Security and data

What leaves your machine, exactly.

A time tracker sits in your editor all day, so you should know precisely what it sends. Here is the full list, where it is stored and who can read it. The plugins are open source, so you can check every line of it yourself.

What the plugins send

Sent, about once every two minutes of activity

  • File path relative to the folder open in the editor, and the repository's git remote
  • Language, branch, editor and its version
  • Timestamp, whether the file was saved, line and cursor position
  • Line counts: added, deleted, and how many an assistant wrote
  • Which AI assistant made an edit, when there is evidence one did
  • Claude Code token counts and model, if you run the Claude Code plugin
  • Commit hashes and line counts, if you run inlinr sync-commits

Never sent

  • File contents, diffs or snippets
  • Prompts or assistant replies
  • Commit messages or author emails
  • Screenshots, keystrokes or clipboard
  • Anything from outside a git repository you work in

Read the code: VS Code extension, CLI, Claude Code plugin.

Stored in Germany

The application and its Postgres database run on Hetzner Online GmbH servers in Germany. The database is not reachable from the internet, and nightly backups are encrypted before they go to a private bucket in the EU.

No passwords to leak

You sign in with GitHub. Each editor on each machine gets its own token, which you can revoke from Settings without touching the others.

No trackers

Cookies only for your session and for remembering the dashboard sidebar. No advertising, no third-party analytics, on the site or in the dashboard.

Teams see totals

Teammates see hours per project and per member, never each other's files, branches or languages.

Client links you control

A share link shows one project, with the sections you pick and an optional PIN. Share links are kept out of search engines, and you can revoke them at any time.

Leave with everything

Export your whole account as JSON from Settings, or delete it there. Deletion removes your tracked data; only billing records stay, because accounting law requires it.

Who else processes your data

Hetzner Online GmbHApplication and database hostingGermany (EU)
CloudflareDatabase backups (R2 storage, encrypted before upload)EU bucket (Data Privacy Framework)
StripePayments and tax, only if you subscribeIreland (EU); US under the Data Privacy Framework
ResendTransactional email (weekly digest, invitations)United States (Standard Contractual Clauses)
GitHubSign-in; package.json reads only for projects with dependency tracking onUnited States (Data Privacy Framework)

Retention periods and your rights under the GDPR are in the privacy policy. Found a vulnerability? Write to support@inlinr.com and we will answer quickly.

See your own week, on your own terms

Free to start. Sign in with GitHub, install the extension, and everything above applies from the first heartbeat.

Install in VS Code

No card to start · no source code leaves your machine