OnPoint Time & Billing is made by Tycho Works LLC, a Colorado limited liability company ("we," "us," "OnPoint"). You can reach us at support@onpointtimeentry.com.
OnPoint is built around an account that keeps your work synced and backed up. When you create an account and sign in, the information you enter in the app is stored in our cloud database so that it is backed up and available on every device where you sign in. The data that syncs to your account includes:
You can keep working when you are offline. Entries are held on your device and sync to your account the next time you connect. An account is required to sync across devices. If you use the app without signing in, your entries remain only on that device until you sign in, at which point they sync to your account.
To create and protect your account, we collect your email address and the authentication information needed to sign you in and keep the account secure. We use your email to operate your account and to contact you about your subscription, security, or important changes to the service. We do not use it for advertising.
Our cloud database, authentication, and storage are provided by Supabase, which runs on managed cloud infrastructure. Your data travels over encrypted connections (TLS) and is stored on that infrastructure, which encrypts data at rest. Access is restricted to your own account through per-row access controls, so other users of the app cannot read your data. The one deliberate exception is OnPoint for Firms, described next.
Every OnPoint account is a practice of one. Your clients, matters, rates, letterhead and time live in that practice, and it is private to you. Nobody else can see it.
Joining a firm with other people is a choice you make by accepting an invitation. Accepting one does not move your practice. You join that firm, and the time you record in it belongs to the firm; your own practice, its clients, its matters, its rates and its trust records stay yours and stay private. The time you record in the firm (its date, hours, client, matter, narrative, and the rate the firm has set for you) is visible to that firm’s administrators and reviewers. They can edit it, approve it, move it to another timekeeper, and put it on the firm’s bill to the client. Every one of those actions is recorded against the name of the person who took it, and you can see that history on the entry. The same is true of the firm’s client trust ledgers: the firm’s administrators and reviewers can see, record, and reconcile them, and every change is logged with the name of the person who made it. Your trust records belong to your own practice, and they stay with it. Joining someone else’s firm never moves trust money, because the money has not changed bank accounts.
Bills you had already issued before you joined stay yours. They remain in the app as your own history, and the firm can neither see them nor bill that work again.
Time you captured for a firm belongs to that firm’s billing records. If you leave the firm, or are removed, that time stays with them, because it is what their invoices to their clients are made of, and for the same reason an account holding firm time cannot be deleted until the firm has released it. Your personal entries are unaffected and remain yours.
We use reasonable administrative and technical safeguards to protect your information. No method of transmission over the internet or method of electronic storage is completely secure, however, so we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.
We share information only with the providers that make the service work, and only as needed for them to perform their function:
Each provider processes data under its own terms solely to provide its part of the service. We do not sell or rent your data to anyone.
OnPoint’s trust accounting stores records. It does not connect to your bank, it never receives your bank login or account credentials, and it does not hold or move money. The records it stores are the ones you enter: the transactions on each client’s trust ledger, the amounts applied to bills, and, when you reconcile, the closing balance you type from your bank statement along with the figures the reconciliation calculated. Saved reconciliations are kept exactly as you saved them. They are deleted when you delete your account, or, for a firm’s ledgers, when the firm is deleted.
Because OnPoint is a paid subscription, the app periodically confirms your subscription is active. This check does not involve your time entries, client names, narratives, rates, or bills. Subscriptions purchased on our website are processed by Lemon Squeezy (merchant of record), and the app reads their status from your own account in our cloud database (Supabase). Subscriptions purchased inside the iOS app are billed by Apple, and the app confirms them through RevenueCat, which receives your account identifier and returns your purchase state. If you are offline, the app keeps working and re-checks the next time you connect.
If you use the in-app microphone, speech-to-text is performed by your device's own built-in speech recognition. OnPoint receives only the resulting text and never records, stores, or transmits audio. Where that speech recognition runs is governed by your device and its settings.
OnPoint uses AI in three places, all over the same encrypted path: Chain Dictation turns your dictated text into structured entries; Polish rewrites a rough narrative into bill-ready wording; and the Assistant answers questions about your logged time and performs actions you request. When you use these while signed in, the text you dictated or typed (along with your client codes/names and matter names so the AI can match them, and never audio) is sent over an encrypted connection through our server to our AI provider, Anthropic, which returns the result. Anthropic does not use data submitted through its API to train its models, and retains it only briefly for abuse monitoring before deletion. Voice commands (such as "hold this" or "next entry") are handled entirely on your device. If you are not signed in, are offline, or the AI service is unavailable, Chain Dictation falls back to on-device processing.
Most of the app's email options open your mail service with a draft prefilled. Those messages travel through your email provider, not through us, and we never see them. Two things are sent from our servers: firm invitations, and a firm bill when the firm chooses to email it from the app. For those we send the message and its attachment through our email provider, Resend, to the address on the firm's client record.
In the web app and the iPhone app you can optionally connect your Microsoft 365 / Outlook account so OnPoint can suggest time entries from your calendar and email for a day you choose. This is off unless you turn it on, and it is built to keep Microsoft data on your device:
You can also connect a Gmail account so OnPoint can suggest time entries from your email for a day you choose. It works the same way as the Outlook connection, and it is off unless you turn it on:
OnPoint's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What changed on August 31, 2026. Until that date the app carried no advertising or analytics code of any kind, and this policy said so. It no longer says so, because it is no longer true, and we would rather change the sentence than let it drift from the practice. The reason is plain: we could not see where people got stuck, and we could not tell which of our advertising brought anyone here. Both are now measured. What has not changed is the boundary that matters: nothing you type into OnPoint (no time entry, client name, matter, narrative, bill, or spoken word) is ever sent to an advertising or analytics service. The measurement is of what happened (an account was created, an entry was saved, a bill was exported, a subscription started), never of what it said.
We advertise OnPoint on Reddit, on Google, and in Apple's App Store. Our marketing pages and the web app load Reddit's advertising pixel so that we can tell whether people who click one of our ads go on to create an account or start a subscription. It stores a cookie named _rdt_uuid in your browser and tells Reddit that a page was visited, that an account was created, or that a subscription began. It receives the address of the page, your screen size, the random identifier in that cookie, and the technical data that accompanies any web request, such as your IP address and browser type. We do not send Reddit your email address, phone number, or name.
When you arrive from an advertisement, the address you land on may carry a click identifier from the network that showed it (Google's gclid, Reddit's rdt_cid, or campaign labels). We keep that identifier in your browser and, if you go on to create an account, store it against the account so that we can tell the network the click led to a signup. That is the whole of what it is used for. The iOS and Android apps do not carry this identifier; store installs are attributed by Apple and Google under their own terms.
You can block all of this freely. A content blocker or a private window stops the pixel; the app works identically without it, and nothing you do in OnPoint depends on it.
We use measurement services so we can tell how people find OnPoint, what they use, and where it loses them. What follows took effect in August 2026 and, since August 31, 2026, applies inside the app as well as on the marketing pages.
All of these receive the technical data that accompanies any web request, such as IP address and browser type, and process what they collect under their own privacy terms. None of them can see your time entries, clients, matters, narratives, bills, or dictated audio, because the app never sends any of that to them, and the list of what an event may carry is fixed in the app's code and tested on every release.
Email and calendar data is excluded entirely. Anything OnPoint learns from a connected Outlook or Gmail account (subjects, participants, calendar events, the suggestions built from them) is used only to suggest time entries to you. It is never sent to an analytics or advertising service, never used to target advertising, and never appears in any event. This is a condition of Google's and Microsoft's terms for that access, and one we intend to keep.
We do not sell, rent, or trade your personal information. We have never used your time entries, clients, narratives, bills, or dictated audio for advertising or analytics, and no analytics or advertising service receives them. We do not target ads to you based on anything you enter in OnPoint. Email and calendar data from a connected account is never used for advertising or analytics at all. The advertising pixel and the analytics services described above are the whole of our measurement, and the list of what they may receive is fixed in the app's code. Our service providers keep limited operational logs as described above to run and secure the service.
We keep your synced data for as long as your account is active so the app can do its job. You stay in control of it:
Data held on your device is removed when you delete entries, clear this site's browsing data, or remove the app from the device. Backup files you download remain wherever you saved them until you delete them.
Depending on where you live, including under the Colorado Privacy Act, you may have the right to access the personal data we hold about you, correct it, delete it, obtain a portable copy, opt out of targeted advertising, and appeal our decision on a request. If you want to opt out of the advertising measurement described above, the browser controls in that section take effect immediately; you can also email us. The app's export/backup feature gives you a portable copy of your data directly; for access, correction, deletion, or appeal, email support@onpointtimeentry.com and we will respond as required by applicable law. We will not discriminate against you for exercising these rights.
Your account data is stored and processed on cloud infrastructure located in the United States. By using the app, you understand that your information will be processed there.
OnPoint is a professional tool and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
If we change this policy, we will post the updated version here with a new effective date and, where appropriate, notify you in the app or by email.
Questions about this policy: support@onpointtimeentry.com.