You can reach us at [email protected].

This policy covers the website and the app at neonfair.com. It describes what the Service actually does with information, and it is the only place we describe that.

You do not need an account. Without one, the Service keeps your workspace in your browser’s local storage on your device. It consists of:

• your projects: name, colour, optional hourly rate and currency, and whether the project is archived;
• your time entries: start and end times, the project and the note you typed;
• the timer that is currently running, if any;
• your preferences: the first day of the week and your default currency;
• a short list of the entries you deleted, so that a deleted entry does not return when two copies of your workspace are combined.

This information never leaves your device and is never sent to us. We cannot see it, and we cannot recover it for you. Clearing your browser’s site data, or using a private window, can erase it. Settings lets you export it as a file at any time. If the saved text cannot be read, the app keeps it aside under a second key instead of overwriting it.

If you want your workspace on more than one device, you can sign in with Google. Sign-in is optional and is the only way to create an account.

You sign in with the “Continue with Google” button on the sign-in page. It opens Google’s own sign-in window, where you choose your Google account. Google then gives the Service a signed statement of who you are (an ID token), which the Service passes to Supabase to create or recognise your account. The statement carries the information covered by Google’s three standard permissions, openid, email and profile, and nothing more. Through it we receive:

• your name;
• your email address;
• your profile picture (as a link to the image, which Google hosts);
• your Google account identifier, a number that identifies your Google account to us.

Nothing else in your Google account is accessed. The Service does not ask for, and cannot read, your Gmail, Google Drive, Google Calendar, contacts or any other Google data. The Service never receives an access token for any Google service. You complete the sign-in with Google itself, and you can remove the Service from your Google Account’s list of apps with access at any time. We never see your Google password.

Sign-in is handled by Supabase, our authentication provider. Its authentication service also keeps the technical records needed to run a sign-in, such as when you signed in and the session that keeps you signed in; these can include your IP address and browser details.

We use the information from Google only to:

• create your account and recognise it when you come back;
• show your name, email address and picture in Settings, so you can see which account you are in;
• keep your workspace in sync between the devices you sign in on.

We do not sell your information. We do not use it for advertising, for profiling or for marketing. We do not use it, or your workspace, to train AI models. We do not use your email address to send you anything; we use it only to reply if you write to us.

When you are signed in, one copy of your workspace (everything listed in the section on using Neonfair without an account) is stored in our database as a single record that belongs to your account. Database rules allow a signed-in person to read and write only their own record.

Signing in on a device that already holds a workspace combines the two, so nothing you tracked before signing in is dropped. After that, changes are saved to the database shortly after you make them and are loaded on your other devices.

The people who administer the database can technically see what is stored in it. We access it only to run and secure the Service, to help you with a problem you ask us about, or when the law requires it.

We use three kinds of provider. None of them is allowed to use your information for its own advertising.

• Google signs you in. When you open the sign-in page, your browser loads Google’s sign-in script and button from accounts.google.com, so Google receives a request from your browser (with your IP address and the fact that you opened that page), and it may set its own cookies on its own domain there. Google also knows that you used Neonfair once you sign in. Your profile picture is loaded straight from Google’s servers when it is shown, so Google receives a request for that image from your browser too.
• Supabase provides the authentication service and the database that holds your account and your workspace. The database is hosted in Frankfurt, Germany.
• Our hosting provider delivers the website to your browser. Like any host, it receives your IP address and the details your browser sends with each request, and it may keep them in ordinary server logs. We do not use them for analytics.

Apart from Google’s sign-in script on the sign-in page, the Service loads no third-party script anywhere. It loads no analytics, no advertising and no fonts from other sites: everything else a page needs is served from neonfair.com. We do not share your information with anyone else, except where the law requires.

Neonfair sets no cookies. It uses your browser’s local storage, only for what the app needs to work:

• neonfair:workspace: your workspace, as described above;
• neonfair:synced-user: when you have signed in, the identifier of the account this browser last synced with, so one person’s time is never added to another person’s account on a shared computer;
• an entry that keeps you signed in (its name starts with sb-), written by the Supabase sign-in library.

There are no analytics cookies and no advertising cookies. On the sign-in page, Google’s sign-in script may set cookies on Google’s own domain, under Google’s own policies. The Service itself sets none.

• In your browser: until you delete it from Settings or clear your browser’s site data.
• With an account: until you delete the account. We do not delete accounts automatically.

Deleting your account removes your account and your workspace record from the database straight away. Copies in our database provider’s routine backups, if any, are overwritten on that provider’s own schedule.

• Export: Settings → Export all data gives you your whole workspace as one JSON file. Reports lets you download your entries, or a summary per project, as CSV.
• Delete the data in this browser: Settings → Delete all data. When you are signed in, this also empties the copy in the database.
• Delete your account: Settings → Delete my account and data. This deletes your account and your workspace from the database and clears this browser’s copy.
• Ask us: write to [email protected] and we will delete your account and data, or send you a copy of what we hold about you.

Depending on where you live you may have further rights over your personal information, such as correcting it or objecting to how it is used. Write to us and we will help.

Neonfair’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, this means:

• we request only the openid, email and profile scopes (the Service receives an ID token and no access token for any Google service), and use what we receive only to provide the features described in this policy;
• we do not transfer it to others, except to Supabase to run authentication and the database for the Service, or where the law requires;
• we do not use it to serve advertisements, and we do not sell it;
• no person reads it, except as needed to run and secure the Service, to help you with a problem you ask us about, or when the law requires it;
• we do not use it to develop, improve or train any AI or machine-learning model.

Information travels between your browser and our authentication and database provider over encrypted (HTTPS) connections, and the database only lets you read and write your own workspace. No service is perfectly secure, so keep an export of anything important, and tell us at [email protected] if you think something is wrong.

Neonfair is not meant for children under 16, and we do not knowingly collect information from them. If you believe a child has signed in, write to us and we will delete the account.

If we change how the Service handles information, we will change this page and its effective date, which is currently 13 October 2026. If a change affects what we do with the information we receive from Google, we will update this page before the change takes effect.

Questions about this policy, or requests about your information: [email protected].