Ur Timesheet

Outside Services (Subprocessors) List

Last updated November 1, 2026 · Operated by astracoretech corp.

These outside services receive personal information to run Ur Timesheet. Companies are given 30 days' notice of additions that receive their workers' data (see the DPA).

ServicePurposeWhat it receivesLocation
Amazon Web Services (EC2, RDS, S3, SES)Servers, database, file storage, sending emailEverything stored; each email's address, subject and bodyCanada
VercelHosts the websiteWebsite visitsUnited States (and its worldwide network)
AnthropicAI featuresText and records described in the AI Features Notice; no imagesUnited States
StripeCompany billing (and website Plus, when released)Company name, email, billing address, tax number, monthly chargeUnited States
Expo push serviceSending push notificationsDevice token, title, text (can contain names), item IDsUnited States
Firebase Cloud Messaging (Google) and Apple Push Notification serviceDelivering pushes to Android and iPhoneThe same push contentUnited States
Google Sign-InSigning in with GoogleGoogle returns email, name and pictureUnited States
Sign in with AppleSigning in with AppleApple account IDUnited States
Photon (OpenStreetMap, run by Komoot)Turning addresses into map points; address searchFull home address text; search text with the phone's locationGermany
Google PlacesAddress searchSearch text and the phone's locationUnited States
Nominatim (OpenStreetMap Foundation)Postcode lookupExact coordinatesEurope
OSRM (public routing server)Road distance and drive timeA blurred home point and the job site; during live sharing, the live point, rounded to about 110 metres, about every 2 minutesGermany
Google Maps (phone app) and Apple MapsShowing mapsWhat the map showsUnited States
OpenFreeMap and CARTOMap tiles on the website and admin mapWhich map area is viewedEurope and the United States
MET NorwayWeather for job sitesJob site location rounded to about 1 kmNorway
PostHogProduct analyticsA fixed list of events; no IP addressUnited States
Google AnalyticsPublic website visits, after AcceptPage views on public pagesUnited States
Calendar apps you choose (Google, Apple, Outlook)Showing shifts in your calendarShifts; a manager's feed includes crew first names and last initialsPer provider

Expo EAS builds the phone app and receives no user data. Speech-to-text uses the phone's own system; Face ID stays on the phone.

Crash and error reports are kept by us, on our own servers. If you allowed it in your phone's settings, Apple (App Store Connect) or Google (Play Console) may also send us reports of crashes of the phone app.