Security and data
How Hourcove handles your data
Each workspace is separate and only its members can see it, within their role; a client's invoice link opens that one invoice and nothing else. Data is hosted with Render in the United States, Harvest tokens are encrypted at rest and never logged, and data isn't shared with other New Odyssey products, sold or used to train AI models.
What Hourcove holds
- Account: email address, name if added, and the sign-up source.
- Workspace: clients, projects, tasks, people and their billable and cost rates with history, time entries, timesheet approvals and estimates.
- Expenses and their receipts (photo or PDF), opened through short-lived signed links.
- Invoices: the client email address they are sent to and the invoice itself, also as a PDF, with payments recorded against it.
- The Harvest move: encrypted Harvest tokens and an exact copy of each record as Harvest sent it, so the move can be checked.
- Billing: plan and subscription status. Card details are held by Stripe.
How long it’s kept, and how to export or delete it
Raw copies of Harvest records are deleted automatically after the retention period you set (90 days by default) once a move is complete. Exports stay available after a plan ends. Deleting the workspace removes everything at once, receipts included; hosting backups expire on Render's standard schedule, and a minimal security log is kept.
The full detail is in Hourcove’s data export and deletion policy.
Who processes it
Service providers (subprocessors), each on our instructions and only for the purpose shown:
- Render: hosting, databases and backups, in the United States.
- Cloudflare: private file storage (R2).
- Stripe: subscription and license payments (card details go to Stripe, never to us).
- Resend: sending email.
Questions and security reports
Hourcove is run by New Odyssey. To ask what we hold about you, to have it exported or deleted, or to report a security problem, email clio@new-odyssey.com. The privacy policy covers the rest.
Questions buyers ask
What does Hourcove do with my data, and is it used to train AI?
Hourcove keeps each workspace's time, rates, expenses, receipts and invoices separate, visible only to its members within their role, and hosted in the United States. Harvest tokens are encrypted at rest. Your data isn't shared with other New Odyssey products, sold or used to train AI models, and you can export everything.