Privacy policy

§1 Controller

The controller of your personal data is:

Write to that address about anything to do with your personal data. No data protection officer has been appointed. This policy provides the information required by Article 13 GDPR (Regulation (EU) 2016/679).

§2 What data we process and why

Biometrics your device uses for passkeys (such as a fingerprint) never leave the device. We do not know your password; we store only a one-way hash of it.

§3 Legal bases

• Art. 6(1)(b) GDPR — processing is necessary to perform the agreement for services provided by electronic means (the Terms of service);
• Art. 6(1)(f) GDPR — our legitimate interest in the Service’s security, preventing abuse, and establishing, pursuing and defending claims;
• Art. 6(1)(c) GDPR — where the law requires processing, for example to answer a request from a competent authority.

§4 Recipients

We do not sell your data or share it for marketing. It may reach only the providers who process it on our behalf under a data processing agreement:

• a hosting provider based in the EU (Hetzner Online GmbH, Germany), whose servers run the Service and store the data;
• an e-mail (SMTP) delivery provider we use to send account e-mails.

Other Users in the same Workspace see its data as far as their role allows. A PDF report goes to whoever you send it to. We may disclose data to public authorities where the law requires it.

§5 Transfers outside the EEA

We do not transfer data outside the European Economic Area. Data is stored on servers in the European Union.

§6 How long we keep data

• We keep Account data and Content for as long as the Account exists, and delete it within 30 days after the Account is deleted.
• Backups are overwritten on a rolling basis and kept for no longer than 30 days, so deleted data disappears from them by then at the latest.
• We keep technical logs for no longer than 90 days.
• We may keep correspondence and data needed to defend claims longer, but only until the limitation period ends or for as long as the law requires.

Workspace data (projects, its members’ entries) belongs to the company that owns the workspace and is kept for as long as that workspace exists.

§7 Your rights

You have the right to:

• access your data and receive a copy;
• rectification — you can change most of it yourself in Account settings;
• erasure — by deleting your Account in Account settings → Personal data, or by writing to us;
• restriction of processing;
• data portability — download your account data as a JSON file with “Download personal data” in Account settings → Personal data, and your time entries as a PDF report; we will send other data on request;
• object to processing based on our legitimate interest (Art. 6(1)(f) GDPR).

To exercise these rights, write to [email protected]. We will reply without undue delay and within one month at the latest.

You may also lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland (uodo.gov.pl).

§8 Voluntary data, profiling and e-mails

Providing data is voluntary, but an e-mail address and password are required to create an Account, and the time recording and report features need the entries and details you enter. Technical data is collected automatically with every connection to the Service.

We make no decisions about you based solely on automated processing, including profiling. We send no marketing e-mails, only messages about your Account, security and changes to these documents.

§9 Cookies

The Service uses only strictly necessary cookies, without which it could not work. We use no analytics, advertising or tracking tools, so there is no consent banner. You can block these cookies in your browser, but signing in will then stop working.

The basis is Article 399 of the Polish Electronic Communications Law of 12 July 2024 (cookies strictly necessary for a service you request) and Art. 6(1)(b) and (f) GDPR.

§10 Third parties’ data you enter

You can enter your clients’ and counterparties’ details in the Service (such as name, tax ID, address, a contact person’s e-mail), and other people’s data in notes. For that data you decide the purposes of processing, and you are responsible for having a legal basis and for informing those people where the law requires it.

We process such data only on your behalf and only to provide the service (storage, display, report generation). On request to [email protected] we will sign a data processing agreement (umowa powierzenia przetwarzania danych osobowych) with you.

§11 Changes to this policy

This policy may change, for example after changes in the law, our providers or the Service’s features. We will announce significant changes by e-mail or with a notice in the Service before they take effect. The current version is always at /privacy and /polityka-prywatnosci.