1. How your work is protected
One cloud service
Clockworks is a cloud service that we operate. Your work is carried out on infrastructure under our control, and all traffic between your browser and the service is encrypted using HTTPS.
Each run is isolated
Every run is carried out in its own isolated working area, and no run can read material belonging to another. Where a task requires code to be written and executed, that code runs in a sandbox with no network access and no visibility beyond the run's own working area. The service refuses to carry out work if that sandbox is not available.
2. What we hold, and for how long
Your work
Your tasks, the results returned to you, and the record of how each result was produced. This material is retained until you delete it or ask us to. There is no automatic expiry.
Kept until deleted
Downloadable documents
Finished documents are stored so that they can be downloaded again. This storage is limited: when it is full, the files belonging to the oldest run are removed first, always as a complete set, so that a document is never left partially available. The text of a run remains readable after its files have been removed. Because the limit is one of capacity rather than time, no retention period is stated.
Kept until storage is reclaimed, oldest first
Connected systems
If you connect a Google Drive, a mailbox or a calendar, we keep the connection's description (its name, what you allowed it to do, and the folders, labels or calendars you chose) and the access Google grants. Google's approval is encrypted in your browser before it is sent, and the access token is stored encrypted, under your account alone; it is never shown on any page. Data from a connected system is used only to carry out the tasks you ask for. Disconnecting deletes the token and, when it was your last connection, revokes the approval at Google; you can also revoke it at any time at myaccount.google.com. The use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Kept until you disconnect it
Your organisation and teams
If your organisation uses Clockworks, we record which organisation and which of its teams you belong to, and your role in each, so that you see the work it shares with you and nothing else. Your organisation asks us to add or remove you; the record is deleted when you are removed or your account is deleted.
Kept until you are removed
Activity log
A record of each request made to the service, linked to your account when you are signed in: the time, the page you opened or the action you took (for example starting a run or downloading a document), whether it succeeded, how long it took, the network address it came from, and the description of itself that your browser sends with every request (its user-agent header). Requests from people who are not signed in, such as visits to the sign-in page, are recorded with their network address too. We use it to diagnose faults, to keep the service secure, and to understand how the service is used so that we can improve it. It is kept within our own service: no third-party analytics or advertising tools receive it, and nothing is placed on your device to collect it. It is deleted with your account.
Kept about 3 months
Record of your actions
A record of the significant things done with your account, kept for longer than the activity log so that questions about who did what can still be answered: each sign-in and sign-out, including failed attempts to sign in to your account; starting, answering, changing, stopping or cancelling plans and runs; saving tasks, uploading files and sending feedback; opening and downloading documents; adding, changing or removing connections; changes to your password, two-factor sign-in and settings, naming the setting and, for whether we may review your work, what it was and what it became; requests the service refused; and when Clockworks staff read your account or your work. Each entry holds the time, the space it happened in (your own, or one your organisation shares), the item concerned by its identifier, the outcome, the network address it came from and, where known, its country, and a general description of your device, such as the browser and operating system. It never contains the content of your work. Entries are linked to one another so that a changed or removed entry can be detected. When your account is deleted the entries remain, because they are also part of your organisation's record and ours, but the network address, country and device are removed from them. In a space your organisation shares, the record of what you do there is visible to Clockworks and is available to your organisation on request. You can see your own recent record in Settings.
Kept about 13 months
Cost record
For each run: when it took place, how long it took, and what it cost us to provide. It contains none of your content. It is retained for longer than the run it describes because it is our accounting record.
Kept about 13 months
Sign-in and sessions
Your password is stored only in hashed form, and each session token only as a one-way digest; a copy of our database would yield neither. A session ends after 30 days in any case, and after 1 day without use. Changing your password ends every other session immediately.
Kept 30 days
Early-access requests
If you ask for early access on our website, we hold the email address and the name you give us, and when you asked. We use them only to reply to you about access. You do not need an account to ask, and you may ask us to remove your request at any time. So that the form cannot be flooded, we also note the network address a request came from for a few hours; it is not kept with your request.
Kept about 1 year
3. What we do not hold
Neither record contains your content
The activity log and the record of your actions contain no request contents: your tasks, results and attached files are your confidential material and are not written to them. They record no query strings, which can identify your files by name, and no cookies or session tokens. Of the headers your browser sends, the activity log keeps only its description of itself, and the record of your actions only a general description of your device. The record of your actions names what you acted on by its identifier, never by its title.
No recording of your screen, keystrokes or device
The service does not use session recording, keystroke logging, mouse tracking, device fingerprinting, or advertising or analytics trackers, and it places nothing on your device to follow what you do. It records what you ask the service to do, as described above, and nothing finer.
We never collect your credentials for other services
Clockworks never asks you for a password to another service, and a request that tries to submit one is refused. If a task must sign in to an external source, we set that access up ourselves. Wherever such a credential is used it is referred to by name only: it is attached to the outgoing request at the moment of use and never appears in a prompt, in any stored record, or inside the code sandbox.
4. Use and disclosure
Review to improve the service
We may review your work (tasks, results and the system's record of its own reasoning) to identify faults and improve the service. You can switch this off in Settings. Once it is switched off, every run you submit is marked accordingly, and our operational tools show that marking to our staff. Shared work belongs to your organisation, so whether we review it is your organisation's choice, not this switch: we do not review it unless your organisation has agreed.
Your work is not shared
Your own work is never visible to another customer. If your organisation uses Clockworks, tasks it shares with its members, or with a team you belong to, are shared work: their runs and results, and any file a member gives a run that asks for one, are visible to every member of that organisation, or of that team, with the name of the member who started each run. Your work is not sold or licensed to anyone. It is sent to the service providers who carry out the work for us, such as the providers of the AI models, only for that purpose. Within Clockworks, our staff access it only to provide and support the service and, unless you have switched review off (or, for shared work, unless your organisation has agreed), to improve it.
5. Your account
Your allowance
Your allowance of runs is measured over a rolling 24 hours rather than a calendar day. Capacity is restored progressively as earlier runs leave the window, rather than resetting at a fixed time.
6. Decisions made by computer programs
The information they use
To keep accounts secure and to limit what the service costs to run, some decisions are made by our computer programs without a person being involved. They use these kinds of personal information: your account, its role and its email address; the email address entered in each attempt to sign in, the time and outcome of the attempt, and the network address it came from; the runs, plans and plan revisions your account has requested recently, and your account's allowance and status; and a saved task's description, schedule and approved plan, and your time zone. They do not use sensitive information.
The decisions they make
These decisions are made by computer programs alone: refusing to start a run, or to start or revise a plan, once your account (or, for an organisation's shared work, the organisation or team it is shared with) has used its allowance (by default 5 runs and 5 plans, counting revisions, in any 24 hours); not starting a scheduled run when its task has no approved plan or nothing to do, when it needs a new file you have not given it yet (it waits for the file), when the allowance has been used, when the account is disabled, or when starting it is refused for another reason, which is recorded; refusing sign-in, or a check of your password, for up to 15 minutes after repeated failed attempts to sign in to your account, or from the same network address, whether or not you made them; and requiring you to choose a new password before anything else when you sign in with one we gave you. Decisions to disable your account or to change its allowance are made by a person. When they make them, they use summaries our programs prepare from the account's recent activity: pages opened, actions taken, refusals, failed sign-ins, and whether it has reached its allowance. A program does not make those decisions.
Having a decision reviewed
An allowance refusal ends as your earlier requests of that kind pass out of the 24 hours, unless we have set your allowance lower, and a sign-in refusal ends on its own. If you think one of these decisions was wrong, or it affects you more than it should, contact us and a person will review it and can change the outcome, for example by raising your allowance.
Decisions you make with Clockworks' documents
Clockworks' documents are produced by AI and can be wrong. We do not use them to make decisions about the people they mention. They are not designed to be the only basis for a decision that could significantly affect a person, such as one about employment, credit, insurance, housing, education, health care or access to government support. If you use them in such a decision, a person should check them first, and you are responsible for any obligations you have to the people affected, such as describing those decisions in your own privacy policy where the law requires it.
7. Changes and deletion
To arrange different terms, or to have your data deleted, contact us; the address is on our contact page. A deletion request is carried out by a person and confirmed to you. Deletion removes your saved tasks, your runs, their documents and your activity log. The record of your actions is kept, without your network address, country or device. Work shared within your organisation or team stays with that organisation and is not deleted with your account; it is no longer linked to your account. The cost record is retained; it is our accounting record and contains none of your content.