Security
How WorkAlio is built and operated, and how to reach us if you find a problem.
Last updated September 11, 2026
This text describes our intended practice and has not yet completed legal review.
Where it runs
WorkAlio runs on Cloudflare Workers, served over HTTPS everywhere. There is no database behind it and no server that receives your work — your file is read in your own browser, whether you opened a tool or dropped it on a page here, so the pages themselves are the only thing we ever send you. Beyond the deploy credentials and the mail binding the contact form uses, there is nothing here to keep secret. Our checks run before a change is committed, and a failing check refuses the commit; publishing is a separate step we run by hand, so nothing reaches this site because a change was committed.
Access to your calendar
Calendar Timesheet never connects to your calendar. There is no sign-in, no consent screen and no token, because the tool does not talk to Google at all: you export an .ics file yourself and drop it on the page, and it is read by code running in your browser. Nothing is uploaded, so there is no access for us to hold and none for you to revoke.
Collecting less
The most reliable way to protect data is not to hold it. Every WorkAlio tool has the same shape, and so does every page here that checks a file for you: you hand it a file you already have, code running in your browser reads it, and it is never uploaded. Whatever kind of file that is, nothing written inside it ever leaves your computer, and there is no copy of any of it for us to secure. What is left over — your categorisation rules and preferences — stays in your browser's own storage.
Reporting a problem
If you believe you have found a vulnerability, please tell us before disclosing it publicly. Send vulnerability reports to support@workalio.app.