Effective 14 November 2026 · XPE TimeSense Research, Chrome extension 0.5.3 private preview
Who we are and what this policy covers
XPEDESIGN PTY LTD (ABN 77 637 249 435, ACN 637 249 435), Australia, operates XPE TimeSense Research. Contact info@xpedesign.com for support, privacy enquiries, access, correction, deletion or complaints.
This policy covers the browser research extension and its connected TimeSense capture, matching and activity-review functions. The current preview connects only to an authorised staging portal. An authorised portal team account is required. It does not cover unrelated legal-portal features or the desktop tracker. Your firm’s notices and instructions also apply to its use of workplace and matter records.
Information the extension handles
Installing or connecting the extension does not start capture. After you approve the portal and explicitly start a research session, it processes the approved tab’s title and site name, your optional topic, timestamps and eligible focused intervals. It can include a page’s main heading if you enable that option. Titles, headings and topics may contain personal or confidential information. Do not capture material you are not authorised to share.
Optional selected-text matching processes up to 8,000 selected, read-only characters in your browser against matching context for matters you are authorised to access. That context may include matter and court references, names and private keywords. Full selected text is not uploaded or retained by the extension. Up to eight previewed matching terms may accompany a capture. Editable fields are excluded by the selection guard.
Optional document matching handles an individual document identifier and, when you confirm it, a private matter/document link and label. Supported cloud document identifiers are hashed before transmission; portal documents use internal identifiers. Hashing does not make these records anonymous: they remain linkable to a matter.
The extension also handles a temporary pairing code, browser credential, approved portal origin and verified firm identity. Captures are associated with your portal account. It does not upload full page URLs, URL query strings, complete page bodies, full selected text, cookies or browsing history. It does not scan your whole mailbox or cloud-storage account. Incognito capture is disabled.
Why we use information
We use information to connect your browser, suggest relevant matters, prepare activity for your review, maintain private matching preferences and document links, provide support, and protect the service. Matching is a suggestion, not proof of attention, work, legal accuracy or billability. Creating a time draft is a separate portal action; nothing is billed automatically.
We do not sell captured data or use it for advertising, unrelated profiling, creditworthiness or lending decisions, or AI model training. The reviewed extension does not send capture content to an external AI service.
Our use and transfer of user data obtained through the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Human access is limited to necessary support, security, administration and other access permitted by that policy, your instructions and applicable law.
Your capture controls and browser permissions
Capture requires an explicit Start and ends after 15 minutes unless you review and start again. Switching away, loss of focus, idle/lock conditions or navigation interrupts counting; a page change requires renewed approval. Pause stops counting. Disconnect clears local connection state and attempts to revoke the connection; if the portal cannot be reached, also revoke that browser in the portal. Removing the extension does not erase synced portal records.
The extension requests permission for your chosen HTTPS portal, rather than permanent access to every portal. The broad optional HTTPS permission lets you choose an authorised firm address. Active-tab and scripting permissions support metadata and optional heading/selection access on the tab you approve; storage, alarms and idle permissions support session state, sampling and idle/lock checks. File/PDF access may require separate browser approval. Protected pages or PDF viewers can restrict available information.
Where information is stored and who can access it
Credentials, pending captures and matching state are held in browser session storage, not extension local or sync storage. Restarting the browser requires reconnecting and clears that session state. Removing the portal permission clears local credentials and pending activity. Synced captures, private document links, matching preferences, device records and audit information remain in the portal.
The activity inbox is scoped to its owner through application permissions. Matter context follows the connected user’s permissions. Authorised operations personnel may access information when necessary for support, security or administration; a private inbox does not mean operators are technically unable to access it. Time drafts follow separate team-time permissions.
Portal requests use HTTPS to the browser-approved, cryptographically verified portal. Public authorisation checks do not include bearer credentials or capture content, but the server sees normal network information such as IP addresses. Expired, invalid or unavailable verification stops capture requests. A changed firm identity requires reconnecting.
Activity metadata, private keywords and document labels are encrypted with the portal’s external credential key, and device bearer credentials are stored as hashes. Some identifiers, timing, status, matter associations and audit fields remain readable in the database. Browser session storage is not a separate encrypted vault. No system can guarantee absolute security.
Retention, backups and deletion
The current staging preview runs an hourly job to remove raw tracker activity older than 90 days and tracker connection/action audit events older than 180 days. Preservation holds and job failures may delay removal; normal scheduling adds up to an hour. These periods do not apply to every authentication, operating-system or provider log. Operational logs follow their own service rotation and capacity settings.
Saved time entries and other business records are separate from raw capture and follow the relevant business, contractual and legal retention requirements. Matching preferences and document links are separate records; they do not automatically expire under the raw-capture job. Discarding activity changes its status, rather than immediately erasing it. Revoking a connection stops access without immediately deleting synced records.
Scheduled application and off-server staging backups are currently disabled. Historical backup copies remain restricted for recovery and do not have an automatic expiry schedule. We will review those copies within 30 days of this policy’s effective date to decide their continued necessity, retention or secure disposal. Before restored information returns to active use, we will reapply approved deletions, current retention rules and preservation holds. This does not promise immediate physical erasure from storage or backups.
To request access, correction or deletion, email the contact above and identify the relevant account and request without sending confidential matter content. We will verify identity and authority proportionately, assess the request, and explain any information we must retain, the reason and applicable handling. Necessary legal or preservation requirements may restrict deletion. Requests are operator-managed; disconnecting or uninstalling is not a self-service server-erasure feature.
Service providers and international processing
The current preview portal is hosted with BinaryLane in Sydney, Australia. Google Gmail sends portal security and operational emails. Cloudflare Turnstile protects portal sign-in and password-reset flows and may process browser/network security information. Google Firebase supports mobile verification when that separate portal feature is used; it is not a destination for research captures. Other legal-portal signing or identity features are outside this extension policy and require their own notices.
IONOS hosts xpedesign.com and the support mailbox. Visiting this public site sends ordinary connection/request information to its hosting infrastructure. Emailing support shares your email address and message with us and the relevant mail providers. Do not send passwords, connection codes, tokens or client documents.
Australian portal hosting does not mean all processing stays in Australia. Email, support and security providers operate internationally, including in the United States and other countries used by their services. We have not established an Australia-only processing arrangement or a complete fixed list of their processing locations. For their current international handling, see Google’s transfer information, Cloudflare’s privacy policy and IONOS’s privacy policy. Contact us for information about the arrangements relevant to your request.
Information may be disclosed to necessary service providers to deliver these functions, to your authorised firm recipients under portal permissions, at your direction, or when required by applicable law. Browser-store account and installation processing are governed separately by the browser provider.
Support, complaints and changes
Email info@xpedesign.com. We aim to acknowledge requests promptly and respond to privacy complaints within 30 days, or explain when more time is needed. If unresolved, you may contact the Office of the Australian Information Commissioner, subject to its jurisdiction and process. This service is intended for authorised workplace users, not children.
Material changes to capture, purposes, recipients or retention will be reflected in this policy, store disclosures and consent screens before the changed handling begins, with further consent where required. See TimeSense Support for connection and capture help.