Privacy policy

1. Scope and contact

This policy covers the current locally run Trainer OT Tracker and the public Longkang Tools information pages. The tool and pages are maintained by Darryl Wang. Contact: darryl.wang@activa.sg.

The tracker is intended for authorised internal use. Access through a personal Google account does not replace the organisation's permission to process staff information. Other future tools require their own appropriate privacy information; this policy does not automatically describe them.

2. Google access and information processed

Google OAuth is used on the operator's computer to authorise the tracker. The requested scope is https://www.googleapis.com/auth/drive.readonly. This scope allows viewing and downloading all files visible to the account. The current implementation requests metadata and an Excel export only for the configured spreadsheet ID; it does not scan unrelated Drive files.

The spreadsheet export may include trainer names, work dates, site assignments, employment-classification information and other contents of its worksheets. The tracker uses the roster information needed to calculate overtime hours and report amounts. The generated report retains the exported roster tabs in addition to its overtime summary.

The tracker does not edit, delete or upload Google Drive files, change sharing permissions, or automatically approve or submit payroll. Google processes the sign-in and API requests under its own policies. See Google's Privacy Policy.

3. Local storage and retention

The exported workbook is processed in memory; the tracker does not separately save a raw download. It does save the resulting workbook, which contains a copy of the roster, to the operator's selected output folder.

OAuth account tokens, including a refresh token when supplied by Google, are saved locally to allow later runs without repeating consent. By default, the Desktop OAuth configuration and token are stored in the operator's private .trainer-ot-tracker folder. They are not sent to this website. The tracker does not itself encrypt local reports or token files; their protection depends on the computer's access controls, device security and storage choices.

Retention is controlled by the operator and applicable organisational requirements. The current tracker has no automatic deletion schedule. Reports and tokens remain until removed or managed by the operator; local backups or cloud-synchronised folders may retain additional copies. Keep credentials and reports out of shared or publicly accessible folders.

4. Use, sharing and Google Limited Use

Google user data is used only to provide the roster-reading and overtime-reporting functions described here. It is not sold, used for advertising, or used to train general-purpose AI or machine-learning models by this application. The current application does not send roster contents or OAuth tokens to the website maintainer, Cloudflare, an AI service or a separate application server.

Network requests required for authorisation and roster access go to Google. The operator may manually share reports for authorised operational or payroll review and is responsible for using appropriate recipients and secure channels. Locally configured backup/sync software is outside the tracker's control.

The use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

5. This website and Cloudflare hosting

The public website serves descriptions and privacy information. It has no Google sign-in feature, roster-upload form, payment form, advertising scripts or application-level analytics. Its pages use local styles and system fonts rather than third-party font requests.

Cloudflare hosts and delivers the site. Normal website requests expose information such as IP address, requested URL, browser information and request time to the hosting provider. Cloudflare may process request/security logs and use platform security cookies or challenges depending on the hosting configuration. This policy does not claim that visiting the site produces no hosting logs. See Cloudflare's Privacy Policy.

Clicking the support email link opens your email application. If you contact support, your email address and the message you send will be processed through the relevant email services to respond to your enquiry. Do not include tokens, OAuth configuration files or unnecessary staff/payroll data.

6. Access, revocation and deletion

You can revoke the tracker's account access through Google Account third-party connections. Revocation prevents continued Google access, but does not delete reports already saved on your computer.

To remove local data, manage the report copies and locally saved authorisation files on your own computer, including any backups or synced copies, subject to your organisation's retention requirements. Removing a local token alone does not revoke Google's authorisation grant. The public website cannot remotely delete files on your computer.

For questions about access, correction, deletion or other applicable privacy rights, contact darryl.wang@activa.sg. Requests about underlying staff records may need to be handled by the organisation responsible for those records. Do not send confidential records or tokens merely to identify a request.

7. Changes to this policy

Changes to the application's data handling will be reflected here with an updated revision date. Additional services, public distribution or new data uses require review of this policy before they are introduced.