Privacy Policy
33International is a time-tracking service for software teams. It records how long you work, and writes that time to your own Jira issues as worklogs. This page says exactly what it stores, where it goes, and how to get rid of it.
What we store
Your account
Your email address and display name, from when you register. A time zone, so hours land on the
right day. A role (member or admin).
Your Atlassian connection
When you link Jira, we store your Atlassian account id, your site's cloud id and URL, and the OAuth access and refresh tokens Atlassian issues us. Those tokens are encrypted at rest and are never returned by any endpoint — not to an administrator, and not to you. They are used to read issues and write worklogs you asked for. If you separately enable standup publishing, they also create Confluence pages and Jira comments on your behalf.
Your work records
Tracking sessions (the issue key, when the timer started and stopped, and how many seconds were credited), the periodic heartbeats that credit them, any progress notes you write, manual time claims, expense claims, and amendments to stopped sessions. A manual time claim includes its start and end, issue, reason, submitter, and review decision. An amendment record keeps the before and after values, the reason, who made the change, and when.
Timer sessions are credited from elapsed wall clock. A person or their agent can instead submit a manual time claim for a start and end when the timer missed work. The claim is inert until an admin who is a human other than its submitter reviews and approves it. Only then can it count as payable time. Corrections to stopped sessions leave an audit trail; they can reduce recorded time or correct its description and issue, but cannot add time to a timer session.
Screenshots and app usage — off unless you turn them on
The service can capture periodic screenshots and a record of which applications were in use. Both are disabled by default and record nothing until you have been shown the policy and explicitly accepted it. Screenshots are never sent to Atlassian, and both they and their index rows are deleted after 30 days.
Sign-in and security records
Each company has a record of security-relevant events: sign-ins, invitations sent and accepted, role changes, members removed, tokens created or revoked, and password changes. Each entry holds what happened, who did it, the time, and the network address and browser description of the request. Company admins can read their own company's record; nobody can edit it. Entries are kept for at least 400 days.
Credentials
Agent tokens and browser session tokens are stored only as hashes, alongside a label and a last-used timestamp. A copy of our database yields nothing anyone could sign in with.
What we send to Atlassian
Worklogs contain an amount of time, a start time, and a comment assembled from the task name and progress notes you wrote — posted to the issue you named. We do not create, edit, transition or delete issues, and we do not send screenshots, app usage or expense data to Atlassian.
If you grant the separate standup consent in Settings, 33International publishes standups as a Confluence page and a comment on each Jira issue included in that standup. This happens in two ways: from the sections you or your agent submit, and automatically once your day has settled — which means an hour has passed with no timer running, or your local day has ended, whichever comes first. An automatic standup contains only what the service already recorded: the issues you tracked, your task names, your progress notes, linked commits, and any manual time claims you submitted that are still unapproved, which are published under a label marking them as claims rather than observed work. It is assembled without composing any wording of its own, and Human Notes is left empty because no person wrote it. You or your agent may replace an automatic page afterwards, and it is then never rewritten automatically again.
Atlassian shows those pages and comments as authored by you because they use your connection. The page discloses that 33International generated it from your tracked work and names the generator you supplied. App usage, screenshots, and notes you did not include are not published. You can withdraw this consent without unlinking Jira; withdrawing it blocks every later standup post, automatic ones included.
Anything we can read in Jira is bounded by your own Jira permissions. Linking your account gives 33International no access you do not already have.
What we do not do
- We do not sell or rent personal data, and there is no advertising.
- We do not run third-party analytics or tracking scripts.
- We do not use your data to train machine-learning models.
- We do not share data with anyone beyond the processors named below.
Who processes it
- Google Cloud — the service runs on a single virtual machine in
australia-southeast1(Sydney). All application data lives there, plus daily disk snapshots in the same region. - Atlassian — for the Jira account you link, on your instruction.
- An email provider — where the operator has configured one, to deliver invitations and account messages (verification, password reset). It sees the recipient's address and the message.
- Sentry — where the operator has configured it, to receive error reports. Reports are scrubbed of cookies, tokens, email addresses, request bodies and URL query strings before they leave the server.
Identity and passwords are handled by FusionAuth, which we run ourselves on the same machine. We never see your password.
How long we keep it
- Screenshots and app-usage records: 30 days, then deleted automatically.
- Sessions, notes, manual time claims, amendment records, and expense claims: for as long as your account exists.
- Issued invoices: retained as financial records even after an account is deleted. An invoice is a record of something that happened; deleting the account does not unmake it.
Your choices
- Unlink Jira at any time from Settings. We delete the stored Atlassian tokens immediately; you can also revoke our access from your Atlassian account.
- Revoke an agent token from Settings. It stops working at once.
- Turn off monitoring from Settings, if it was ever enabled.
- Withdraw standup publishing consent from Settings. Existing pages and comments remain in Atlassian, but 33International will not create or update another one.
- Get a copy, or have your data deleted — email the address at the top. We will respond within 30 days.
Changes
If this policy changes materially, we will say so on this page and update the date above.