Qubeq Work Tracker privacy policy

The Qubeq Work Tracker is a browser extension for people who work in a Qubeq workspace. It records work sessions that the person starts and stops, and sends them to that person's work diary in Qubeq. This policy covers the extension. The rest of Qubeq is covered by the Qubeq privacy policy.

Several parts below happen only when the workspace's owner or an admin switches them on in Qubeq. Those parts say so.

When it records

Nothing is recorded until the person signs in to the extension and presses Start work, and only in a workspace whose owner or admin has switched the work tracker on.
When the workspace records time per website (see below), Start work first asks for the browser's “Read your browsing history” permission, and a session does not start without it. When the workspace turns on detailed activity or site blocking (see below), Start work first asks for access to the websites you visit, for the same reason.
The person can pause and resume a session. While it is paused, no screenshot is taken and no time is counted as work.
A session ends when the person presses Stop, stops sharing in the browser, or closes the browser. After the workspace's idle limit (10 minutes unless an admin changes it) the session pauses and asks the person whether to resume or to drop the idle minutes, or it stops, if the workspace chose that. A session paused for longer than the workspace's limit (60 minutes unless an admin changes it) ends.
The browser shows its own screen-sharing indicator for as long as a session runs.

What it collects during a session

Screenshots at random moments: about as many in every ten-minute slot as the workspace sets, from one to ten, or as an owner or admin sets for one person. Each minute has its own chance, so a slot can have more or fewer than that number, never more than ten, and a slot with none by its last minute gets one then. Each is of a screen, window or tab the person chose in the browser's share picker; a person can share up to three screens, and each is pictured at the same moment. Screenshots are reduced to at most 1,280 pixels wide. If the workspace asks, they are blurred on the computer before they are sent, and only a whole screen can be shared, not a window or a tab.
With each screenshot, a copy shrunk to 32 by 18 grey squares, which Qubeq compares with the one before it to flag ten minutes whose screen did not change while the computer was in use.
Whether the computer is in use or idle. It counts as idle 15 seconds after the last keyboard or mouse input. The time is added up for each ten-minute slot as active, idle and paused time.
If the workspace asks, the answer the person types to “What are you working on?” in the extension, kept with each ten-minute slot.
When each session started and ended, and why it ended.

Time per website (only when the workspace switches it on)

While the computer is in use: the website and page in front, and for how long. For example example.com/orders. The part of an address after “?” or “#”, where searches and form entries usually are, is never kept. A page that is not a website, such as the browser's own settings, is kept only as its kind.
The page's title, only if the workspace also switches titles on.
Time the computer is in use while no browser window is in front, as “outside the browser”, without what was in front instead — unless the workspace also switches on reading the app or site name from a screenshot (below).
Private (incognito) windows are not seen, unless the person allows the extension in them in the browser's settings.
Owners and admins can label sites productive, unproductive, or a call site. Qubeq uses the labels to show productive time and focus time in the diary.

Reading the app or site name from a screenshot (only when the workspace switches it on)

When a screenshot is taken while another program — or another browser — is in front, so the person is not on a tab this extension can see, the extension also keeps the sharp top of each screen (the address bar and the window titles) and sends it. It is not sent for a blurred screenshot, and not while a window of this browser is in front.
On Qubeq's server the app's or site's name is read from that strip and only the name is kept — for example “Roblox” or youtube.com. The text that was read is not kept, and the strip is deleted once it is read.
The names appear in the person's Work diary as “apps and sites outside the browser”. Owners and admins see them; a person sees their own only when the workspace turns that on.

A screenshot on request (only when the workspace switches it on)

Someone who may open the person's work diary can ask for one extra screenshot while a session is running, shared and not paused. It is taken within a minute, like any other screenshot, and shows the same notification with the same Delete these ten minutes button.
Every request is written to the workspace's audit log.

Live view (only when the workspace switches it on)

Someone who may open the person's work diary can watch the person's first shared screen while a session is running and not paused. While they watch, the extension sends a frame every five seconds, blurred first if the workspace blurs screenshots.
Live frames are never saved to disk. Qubeq's server keeps only the newest one, in its memory, and never shows one older than 30 seconds. The extension stops sending soon after the viewer closes the view.
For as long as someone watches, the extension shows a notification saying the screen is being viewed live, and its window says so too. Each time someone starts watching, it is written to the workspace's audit log.

Time-lapse (only when the workspace switches it on)

While a session is running and not paused, a frame of the person's first shared screen every 30 seconds, blurred first if the workspace blurs screenshots. The frames are stored like screenshots and can be played through in the work diary.
Deleting ten minutes does not delete the time-lapse frames from them. They are deleted with the retention period (below).

A photo at the first Start of the day (only when the workspace switches it on)

The first Start work of the day opens a window from the extension that asks the browser for the camera, shows the picture, and takes a photo after a moment or when the person presses Take photo. The photo is shown first, with Use this photo and Retake. Only the photo the person uses — or, after ten seconds with no answer, the one on screen — is sent to Qubeq; a photo they retake is never sent.
The session starts either way. With Start without a photo, a refused camera or no camera, no photo is taken, and the diary shows “No photo” with that reason.
The camera is used for nothing else, and the microphone is never asked for.
An owner or admin can delete a day's photo; the diary then says it was deleted, and no other photo is asked for that day.

Searching the text in screenshots (only when the workspace switches it on)

On Qubeq's server, the text in each screenshot is read and kept with the screenshot, so someone who may open the person's work diary can search for a word and find the screenshots that showed it.
The text is deleted with its screenshot, when the slot is deleted or the retention period ends. Every search is written to the workspace's audit log.

Detailed activity (only when the workspace switches it on)

A small script the extension puts into the web pages you visit while a session runs counts, each second, how many keys you pressed and how many times you clicked, scrolled or moved the mouse. It sends those counts to Qubeq, so how active each ten minutes was can be measured inside web pages as well as from the whole computer.
It counts only. It never records which key was pressed, what was typed, what was clicked, where the pointer was, or anything on the page. A held-down key counts as one press.
With the counts it sends which kinds of input each second had — a key, the mouse, a click or a scroll — so Qubeq can notice the pointer being moved by a program at evenly spaced moments. Those seconds are deleted once Qubeq has checked them, at most a day later; what stays is how many minutes of each ten looked like that.
This needs access to the websites you visit, which Start work asks for. It runs only while a session is running, and only when the workspace has detailed activity switched on.

Blocking distracting sites (only when the workspace switches it on)

The workspace's owner or an admin can list sites that stay closed while a work session is running and not paused. The extension stops those addresses, and their subdomains, from loading; opening one shows a Qubeq page instead.
To do this the extension needs access to the websites you visit, which Start work asks for. It reads nothing on any page: it only keeps the listed addresses from opening while a session runs.

The time on the screen edge (while a session runs)

While a session runs, the extension shows a small icon with today's tracked time on the right edge of the web page in front. Its rim marks the minutes of the current ten minutes as active or idle, from the time the extension already counts. Clicking it opens the extension's own window beside it; it can be dragged up or down, hidden to a thin tab, or switched off in that window.
It only draws. It reads nothing on the page and sends nothing anywhere.
It uses the same access to the websites you visit that detailed activity uses. Where that has not been allowed, the icon does not appear until the person switches it on in the extension window, which asks for it then. The workspace's owner or an admin can switch the icon off for everyone.

What stays on the computer

When the workspace records time per website and counts calls, the extension checks which tabs are playing sound. While a video-call site plays sound, idle time counts as active, because nobody types in a meeting. Only that effect on the active time reaches Qubeq.
If the workspace asks, a reminder to start work once the person's working hours have begun, and a reminder after some minutes on a site labelled unproductive. Both are notifications on the computer; Qubeq is not told that they were shown.

Outside a session

If the workspace asks to be told when a tracker goes quiet, a signed-in browser with no session running tells Qubeq once a minute, inside the person's working hours, that it is still there. It sends nothing else.
When the extension is removed, the browser opens a Qubeq page. That page marks the browser as removed, ends a session it was running, and, if the workspace asks, tells the owners and admins.

What it collects when signing in

The Qubeq email and password, and the authenticator code if the account uses one, are sent once to Qubeq to connect the browser. The extension does not store the password.
The extension then keeps a device key in the browser's extension storage and uses it for what it sends.
A device name made of the browser and the operating system, for example “Chrome on Windows”, so the device can be recognised.

What it does not collect

Keystrokes or anything typed other than the answer to “What are you working on?”, mouse clicks, page contents, searches, audio, or the microphone. The camera is used only for the photo at the first Start of the day, when the workspace switches it on (above). The extension does not watch which programs are running: an app or site name is read only from a screenshot, on the server, and only when the workspace switches that on (above).
Website addresses and page titles, unless the workspace switches time per website (and titles) on and the person allows it at Start work.
Unless the workspace switches on detailed activity or the time icon has access to the websites you visit, the extension runs no code inside web pages, and unless it switches on time per website, detailed activity or site blocking, or the time icon is allowed, the extension has no access to websites other than Qubeq's own server. Even then, the scripts in a page count input events or draw the time icon; they never read what is on the page or what is typed.

How it is used

To show the work diary in Qubeq: the ten-minute slots, the active, idle and paused time, the answers to “What are you working on?”, the screenshots, and the time per website with the productive and focus time worked out from it.
To tell the workspace's owners and admins what the workspace has asked to be told (below).
When the workspace switches them on, to let someone who may open the person's diary ask for a screenshot or watch the shared screen live, as described above.
It is not added to timesheets, payroll or invoices.
Qubeq does not sell it, does not use it for advertising, and does not use it for anything else.

What owners and admins are told (each only when the workspace switches it on)

That someone removed the tracker, or that it went quiet during a session or in their working hours.
That someone with the tracker installed has not started work a set number of minutes into their working hours.
In the diary: ten minutes whose screen did not change while the keyboard or mouse was in use.

Where it is kept

It is sent over HTTPS to Qubeq's server and stored with the workspace's other Qubeq data.
Screenshots, time-lapse frames and photos are not public: opening one requires signing in to Qubeq with an account allowed to see it.

Who can see it

The person it belongs to.
The workspace's owner and admins, and anyone an admin gives the work tracker permission to.
Every time someone opens another person's diary, screenshot, time-lapse frame or photo, asks for a screenshot, starts watching live, or searches the text in screenshots, it is written to the workspace's audit log.

How long it is kept

Screenshots, with their grey copies and the text read from them, time-lapse frames, and photos at Start are deleted automatically once they are older than the workspace's retention period: 30 days, unless an admin sets a different number of days. The time, the answers to “What are you working on?” and the time per website stay in the diary without the pictures.

Deleting it and stopping it

After each screenshot the extension shows a notification with a Delete these ten minutes button. Pressing it deletes that ten-minute slot: its screenshots, its time, its answer and its time per website. Time-lapse frames from those minutes stay until the retention period ends.
In the work diary, a person can delete their own slots from the start of the current week. Owners and admins can delete any slot, or remove a single screenshot.
Signing out in the extension stops any running session and removes the device key from the browser. Removing the extension stops it altogether.

Terms of use

It is provided only for use with a Qubeq workspace, by the people that workspace adds, and may be installed and used for that purpose only.
You may not copy, modify, decompile or reverse engineer it; publish or redistribute it, in an extension store or anywhere else; or use it or any part of its code to make another product — except where the law allows this whatever these terms say.
To report a copy: hello@qubeq.com.

Contact

Questions about this policy, or a request about data the extension has sent: hello@qubeq.com. A request can also be made to the owner of the workspace the data belongs to.

Changes

If what the extension collects changes, this page changes with it and the effective date at the top is updated.