Hourcraft
A time tracker we built — and then took all the way to market, through the store review, trader verification, tax handling and privacy law that turn a working app into a product you can actually sell.
The problem
Most time trackers are project-management tools wearing a stopwatch — they want a workspace, a client roster, and a billing rate before they will count a single minute. Someone who only needs to know where the day went has to stand up a company first.
What we built
Two surfaces over one timer. The web app installs to a phone like anything else on the home screen; the extension docks in Chrome’s side panel, beside your tabs rather than buried among them. Start a task in either and the other already knows. Behind both, sign-in is a one-time email link rather than a password, and the week resolves into three readings — a trend, a split by category, and a heatmap that makes a missed week obvious at a glance.
What shipping it actually took
Getting the software working was the short part. An extension that charges money has to clear store review, and a publisher taking payment has to prove it is a real trader — a D-U-N-S registration, a verified business identity, a contactable legal entity, all of it published on the store listing where anyone can check it. Billing runs through Stripe as merchant of record, so sales tax and VAT are calculated, collected and remitted per jurisdiction instead of guessed at. The privacy policy names a data controller and states a legal basis for each purpose, and customers in the EU and UK get their statutory fourteen-day withdrawal right. None of it is visible in the product. All of it is the difference between a working app and one you can sell.
How it holds up
The restraint is structural rather than promised. The extension cannot read your tabs, your history, or the content of any page you visit; it asks only for storage, alarms, notifications and the side panel, and it talks to nothing but its own backend. No analytics, no telemetry, no third-party trackers anywhere in it, and the whole extension ships in seventy-seven kilobytes. Sign-in tokens are kept only as one-way hashes and card numbers never reach us, because the safest way to hold something sensitive is not to hold it. And tracking keeps working offline — a timer that stops counting when the wifi drops is not a timer.