Trust center
Last updated October 9, 2026
Privacy policy
This policy explains what data SOWLedger collects, how we use it, how we handle third-party integrations like Google Calendar and QuickBooks, and what rights you have over your data.
Summary
SOWLedger stores your work records, encrypted integration credentials, and hashed API keys. Stripe handles payments. Connected services exchange the data needed for the features you authorize. You can export records in the app or contact support to request deletion.
What we collect
We store your account email and display name, workspace settings, client and project records, time entries, scheduled work, billing identifiers, API key details, and messages you send to support. When you connect a service such as Google Calendar or QuickBooks, we also store encrypted credentials for the permissions you authorize.
How we use it
We use workspace data to provide scheduling, timers, completed work logging, analytics, exports, invoices, API access, support, security monitoring, and billing operations. Google Calendar data is used exclusively to sync scheduled work blocks and import busy events to prevent double-booking. QuickBooks data is used exclusively to export the SOWLedger invoices you choose to send. We do not use third-party integration data for advertising, profiling, or any purpose beyond delivering the features you connect.
Third-party integrations
Google Calendar connections request calendar event read/write access. Slack connections use incoming webhooks. QuickBooks connections request its accounting permission for invoice sync. Owners and managers can disconnect a service from Integrations, which disables the connection and removes its stored credentials from SOWLedger. To revoke the provider's authorization as well, remove SOWLedger in that provider's account settings.
What we do not store
API key secrets are shown once and stored only as hashes. Stripe handles payment card details. SOWLedger stores the work records and connection details needed for sync, rather than complete raw Google or QuickBooks API responses.
Data sharing
We do not sell or rent your workspace data or integration credentials. Data is shared with infrastructure providers to operate SOWLedger, with Stripe for payments, and with the connected services you choose to use. No workspace data is used for training machine learning models.
Data security
Stored integration credentials are encrypted with AES-256-GCM, and API keys are stored as one-way hashes. Workspace membership, roles, and API permissions control access to records and actions. Sensitive settings require manager or owner access; subscription changes require an owner.
Data exports and portability
Workspace owners and managers can export records in CSV or JSON. Exports exclude secrets and include a SHA-256 checksum. Review files before sharing them: a JSON export can include workspace records beyond a filtered set of time entries. You own your workspace data and can contact support to request a full export or deletion.
Your rights
You may access, correct, export, or request deletion of your personal data by contacting support. If you are in the EU, UK, or California, you have additional rights under GDPR, UK GDPR, and CCPA respectively, including the right to object to processing and the right to data portability. We will respond to verified requests within 30 days.
Retention
Operational records stay available until deleted through product workflows or by a verified workspace request. After account deletion, data is purged within 30 days, subject to legal, billing, and security obligations.
Changes to this policy
We may update this privacy notice from time to time. Material changes will be communicated via email to workspace owners before they take effect. Continued use of the service after notice constitutes acceptance.
Contact
Privacy questions can be sent through the contact page or emailed to privacy@sowledger.com. Include the workspace name and the email tied to your account.
Privacy questions
Include your workspace name and account email. Do not include API keys or card data.