We use data to provide the free EXPANS time tracker and its ClickUp integration. We do not sell user data, use it for advertising or collect general browsing history through the extension.
01 · Who is responsible
The EXPANS service is operated by individual entrepreneur Skliar Vladyslav Olehovych (ФОП Скляр Владислав Олегович), Ukraine. The Chrome Web Store publisher is Vladyslav Skliar. Contact us about privacy at support@expans.ua.
Operator contact and business details are available on the EXPANS contact page ↗.
This policy covers track.expans.ua, the EXPANS Chrome extension and data exchanged between them. Your workspace organization determines the purposes of the work records it manages; contact its administrator for workspace-specific access and retention decisions.
02 · Data we process and why
Account and security
Name, email, user ID, optional photo, workspace membership and permissions, language and time preferences are used to sign you in, identify you and apply access controls. Passwords are stored as hashes. Authentication sessions, passkeys and two-factor settings support account security.
Work records
Task descriptions, projects, clients, timer start and stop times, durations, favorites, goals and reports provide time tracking and planning. If your workspace uses absence or payroll features, it also processes the absence requests, schedules, rates, calculations and approvals entered by authorized users. The extension itself does not request access to payroll or absence modules.
Service operation
Session and CSRF cookies protect website sign-in and forms. Browser storage retains interface settings and interrupted operations. Server requests may create technical and security logs containing IP address, request time, requested route, browser information and errors. These support delivery, troubleshooting and abuse prevention. Optional notifications and weekly reports use the preferences you enable.
Do not put passwords, medical details or other unnecessary sensitive information in task descriptions or absence comments.
03 · Chrome extension and ClickUp
Before reading task content or connecting to the tracker, the extension asks you to agree to the displayed data practices. Without agreement, time tracking through the extension remains disabled and ClickUp continues to work normally.
After agreement, it reads the visible open ClickUp task’s name, ID, workspace ID, URL and tags to prepare a time entry, identify the task and suggest a project. It does not read task comments or pages outside app.clickup.com. Task details and your chosen project are sent to EXPANS when you start or switch the timer. Tags are used locally for matching and are not sent as a tag list in the time-entry request. The integration does not automatically write time into ClickUp.
EXPANS returns your name, ID, photo, available projects and clients, favorites, workspace branding and active timer, plus the names of your accessible workspaces and your default selection. Switching requires confirmation for the selected workspace. The extension receives an access token, not your account password. The identity permission opens EXPANS sign-in; it does not request Google account OAuth data. Chrome and ClickUp are separate products governed by their own policies.
05 · Storage and protection
The extension stores its connection token and consent version/date locally in this Chrome profile, without Chrome Sync. It does not add application-level encryption to Chrome storage. Access expires after 90 days without opening or using the timer panel; passive background refresh does not renew it. Revocation and account security changes can invalidate access earlier.
Unconfirmed timer commands, including their original click time and task details, stay locally in this Chrome profile until the server confirms or rejects them. They survive a browser restart and are retried only when you choose to retry. Drafts, temporary task contexts and remembered project choices use temporary Chrome session storage. Temporary images may be cached in extension memory. Removing the extension clears its browser storage, but does not delete EXPANS records or stop an active server timer.
Server work records are retained for workspace operation until an authorized deletion or another applicable retention decision. Security/audit records and backups may remain separately where needed for security, recovery or legal obligations; deleted data may remain in backups until those copies are rotated. We do not promise a fixed automatic deletion period for all data. Contact us for the retention and deletion details applicable to your request.
Service traffic uses HTTPS and server access is restricted. No storage or transmission method offers an absolute security guarantee.
06 · Your choices and requests
Use “Manage consent” in the extension or “Privacy & consent” in extension settings to review or withdraw agreement. Withdrawal revokes the extension connection and clears its local work data after server confirmation. If an operation is unconfirmed, check its result first; a network failure is not shown as a successful revocation. You can also revoke an extension connection on the EXPANS website. This leaves server records and the active timer intact.
To request access, correction, export or deletion, ask your workspace administrator and/or email support@expans.ua. We may verify your identity and authority to protect other workspace members. We assess requests under applicable law and explain any necessary limits, including records controlled by your organization. Withdrawing consent does not undo earlier lawful processing.
Google Calendar
Calendar connection is optional and separate from Google sign-in. EXPANS requests your calendar list and permission to view, create, edit and delete events in calendars you can already access in Google. Sharing and access rights remain controlled by Google. Other EXPANS members, including workspace administrators, cannot see your connection or events. Starting a timer explicitly copies the meeting title into that workspace’s time history, under its usual access rules.
Access and refresh tokens are encrypted on the server. We store the connected account identifier/email, calendar names, access settings and selections. Event details are fetched on demand and are not stored in a separate EXPANS event database. Creating or changing events and sending guest invitations happens only when you request it. Calendar data is not sold, used for advertising or sent to external AI services. Disconnecting removes active connection credentials and selections in EXPANS; events remain in Google. Access can also be revoked in your Google account. Existing encrypted backups follow the service’s backup retention policy. Use and transfer of Google API information follows the Google API Services User Data Policy, including Limited Use requirements.
Google sign-in
If you choose Google sign-in, we receive your Google account identifier, verified email status, email, basic name information and an optional profile photo to authenticate you or create your EXPANS account. We store the account identifier and email with your sign-in connection. A profile photo may be imported once, normalized and stored in EXPANS; an existing profile photo is preserved. We do not request access to Gmail, Drive or Calendar, and do not retain Google access or refresh tokens for sign-in. Existing accounts are linked only after you sign in and confirm your account security. You can disconnect Google from your profile after adding a password so that you keep access.
07 · Changes and limited use
We use extension data only as necessary to provide and secure its disclosed time-tracking functionality, in accordance with the Chrome Web Store User Data Policy, including Limited Use requirements. We do not sell it or use it for unrelated advertising. If extension data practices materially change, we will update this page and present a new disclosure and consent request before the changed processing begins.
The effective date and policy version are shown at the top. Questions? support@expans.ua.