Circlebox Time home

Privacy Policy

Effective November 5, 2026

Circlebox LLC operates Circlebox Time, a time-tracking service offered to US residents and businesses, for users age 18 and older. This policy explains how we handle information when you visit our website or use the service.

Information we collect

• Account information: your Google account identifier, name, email address, preferred time zone, and workspace memberships. We use Google for sign-in and do not receive your Google password.
• Workspace information: customers, projects, time entries, descriptions, invitations, and membership information entered into the service.
• AI interactions: commands, voice recordings, transcripts, and clarification replies needed to process your instructions. Recordings, transcripts, and interpreted details attached to time entries are saved for your later review.
• Billing and operational information: purchase and subscription records, payment status, AI allowance usage, provider usage measurements, and technical information used to operate and secure the service. Our hosting and service providers may process IP addresses and request logs. Stripe collects your billing address and payment details through its hosted payment pages and saves the address to your workspace’s Stripe customer record for billing and customer location purposes. Circlebox Time does not collect full card numbers in its own forms or copy the billing address into its application database.
• Diagnostics and usage information: error reports and performance measurements from the website and app, such as page load time, failed requests, and browser and device type, recorded without account identifiers; and aggregate counts drawn from account and workspace records, such as how many workspaces were active in a week. Diagnostic records do not retain full IP addresses.
• Support communications: information you send to our helpdesk.

How we use information

We use information to authenticate accounts, track and report time, manage workspaces and invitations, process AI instructions, administer payments and usage allowances, respond to support requests, investigate problems, prevent abuse, and meet legal obligations. We also use diagnostics and aggregate usage information to keep the service reliable and secure and to decide what to build. Signup and confirmed-purchase notifications may be sent to our support team.

Voice and AI processing

When you send a voice command, audio passes through our server to OpenAI for transcription. Typed commands and transcripts are sent to OpenAI for interpretation, together with relevant context such as your time zone and information needed to resolve your instruction. Spoken assistant replies also use OpenAI.

When you dictate into a time entry, we save the recording in private storage and retain its transcript and interpretation with the entry. You can play it back during review. Uploading a recording does not depend on successful AI processing. Legacy command conversations remain in the active browser session.

OpenAI states that API data is not used for model training by default. Its retention rules apply separately from ours. We disable response storage for command interpretation, but that does not disable separate provider abuse-monitoring retention. See OpenAI’s API data controls.

Service providers and other disclosures

We use Microsoft Azure for hosting, database, and diagnostic monitoring (Azure Monitor and Application Insights), Google for authentication, OpenAI for AI processing, Stripe for billing, and SendGrid for email delivery. These providers receive information needed for their respective services. Our use of Google Analytics is described below. Provider processing may occur in the United States or other locations where providers operate.

Workspace administrators can manage membership, view member information, and administer workspace billing. Current time reports show each user’s own time. Authorized Circlebox personnel may access information when needed to provide support, maintain the service, or investigate abuse.

We may disclose information to comply with legal requirements, protect people or the service, or in connection with a merger, acquisition, or business transfer subject to applicable protections.

Cookies, preferences, and analytics

We use cookies for sign-in and request security, and browser storage for preferences such as spoken assistant replies.

Diagnostics. We measure errors and performance with Azure Application Insights, on public pages and inside the signed-in app. It sets no cookies and stores no persistent identifier, so we cannot follow a device or person from one visit to the next, and it is not linked to your account. Page addresses are reduced to a general route, such as the customer page rather than a specific customer, and exclude query strings, invitation links, names, time entries, recordings, and command content. Error messages are shortened before they are sent. See Microsoft’s Privacy Statement.

Marketing analytics. We use Google Analytics to automatically collect signed-out homepage views, homepage sign-in clicks, and new-account signup events, so we can tell whether people find and try the service. Analytics loads without a consent prompt, but it does not load if your browser sends a Global Privacy Control signal. Google Analytics uses analytics cookies and processes device or network information. Our integration supplies limited campaign and referral information and does not send account identifiers, email addresses, time entries, workspace/customer identifiers, recordings, or command content. Google signals and advertising personalization are disabled in our configuration. Browser cookie settings and tracking blockers may limit collection. See Google’s Privacy Policy.

How long information remains

Account and workspace information remains while needed to provide the service, subject to deletion requests and applicable retention obligations. We may retain records needed for billing, security, legal compliance, or resolving disputes.

Entry recordings, transcripts, and interpretations remain with workspace information until deleted, subject to retention obligations. You can delete individual recordings on entries that have not been billed. Content-free AI accounting records currently have no automatic expiration. Diagnostic records are kept for 90 days, Google Analytics keeps event data for two months and analytics cookie identifiers for up to 14 months after your most recent visit.

Our Azure SQL database is configured with a 35-day point-in-time recovery window and no long-term backup retention. Supporting backup files can remain beyond the recovery window, and deleted information may remain in backups until those copies expire. Provider records follow provider retention rules. Deletion from active systems does not mean immediate removal from every backup or third-party system.

Your choices and requests

You can use manual time tracking without sending commands to OpenAI, type instead of recording, and review or delete saved recordings before billing. Microphone permission is controlled by your browser. You can edit your time entries and account time zone in the app. Sending a Global Privacy Control signal from your browser stops Google Analytics from loading; diagnostics use no cookies and do not identify you.

To request access to, correction of, or deletion of your personal information, contact helpdesk@circlebox.com. We may verify your identity and will respond as required by applicable law. The app does not currently provide a self-service account export or deletion tool. Requests involving shared workspace information may require coordination with its administrator and protection of other people’s information.

Privacy rights, exceptions, and response requirements depend on applicable law. We do not require you to waive rights that cannot legally be waived.

Security and children

We use access controls and other safeguards to protect information, but no online service can guarantee absolute security. Circlebox Time is intended for adults age 18 and older. If you believe a child has provided personal information, contact us.

Changes to this policy

We will publish updates here with a revised effective date and provide additional notice when required by applicable law.

Contact Circlebox LLC