Folding Forks — Sign in

Project	Loading week…
Loading time entries…

Modules

Enable or disable modules for your organization. Disabling a module hides its navigation and returns 404 from its API endpoints. Existing data (submissions, approvals, audit history) is preserved.

Loading modules…

Which sign-in methods this instance offers. A method needs two things to be live: credentials in the deployment, and your permission here. Switching one off stops its routes, not just its buttons — anyone part-way through it is turned away. You cannot switch off the last one standing, or the last one you yourself can use.

Loading sign-in methods…

Webhooks

Notify your own HTTPS endpoint when invoice, payment or administrator time events occur. Events carry IDs and links. Receivers must verify signatures and deduplicate event IDs.

Loading webhooks…

Work items

Read GitHub issues into the projects and tasks you choose. Reading issue metadata does not publish comments. Time-note publication has separate permission and per-entry review below.

Loading GitHub connection…

Publish time notes to GitHub

Publication is off by default. Enable a connection, then review each time entry before allowing its date and duration to appear as a GitHub issue comment. Notes, rates and amounts are not included.

Erasure and retention

Publish your instance's account-closure disclosure. The operator determines applicable obligations and completes requests. Saving this policy does not erase accounts, schedule deletion, or establish legal compliance.

Loading policy…

Operator policy

Applicable frameworks

Check only frameworks you have assessed. These selections do not waive user rights or authorize blanket retention.

EU / EEA GDPR

Applicable US / Florida recordkeeping obligations

Identify the actual tax, employment, accounting or other obligation. US law alone is not the EU-law exception in GDPR Article 17(3)(b). Reference

Other applicable laws and jurisdictions

Include other countries, US territories and applicable federal or sector-specific duties. Describe the actual jurisdiction and legal basis in the retention reason and user disclosure.

US states and District of Columbia

Reviewed 2026-10-09. Entries distinguish current laws, enacted future laws, sector-specific examples and jurisdictions needing an operator assessment. This is a dated reference, not an exhaustive legal opinion.

Find a state or privacy law

Alabama Personal Data Protection Act

Enacted; principal effective date 2027-05-01. Record preparation separately from present obligations. Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

Alaska — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Arizona — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Arkansas — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

California CCPA, as amended by CPRA

Assess covered-business criteria and deletion exceptions. Employment data is not generally excluded; statutory rights cannot be waived by a disclaimer. Reference

Colorado Privacy Act

General consumer rights exclude employment and commercial contexts. Assess separate obligations for the actual data and processing. Reference

Connecticut Data Privacy Act

Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

Delaware Personal Data Privacy Act

Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

District of Columbia — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Florida Digital Bill of Rights

The controller definition is unusually narrow and certain provisions have a different scope. Florida incorporation does not establish coverage or compliance. Reference

Georgia — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Hawaii — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Idaho — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Illinois Biometric Information Privacy Act

Assess only if the operator processes covered biometric identifiers or information; a phone sign-in feature alone does not establish that processing. Reference

Indiana Consumer Data Protection Act

Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

Iowa Consumer Data Protection Act (Chapter 715D)

Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

Kansas — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Kentucky Consumer Data Protection Act

Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

Louisiana Data Privacy Act (Act 502 / SB386)

Enacted; principal effective date 2027-01-01. Record preparation separately from present obligations. Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

Maine — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Maryland Online Data Privacy Act

Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

Massachusetts — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Michigan — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Minnesota Consumer Data Privacy Act

Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

Mississippi — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Missouri — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Montana Consumer Data Privacy Act

Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

Nebraska Data Privacy Act

Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

Nevada NRS 603A (online privacy, security and consumer health data)

Assess the specific online-operator, data-broker and consumer-health provisions that apply. Reference

New Hampshire RSA 507-H (Expectation of Privacy)

Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

New Jersey Data Privacy Law

Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

New Mexico — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

New York — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

North Carolina — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

North Dakota — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Ohio — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Oklahoma consumer data privacy law (SB546)

Enacted; principal effective date 2027-01-01. Record preparation separately from present obligations. Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

Oregon Consumer Privacy Act

Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

Pennsylvania — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Rhode Island Data Transparency and Privacy Protection Act

Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

South Carolina — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

South Dakota — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Tennessee Information Protection Act

Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

Texas Data Privacy and Security Act

The consumer definition excludes employment and commercial contexts. Retention exceptions must remain necessary, proportionate and purpose-limited. Reference

Utah Consumer Privacy Act

Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

Vermont Data Privacy and Online Surveillance Act

Enacted; principal effective date 2028-01-01. Record preparation separately from present obligations. Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

Virginia Consumer Data Protection Act

Assess resident and business scope, thresholds, exemptions, request deadlines and specific retention exceptions for your actual processing. Reference

Washington My Health My Data Act

Assess covered consumer health data and exemptions; this is a sector-specific law, not a general GDPR equivalent. Reference

West Virginia — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Wisconsin — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Wyoming — other applicable privacy obligations

Jurisdiction assessment entry, not a claim that a comprehensive act exists or that no privacy law applies. Check current state, sector-specific, security, breach, employment and consumer-protection duties; identify the actual law in your disclosure. Reference

Records retained after account closure

For each checked category, specify why it is necessary, when retention ends, and when it must be reviewed. Leave unchecked when you have no justified retention need. A review interval is a follow-up target, not automatic erasure.

Time records and worker attributionRetain necessary records in this category

Who performed which hours, when, and their links to invoices and payments.

Retention justification Specific purpose and legal basis Retention period and starting event, or hold release condition Review within (days)

Invoices, expenses and paymentsRetain necessary records in this category

Include only necessary billing evidence and attachments.

Retention justification Specific purpose and legal basis Retention period and starting event, or hold release condition Review within (days)

Audit and security recordsRetain necessary records in this category

Limit personal data and access to the documented purpose.

Retention justification Specific purpose and legal basis Retention period and starting event, or hold release condition Review within (days)

Records subject to a legal holdRetain necessary records in this category

Identify the specific hold, its scope, release condition and review process.

Retention justification Specific purpose and legal basis Retention period and starting event, or hold release condition Review within (days)

Operator privacy contact Initial response target (days)

Choose a target that meets every applicable deadline. This setting cannot extend statutory deadlines or promise completion.

User disclosure

Explain what is erased, what remains identified, why, how long, how requests are completed and how users can contact you or appeal where applicable.

Backup and restore handling

State your actual backup expiry and deletion process, including how closures are reapplied before restored data is used. Account closure does not automatically remove backup or third-party copies.

I have reviewed applicability, necessity, retention periods and this user disclosure. I understand these settings do not certify compliance, waive user rights or perform erasure.

Time tracking

How the week grid reads and what a time entry has to say. The notes policy is enforced on every entry, including ones the API writes.

Loading time tracking settings…

Automatic approval

Off unless you turn it on. When on, a submitted week that nobody has approved or rejected within the number of calendar days you choose is approved for you. The days are counted from the moment the week was submitted, and start again if it is rejected and submitted again. A rejected week is never approved this way, and weeks submitted before you turn this on are left for a person to decide. The system records the decision with the review window and the administrator who authorized the policy. The submitter receives a confirmation; reviewers with email enabled receive a warning before the deadline.

Loading automatic approval…

Email delivery

Who this instance sends as, and how that mail has been landing. Transport credentials stay in the deployment; what is shown here is the state they produce.

Loading email delivery…

Invoices

What every invoice prints, and what a new draft starts with. The company name and address print on every invoice when it is sent, existing ones included. The default subject and notes are copied onto each new draft, where they can still be changed. Payment terms are set on each client.

Loading invoice settings…

Default values

Invoice subject

Filled in for each new draft: %client% is the client's name, %period_month_name% and %period_year% the month the invoice period starts in (a draft with no period uses its issue date), and %project% the project on an invoice for one project, empty otherwise. Everything else stays as written.

Invoice notes

Printed below the line items: how to pay, bank and wire details, terms. Formatting: *bold* and _italic_.

Estimate validity, in days

How long a customer can answer an estimate, counted from the day it is first sent. Leave blank for estimates that do not expire. An expiry set on an estimate overrides this.

Online invoice

Link the invoice online in the email, and record when it is first opened

Off, the email is exactly what it is today. On, its “View invoice” line opens a private page for that email: the invoice, its PDF, and a pay button where online payment is set up. The first time someone opens it, the invoice's History and Settings › Deliveries show when. There is no tracking image, and a mail scanner that only fetches the link does not count. An invoice email goes to everyone on it, so this shows that the email was opened, not by whom.

One per line, as email@example.com or Name <email@example.com> — your own finance mailbox, say. Every invoice email copies them, whoever it goes to; up to 20.

Payment reminders

What an open invoice sends once it is past due, until it is paid, written off or cancelled. This is the default for every invoice sent from now on; an invoice with a policy of its own keeps it. The wording is the reminder template under Templates, and each reminder goes to whoever was sent the invoice.

Loading payment reminders…

Notifications

Mail this instance sends the people who work in it. A project that has “Notify when over budget” on emails its project managers once each time its budget crosses the threshold set on the project. If a project has no manager with an address, the administrators are told instead, so an alert never goes to nobody.

Loading notification settings…

Payouts

Which Wise profile money leaves from, how many people it can currently pay, and whether Wise can tell this instance what became of a transfer. The token itself stays in the deployment; what is shown here is the state it produces.

Loading payout connection…

Import and export

Download authorized report data, review a supported Clockify browser import, or use the operator migration tool.

Loading available exports…

Other exports and recovery

CSV time imports

Run a dry run from the operator checkout before applying a file. CSV import covers people, clients, projects, tasks and time; it does not import invoices, payments, expenses or credentials.

npm ci
npm run build -w ./packages/migrate
node packages/migrate/dist/cli.js import-csv --database /data/db.sqlite --file time.csv --dry-run

CSV format and import guide

Move from Harvest

Use the migration guide to extract, verify, rehearse, reconcile and cut over. Keep credentials and snapshots on the operator's machine.

Harvest migration and parallel-run guide

Import Clockify time

Use a Clockify Detailed report CSV with ISO dates and unrounded HH:MM:SS durations. This imports time and reviewed people, clients, projects, tasks and assignments. Invoices, payments, expenses, attachments, source prices and credentials are excluded.

Checking browser import availability…

Bulk actions

Open a workflow to choose records and review the change. Permissions, invoice rules and locked periods are checked there.

Loading available actions…

Backups

When this instance last exported itself, and whether the last attempt worked. A backup nobody looks at is a backup nobody knows is broken, which is the state it stays in until it is needed.

Loading backup status…

Brand

The marks this instance draws on itself and on the documents it sends. An uploaded mark replaces the one configured at deploy time; remove it and the deployment's own setting comes back. PNG, JPEG or WebP up to 512 KB — SVG is not accepted, because it can carry script and these files are served to anyone who opens the sign-in page.

Loading brand assets…

Appearance

The colours this instance wears, for everyone who uses it. Leave them alone and it looks the way it shipped. Every palette is checked for readability before it is saved — a colour that would leave text unreadable against what sits behind it is refused, and the message says which one and why.

These are the light theme, and they are what everyone sees by default, whatever their computer is set to. Somebody who picks Dim or Dark in their own settings sees that built-in theme instead.

Loading appearance…

Accounting

Native accounting and financial integrations available on this deployment. Configuration is separate from an authorized connection. Only an administrator can manage connections.

QuickBooks Online: Accounting · Not configured
BILL: Invoice delivery and receivables · Not configured
Wise: Payouts · Not configured
Deel: Approved time sync · Not configured

SSO provisioning domains

Email domains this instance will create an account from on first single sign-on. A domain provisions nobody until its DNS challenge verifies, which is what proves this instance is entitled to the domain.

Loading SSO provisioning domains…

Make every hour visible.

Sign in to Folding Forks

Enter your verification code

Reset your password

Choose your new password

Lock all tracked work through a date

Notes

Stripe payment alerts

History

Invoice details

Line items

Tax and discount

Notes

Recurring invoices

Recurring invoice

Issue this period

What it bills

On the invoice

Attachments

Client and schedule

On the invoice

Amount

Covers the time on

Lines

Attachments

Estimates

Estimate

What was quoted

Expiry

Customer response

Turn this into an invoice

Retainers

Retainer

Ledger

Review deposit

Verify the source

Sender identities

Email templates

Template

Variables for this template

Versions

Client details

Hourly rate card

Publish a new version

Preview the matching card

Open invoices

Retainer balance

Node budget burn

Payment defaults

Account status

Emailed sign-in code

Set

Deel

Project details

Your week

Waiting on you

Uninvoiced work

Owed to you

Expenses are unavailable

Expenses are unavailable

Expense categories are unavailable

Add an endpoint

Delivery log