Manage Working TimeManage Working Time
Privacy policy
The extension runs in your browser and talks only to Zoho People and SRA, using the session you're already signed in with. This page lists what it reads, what it keeps on your device, and where requests go.
- No server of its ownNothing is sent to the developer. Requests go from your browser to Zoho People and SRA, nowhere else.
- No analytics, no adsNo tracking, no third-party scripts, no code loaded from the internet.
- Kept on your deviceSettings, the SRA token and a small cache of today's attendance stay in your browser profile.
- Gone when you remove itUninstalling the extension deletes everything it stored.
What it reads and keeps
Everything below comes from sites you're signed in to. On your device means the browser's extension storage (chrome.storage.local) in your own profile. In memory means it's gone when you close the tab.
Attendance for the pay cycle
Check-in and check-out times, hours, leave, holidays, requests and salary days from Zoho People.
Used to draw the calendar and its counts.
In memoryToday's summary
Today's check-in and check-out, the 4H/6H/8H marks, and the cycle's early-leave and request counts.
Used by the popup and the check-in/check-out reminders, so they work without reopening Zoho.
On your deviceYour Zoho profile and session
Your name, employee ID and work email, plus the Zoho People portal ID and the page's CSRF token.
Used by the popup and reminders to fetch today's attendance from Zoho and show whose day it is.
On your deviceLeave balances and salary breakdown
Leave left by type, and the salary figures Zoho shows when you open the breakdown.
Shown when you open them.
In memoryZoho session cookie
The wms-tkp-token cookie on your Zoho People domain. It's HttpOnly, so page scripts can't read it.
Read only when you submit a leave request, to get your user ID (ZUID), which Zoho's leave API requires.
Not storedSRA sign-in
The token sra.smartosc.com issues when you sign in, with your SRA username and user ID.
Used to load and log your timesheet in SRA mode.
On your deviceSRA timesheets and projects
Logged hours, projects and allocations from the SRA API.
Shown in SRA mode.
In memoryYour settings
Colours, light/dark mode, display toggles, reminder choices, and SRA defaults (project, hours, type of work, note).
Remembered between sessions.
On your devicePayslip lock
If you set a password for the salary view: a salted SHA-256 hash of it and of the recovery code. The password itself is never stored.
Used to check the password when you open the salary view.
On your deviceJSON tool
Text you paste into the built-in JSON tool, up to 1 MB per document.
Kept so your documents are still there next time.
On your deviceWhere requests go
Only to your employer's own systems, over HTTPS, using the session you're already signed in with:
- Zoho People:
people.smartosc.com,people.zoho.com,people5.zoho.com - SRA:
sra.smartosc.com,sra-api.smartosc.com
Regularization requests, leave applications and SRA timesheets are sent only when you click Submit or Log yourself.
Two links open a Google Form in a new tab: the Report bug button, and the feedback page Chrome opens when you uninstall the extension. Nothing is filled in for you. The form only gets what you type into it, and Google handles it under its own privacy policy.
What it never does
- Sell, rent or share your data with anyone.
- Send your data to a server run by the developer. There isn't one.
- Use your data for advertising, profiling, or anything other than the features above.
- Run analytics or tracking.
- Load or run code from the internet. Everything it runs ships inside the extension.
Storage and deletion
What the extension keeps lives in chrome.storage.local in your browser profile. It isn't synced to other devices and isn't copied to any database.
It also sets a single "visited" flag in Zoho People's own page storage, so it takes you to the calendar only the first time you open Zoho People.
Removing the extension deletes everything it stored in extension storage, including the SRA token.
Permissions
These are all the permissions it asks Chrome for, and what each one is used for:
storage- Keeps the data marked "On your device" above.
notifications- Shows the check-in and check-out reminders.
alarms- Schedules those reminders.
cookies- Reads the one Zoho session cookie described above, at the moment you submit a leave request. The cookie is never stored or sent anywhere else.
- Host access
- Reads and changes pages, and calls the APIs, on the five Zoho People and SRA addresses listed above. The extension can't access any other site.
Security
The SRA token is sent only to sra-api.smartosc.com, over HTTPS. Zoho requests reuse the session your browser already has. The extension never asks for your Zoho or SRA password.
The payslip lock hides the salary view from someone looking over your shoulder. It doesn't encrypt anything.
This website
This site sets no cookies, runs no analytics and loads no third-party scripts. The Add to Chrome buttons are plain links to the Chrome Web Store.
Children and changes
Manage Working Time is a workplace tool and isn't directed at children under 13.
When the extension changes how it handles data, this page is updated and the date at the top changes with it.
Contact
Questions about this policy or your data: phuccntttb@gmail.com.