Open My Account → Your data. Downloads and restores always belong to the signed-in account. Administrator access does not include anyone else’s records.
Download my data creates a private ZIP containing:
archive.json: a versioned snapshot for restoring work and preferences.manifest.json: archive identity, generation time, record counts and file descriptions.README.txt: format and privacy notes.The snapshot includes all work records, project/client links, task relationships, labels, descriptions, external references, exact timestamps, running intervals, time-zone preferences and import audit history. It also includes your account identity, recovery addresses and credential-management metadata for reference. Passwords and hashes, API/session token material, passkey keys/credential IDs, recovery codes/links and deployment settings or SMTP secrets are excluded.
One consistent snapshot supplies every file. Ordinary list pagination and the older transfer endpoint’s 10,000-record/20 MiB limits do not truncate this download. CSV cells are quoted and potential spreadsheet formulas receive an apostrophe; JSON retains the original values. Keep the archive private.
archive.json.All imported work receives new IDs, with client/project/task/label links remapped together. Existing work remains. Your username, role, recovery addresses and sign-in credentials remain under this account’s control; the source account’s metadata is informational. Imported history is an audit copy and cannot authorize old import jobs or Undo operations.
Closed intervals retain exact instants and nanoseconds. A source running activity or work session can be restored when the corresponding timer is available in this account. Stop a conflicting current timer and review again. Activities continue to follow the account’s local-midnight partitioning.
If your work or preference changes after review, review the archive again. Validation and restore are atomic: rejected input leaves existing work and preferences intact. Each archive identity restores at most once into an account, including across server restarts, lost replies, changed preference choices and ZIP/extracted-JSON selection. A changed document reusing an already restored archive identity is rejected; keep the original file.
If the result is unknown, use Check import result. Timekeeper reconciles the recorded result before allowing another attempt. Reloading or selecting the same archive again also reconciles a completed restore.
The review lists record counts and the client, project, task, label and session links to preserve. It validates these links before importing; linked records receive new IDs together.
Uploads are private to your account and can resume after a lost reply or reload: select the unchanged file and choose Review archive again. Pending uploads expire after 24 hours. Discard upload clears staging data and keeps existing work records.
Restore accepts files and uncompressed JSON up to 256 MiB, up to 250,000 records of each work type and 1,000,000 import audit records. Oversized input is rejected explicitly. At most three uploads and 512 MiB of declared upload data can be pending for one account. Read-only sessions can download their account and cannot stage or restore an archive.
Use protected deployment backups or the Synology backup workflow for disaster recovery, including account credentials and service configuration. For Toggl CSV, use the separate Toggl Track import.