🛡️ DevTime Security & Compliance Policy

This document outlines the security architecture and data handling policies for DevTime (Chrome Extension). It is strictly designed to assist Information Security (InfoSec) and IT teams in auditing and approving the tool for enterprise and corporate deployment.

Privacy Policy: Privacy Policy

1. Executive Summary

DevTime operates on a strict Local-First architecture.

• No external network requests are made by the core time tracking engine to unauthorized servers. The extension only communicates with approved integrations like Google Calendar or Google Drive when explicitly authorized by the user.
• No telemetry, analytics, or tracking is included in the extension clients.
• 100% of tracking data resides securely in the user's encrypted local environment (Chrome profile).

2. Platform Security Architectures & Permissions

A. Chrome Extension (Manifest V3)

The extension operates within Chrome's restrictive Manifest V3 environment.

• Storage: Uses chrome.storage.local to securely isolate tracking data within the browser profile.
• Content Security Policy (CSP): Strictly adheres to script-src 'self'; object-src 'self';. No inline scripts or eval() functions are used.

3. Third-Party Integrations

When connecting DevTime to third-party services like Google Calendar, the authorization is handled securely via Chrome's native identity APIs (OAuth2). OAuth tokens are securely stored and never exposed to the DOM.

4. Error Logging & Telemetry

The application uses localized console.error() calls to capture runtime failures. These logs are visible only inside the local DevTools panel and are not accessible to remote servers, third-party error tracking services, or any external party. There is no data exfiltration vector.

5. Enterprise Deployment & Auditing

DevTime is designed to be deployed silently via corporate IT management tools.

• Chrome Extension: Deployable via Google Workspace Chrome Management using the "Force install + pin to browser toolbar" policy targeting specific Organizational Units (OUs).