The fine print

Privacy.

Last updated 14 October 2026

In one line

No ads, no cookies, no accounts, and your pay data stays yours. It lives on your phone or in your browser, and on iPhone in a private backup in your own iCloud that we can’t read. The iPhone app sends anonymous usage milestones so we can see which parts of the app get used, and you can switch them off. Exactly what they carry, and what happens to them, is below.

Who this policy is from

TimeMachine is an APA pay and timesheet calculator for UK commercial crew, available on the web and as an iPhone app on the App Store, built and run by a single developer in the UK. If you need to get hold of a real person about anything below, the email is feedback@timemachineapp.co.uk.

What we collect

There’s no account to create, no sign-up form and no “tell us about yourself” flow. We never receive your name, your email address, your rates, your hours or anything you type into the app.

Three things do reach us, or the services we use, and each is described in full below:

What you put into TimeMachine

As you use the app you’ll enter things like your name, role, day rate, bank details, productions you’ve worked on, the hours you logged, and notes you wrote. All of this is stored locally on your device - in your browser’s storage when you use the web app, or in the app’s own on-device storage on iPhone. The only copy that ever leaves the device is the iPhone app’s daily backup, which goes to your own private iCloud (see below) - your storage, visible to no one else, including us. There is no copy on any server controlled by TimeMachine, because there are no servers controlled by TimeMachine.

Practically, this means:

On-device AI (the call-sheet reader)

On iPhone, TimeMachine can read a call sheet you import - a PDF, a photo, or something shared in from Mail or WhatsApp - and pre-fill a new shoot’s invoicing details (production company, job reference, invoicing email, address). This runs entirely on your device, on any iPhone that runs TimeMachine, and where Apple Intelligence is switched on it also uses Apple’s on-device model. The call sheet and everything read from it stay on your phone; nothing is uploaded to TimeMachine or to anyone else, and there is no server in the loop. You review every field on screen before any of it is saved, and the document you imported isn’t kept unless you choose to save the shoot.

Apple Health (the step counter)

On iPhone, TimeMachine can read your step count from Apple Health - with your permission, asked for through the standard Health access sheet - to show walking stats for your shoot days: steps between call and wrap, and what a day paid per thousand of them. That is the only thing it reads and the only thing the steps are used for. The counting happens entirely on your device: step data is never transmitted, never collected by TimeMachine, and never stored anywhere other than your phone. You can revoke access at any time in the Health app or in iOS Settings, and the app simply carries on without the stats.

Siri

When you ask Siri a question, Siri handles it under Apple’s own privacy terms, and TimeMachine itself sends nothing.

Cookies, analytics, trackers

TimeMachine sets no cookies: not on the website, not in the web app, not in the iPhone app. The website and the web app load no analytics, advertising or tracking scripts, and apart from fetching their own pages from our web host they send nothing, to anyone. You can check this in your browser’s developer tools.

The iPhone app uses one analytics service, Aptabase, for the usage milestones described next. The app itself sends nothing else about how you use it.

Anonymous milestones, on iPhone only

The iPhone app can send a signal when you pass a milestone - your first shoot, your fifth, your twenty-fifth, your first invoice sent, the first time you use the call sheet reader or share a timesheet. It tells me which parts of the app people actually reach. From version 2026.14 a milestone also carries which department you work in, picked from the app’s own list (never a job title or a role), and the first ones carry how long it took you to get there in rough bands: the same day, within a week, within a month, later. The app also sends whether it was used in two or four separate weeks, and a signal when it opens and when it closes, so sessions can be counted, and one when you copy a breakdown as text. When you set up invoicing it sends how you chose to invoice (from TimeMachine, Xero, QuickBooks, CSV or not at all, or that you closed it), which step it was closed at if you left it part way, and that you started and finished setting it up. There are forty-two of these and that is the entire list.

What is never sent: your name, anyone else’s name, any figure or rate, any date, any job or production title, any client, any note, any bank detail. Not trimmed, not shortened, not hashed - never sent. The app carries a fixed list of what it is permitted to send, and anything not on that list is dropped whole rather than cleaned up and let through. A milestone carries the fact that it happened, never the number that triggered it: “someone reached five shoots”, never “this person has seven”.

There is no identifier. No account, no device id, no advertising id, nothing stored on your phone to recognise you by. The app does keep a short list of which milestones it has already sent - just the names, like “shoot_5” - so each one is counted once rather than every time you open the app, and a short list of the weeks it was opened in, at most eight, for the active-weeks milestones. Neither says anything about you or your work, neither is an identifier, and both only ever leave your phone inside your own backup. The milestones cannot be tied back to you, and they cannot be joined up with anything else about you.

They go to Aptabase, an analytics service that stores them on servers in the EU. With each one the app sends the time it was sent, a session number that exists only while the app is running, your phone’s language setting (such as en-GB), the version of the app and of its analytics code, and whether it’s a test build. The signal for a new job also carries whether it’s commercials or long form. Beyond that, a signal can carry only the department, the band, or the invoicing choice and step described above, each from a fixed list in the app.

What Aptabase works out and keeps. Like any request on the internet, each signal reaches Aptabase with your phone’s IP address and its browser identification, the user agent. From these, Aptabase works out three things and stores them with the signal: the country and region it came from, such as the United Kingdom and England (Aptabase leaves the city blank); that it came from iOS; and a daily code, made one-way from the IP address and user agent with a secret that changes every day, so it can count how many phones used the app that day.

Aptabase holds the IP address and user agent in memory for a few seconds while it works these out, and never stores them. Each day’s secret is deleted within 48 hours, after which the code can’t be turned back into an address or matched from one day to the next, by us or by Aptabase. Aptabase keeps the signals for up to five years, and signals from test builds for six months. It sets no cookie and writes nothing to your phone. Their privacy policy.

Coarse location. In the terms of Apple’s App Store privacy labels, a country and region is coarse location. It is collected for analytics, not linked to you, and not used for tracking.

Can any of this identify you? Not on its own. There’s no name, no account, no device id and no advertising id, and the daily code can’t be linked from one day to the next. A department is shared with many crew, and a country and region cover many people. We never try to identify anyone, and we couldn’t match the signals with anything else, because we hold nothing else about you.

What they’re used for. Deciding what to build and what to keep: which features get used, and whether people come back. They’re never used for advertising, never sold, never shared with anyone else and never combined with other data.

It is on by default, and you can turn it off in one tap. A new install asks once, as a switch on the last page of setup, before anything is sent, and the switch lives permanently in Settings → Privacy. Turning it off stops everything immediately. None of this exists in the web version, which has no analytics of any kind.

Our website and its links

The website and the web app are hosted by Netlify. Like any web host, Netlify keeps standard server logs of each request: the IP address, the browser’s identification, the page asked for and the time. We use them only for visitor numbers, which Netlify shows us as totals; we never see who a visitor is. Netlify keeps the logs under its own privacy policy.

The App Store links on this site, and the one in our Instagram bio, carry a campaign name, such as website, articles or welcome-sticker, so Apple can tell us how many downloads came from each place. The name is part of the link and nothing more: the site sets nothing and stores nothing on your device. Apple does the counting, under its own privacy policy, and shows us totals only.

On iPhone (the App Store)

The iPhone version works the same way - your data stays in your hands, on the phone and in your own private iCloud backup, and TimeMachine has no server. One Apple-side thing worth knowing: the App Store handles the download and any standard account information under Apple’s own privacy policy. And if you’re ever running a beta build through TestFlight, Apple additionally collects information about your device and how the beta performs, including crash logs, and may share that with us under Apple’s TestFlight terms - that is Apple’s processing, not the app’s, and only on beta builds. Either way, the only thing the app itself sends is the usage milestones described above, and only while they’re switched on.

If you email us

If you contact feedback@timemachineapp.co.uk, the email itself is held by the email provider that powers that address. The email is kept long enough to reply and resolve whatever you wrote about, and then either retained for ongoing context or deleted on request.

Sharing

We don’t sell data, show ads, or pass anything to advertisers or data brokers. The only services that receive anything are the ones named on this page - Aptabase for the usage milestones, Netlify for the website’s server logs, and Apple for the App Store and TestFlight - each only as described above. Your pay data never reaches us, so it can’t be used to train models or be handed to anyone on request. Only you have it.

Your rights under UK GDPR

UK data protection law gives you rights over personal data held about you (access, rectification, erasure, portability, restriction, objection). We hold no account or profile about you. The usage milestones can’t be linked to a person, and the server logs are Netlify’s, which show us only totals, so there’s usually nothing we can find about you. You can object to the milestones at any time by switching them off in Settings → Privacy.

If you’ve emailed us and want to know what we hold from that exchange, or want it deleted, write back to the same address and we’ll handle it within 30 days.

Children

TimeMachine is a professional tool for working crew. It’s not designed for or directed at anyone under 16, and we don’t expect under-16s to be using it.

Changes to this policy

If this policy changes materially - for example, if TimeMachine ever moves to a cloud-sync model (it has no plans to) - the change will be announced in-app and the date at the top of this page will update. The current version stays available in the project’s git history.

Contact

Real person, real inbox: feedback@timemachineapp.co.uk.

If you’re ever unhappy with how a question got answered, you can also complain to the UK’s data protection regulator, the Information Commissioner’s Office, at ico.org.uk.