ArchaLaw Timer is a Chrome extension built for ArchaLaw staff to track billable time against client matters without leaving the page they are working on. This policy describes what data the extension handles.
What the extension does
The extension lets a signed-in ArchaLaw team member start, pause, and stop a time entry against a matter. All timer state lives on the firm's own server at app.archalaw.cloud — the extension only displays and controls it. There is no independent timer logic inside the extension itself.
Data we collect
- Personally identifiable information: the user's email address, obtained through Google sign-in (chrome.identity), used to identify the signed-in team member.
- Authentication information: an OAuth access token, used to authenticate the extension's requests to the firm's own API and cached locally (chrome.storage) so the user is not asked to sign in on every use.
We do not collect health information, financial or payment information, personal communications, location data, web browsing history, user activity (clicks, keystrokes, mouse movement), or the content of any web page. The extension has no content scripts and communicates with exactly one host: app.archalaw.cloud.
How we use this data
The email address and authentication token are used solely to authenticate the signed-in user and to read, start, pause, and stop their own time entries through the firm's API. Nothing is used for advertising, profiling, or any purpose unrelated to time tracking.
Data sharing
We do not sell or transfer user data to third parties. Data collected by the extension is sent only to app.archalaw.cloud, the firm's own billing system, and is not shared with any other party. We do not use this data to determine creditworthiness or for lending purposes.
Data retention
The authentication token is kept in the browser's local extension storage until the user signs out or revokes access. Time entries themselves are retained on the firm's server under the firm's normal recordkeeping practices for client billing.
Remote code
This extension does not execute any remote code. All logic ships inside the installed package; there is no eval of remote strings and no dynamically loaded or remotely fetched script.
Permissions
- identity — to sign in with the user's Google Workspace account and obtain an authentication token.
- storage — to cache that token locally between uses.
- alarms — to refresh the toolbar badge with the running timer's elapsed time approximately once a minute.
- host permission (https://app.archalaw.cloud/*) — the single host the extension talks to, to read and control the user's timer.
Contact
Questions about this policy can be sent to david@archalaw.com.