Last updated: 2026-10-16
Ataru LLC ("Ataru", "we", "us", or "our") operates the Ataru Cesium application and the ataru.io website (collectively, the "Service"). This Privacy Policy explains how we collect, use, and safeguard your information when you use the Service.
When you create an account, we collect your name, email address and account type, and the business address, phone number, company name and tax ID you enter. If you sign in with Google, we receive your name, email, and profile photo from Google. If you sign in with Apple, we receive the name you choose to share, on your first sign-in only, and your email address or, if you choose Hide My Email, a private relay address from Apple that forwards our mail to you.
We only accept an email address that can receive mail: addresses on names reserved for examples and tests, and on domains with no mail server, are refused at sign-up.
The Service stores business data you provide, including time entries, client and project details, billable items and price lists, invoices, the payments, write-offs and credits you record against them (dates, amounts, methods, the bank references you type, notes, and the part of a payment you kept, with its reason), dispute notes, other income records, expenses, tax configurations and your income method, and estimated tax payments. This data is yours. We store it solely to provide the Service to you. Bank references are free text you enter; they appear only on your own screens, invoices and statements.
When you submit the contact form, we collect your name, email address, and message content. We also record your IP address for spam prevention.
When you contact support from inside the app, we collect your name, email address, the category you choose and your message. Unless you switch "Attach these details" off, the message also carries the details the form lists before you send it: the app version, the page you were on (with the values in its address removed), your browser or device and its system, the window size, your time zone, your connection, your plan, and the last few errors the app noticed while you were using it, with personal details removed. We record your IP address to limit abuse. Each message gets a reference number, which our replies quote.
You may attach one picture to a support message. It is shrunk, and its hidden details (such as where and on what device it was taken) are removed before it leaves your device, and removed again on our servers. It is stored privately: only our support team can see it, and it is never sent back to you in a reply.
When something fails while you are signed in, the website and the phone app send us a short error report: the error's message with personal details removed, the kind of page it happened on (never the address of a particular record), the app version and the platform. Our servers report their own errors the same way. Reports carry no name, email address or account identifier. We group them by error and count them, so we can find and fix problems nobody has told us about.
Where you came from when you signed up: the campaign tags in the link you followed, the site that linked to us (its address without the query), the first page you saw, and how you signed up (email, Google, Apple, the demo or the phone app). We also note the first time you track time, issue an invoice, record a payment, deliver an item and start a paid plan, to understand how people get started. Both are kept with your account and deleted with it.
If you share a few words with us and tick the box, we may quote them, with the name and business you give, on our website and listings. Your words are kept with your messages and deleted with your account. A quote already published outside Ataru is removed on request.
When an import from a source we have not yet checked against real exports finishes, we may ask whether you will share a copy of the file to help us test that source. Sharing is your choice, it does not change anything else in the Service, and nothing is shared unless you press Share This Copy. The copy keeps the file's column headings, every date, start and end time and duration, and whether each entry was billable. It removes your name, your email address, every rate and amount, and every column we do not read. Client, project, task, tag and description names are replaced with codes such as C1 and P2, and the list that would turn a code back into a name is never kept. We use the copy only to build test files for the importer.
When you import a file whose columns Cesium does not recognise, we may ask Google's Vertex AI service to suggest which column holds which kind of information. We send only the column headings, with anything that looks like an email address, a long number or a web address removed, and a description of each column's format, such as "a date written as four digits, a dash, two digits, a dash, two digits". When the file brings client or project names your account does not have, we also send, for those names and for your existing client and project names, only their initials, their length and the pattern of their words (such as "a word of seven letters, a word of eight letters, a four-digit number") so the service can point out names that may be the same; the names themselves are never sent. We never send the rows of your file, amounts, or anything else from your account. Google processes the request on our behalf under its Cloud terms, does not use it to train its models, and does not keep it after answering. The suggestion only fills in column choices that you check and can change before anything is imported. You can always import without it.
When you suggest a feature on the roadmap, we keep its title and description with your account identifier and email address. A suggestion we publish on the roadmap shows its words only, never who sent it.
You can try Cesium without an account. A demo is a temporary account filled with sample data: it ends after a set time (24 hours unless we change it) and is deleted a day or two after it ends, unless you keep it by signing up. We use your IP address to limit how many demos one address can start.
We measure how fast pages load: the page's path, your plan and the timings, with no name or email. We do not use third-party analytics trackers. On our public pages, Cloudflare Web Analytics counts visits without cookies or personal identifiers; it never runs inside the app.
We do not sell, rent, or share your personal information with third parties for marketing purposes.
No newsletters. No marketing email. Only the emails your account needs. Everything we send is about your account: sign-in and security, the state of your trial or subscription, payments and receipts, and replies to the messages you send us. There is nothing to opt out of, so there is no unsubscribe link.
Your data is stored in Google Cloud Firestore and served via Google Cloud Run. We use Firebase Authentication for account management with support for multi-factor authentication. All data is transmitted over HTTPS.
We take reasonable measures to protect your data but cannot guarantee absolute security. No method of electronic storage is 100% secure.
We use the following third-party services to operate:
Each service has its own privacy policy governing how they process data.
Your business data is retained for as long as your account is active and your subscription is current.
When your subscription ends (whether by cancellation, payment failure, or expiry), or your free trial ends without a plan, we retain your data for 90 days from the end-of-access date (for a trial, the day after its last day). During this period:
This includes items, payments, write-offs, credits and other income records.
If you create a sign-in but never finish setting up an account, and it holds no data, we delete it once 30 days have passed since you created it and since you last signed in.
A copy of an import file you chose to share is deleted 90 days after you share it, when you delete it from Settings > Import & Export, or when you delete your account, whichever comes first.
We keep encrypted backups of our database for 30 days. If we ever restore from a backup, we first delete again every account that was deleted after that backup was taken, so a deleted account never comes back. To do that, we keep a deleted account's identifier, and nothing else from it, for 44 days.
You may request immediate permanent deletion at any time via the account settings page or by contacting us. This is irreversible.
When you delete your account, we remove your business data, the support messages you sent and their screenshots, the transactional email log we keep about messages sent to you, and any active session or timer state. Roadmap suggestions you made stay on the roadmap without your email address; your votes are removed, and the counts they added stay. We retain Stripe webhook event identifiers (which contain no personal data) for payment-integrity purposes.
If you opened checkout but never paid, the customer record Stripe holds for us (your email address and name) is deleted with your account. If you paid, Stripe keeps your payment records for tax and accounting under its own privacy policy.
Cesium is a tool, not a system-of-record for your tax compliance. You are responsible for retaining your own business records as required by your jurisdiction. Use the export feature to keep your own copies for as long as your jurisdiction requires.
We keep a log of the emails we send you about your trial and subscription (recipient, type, time) while your account exists, and delete it with your account.
We keep support messages so we can refer back to them, until you delete your account or ask us to delete them. A screenshot is deleted 30 days after we close the conversation, or at once if the message is deleted.
An error group is deleted once the error has not happened for 90 days. Our servers' logs, which record requests and errors, are kept for 30 days.
We retain Stripe webhook event identifiers in a stripe_events collection for idempotency. This collection contains no personal data, only Stripe event IDs and types.
You may request access to, correction of, or deletion of your personal data by contacting us. You may delete your account at any time through the application settings, on the web or in the app.
If you are in the European Economic Area (EEA) or United Kingdom, you have additional rights under GDPR including:
The data export feature satisfies the right to data portability. The "delete my account permanently" feature satisfies the right to erasure.
If you are in California, you have rights under CCPA including the right to know, delete, and opt out of sale (we do not sell your data).
We use a session cookie (__session) for authentication, a timezone cookie (tz) for date display, and a rum_sample cookie that lets us measure
page speed. Cloudflare's bot check may set its own cookie. We do not use advertising or tracking cookies.
The Service is not intended for use by anyone under the age of 18. We do not knowingly collect information from children.
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "last updated" date. Your continued use of the Service after changes constitutes acceptance of the revised policy.
For questions about this Privacy Policy, please use the contact form.