Privacy policy
This notice describes the processing of personal data when visiting timeasy.org and using our hosted web app and its connected mobile app. The final section explains the distinction for self-hosted installations.
1. Controller and contact
The controller for the processing carried out for our own purposes described here is Achim Hilwers, trading as Softqo, Schützenstraße 17, 26676 Barßel, Germany.
For privacy enquiries and to exercise your rights, contact info@timeasy.org.
2. Hosting and technical logs
We operate timeasy on servers that we manage in Germany. The hosting provider supplies the infrastructure. We process technically necessary connection and log data, including IP addresses, access times, requested resources, response status and browser/operating system information.
The purposes are service delivery, troubleshooting and protection against unauthorised access. Processing necessary for contractual services is based on Article 6(1)(b) GDPR. Secure operation and troubleshooting are based on Article 6(1)(f) GDPR; our legitimate interest is maintaining a reliable and protected service.
3. Accounts, authentication and necessary storage
For the hosted service, we process account identifiers, email addresses, any names provided and authentication/session data. Registration and sign-in are handled by a system we operate on servers in Germany. The purposes are account setup and security and the association of your content with your account. Article 6(1)(b) GDPR applies where processing is necessary for the service contract; security measures are additionally based on Article 6(1)(f) GDPR.
Authentication may use technically necessary cookies and other local storage mechanisms for sessions and authentication. The mobile app also stores data necessary for use and synchronisation on your device. Access to strictly necessary device storage is subject to section 25(2) of the German TDDDG. Consent for any additional purposes must be assessed separately.
Required account and authentication information must be provided to use the hosted features. Optional profile information is distinct from those requirements.
4. Projects, work entries and personal content
timeasy processes projects, time entries, start/end times, descriptions and any project parameters such as hourly rates that you provide. Data is associated with the relevant account or shared team for tracking, synchronisation, reporting and export. Processing necessary for agreed features is based on Article 6(1)(b) GDPR.
You do not need to maintain a customer directory of your own clients to use timeasy. However, project names, descriptions and issue content may contain information about other people. Only enter information you are authorised to process and avoid unnecessary personal information.
Where we process personal content on a business customer’s instructions and behalf, the allocation of data protection roles must be considered separately. This notice does not replace a data processing agreement where one is required.
5. GitHub, GitLab and Jira integrations
If you enable an integration, we process the access tokens, account/project associations and issue information required for that connection. This can include the provider, issue identifier, title, status and URL. The relevant destination is determined by the GitHub, GitLab or Jira instance you configure.
Processing supports retrieving issues and associating them with time entries and is based on Article 6(1)(b) GDPR for the requested features. Without an integration, that issue access is not required. The connected instance operator’s own privacy information applies to its processing.
6. RevenueCat and cross-platform subscriptions
We use RevenueCat to associate and manage subscription entitlements. Your timeasy account identifier is used as the RevenueCat App User ID, allowing purchases to be associated with the account on other supported platforms.
In the mobile app, email address and display name are also sent to RevenueCat where present in the account and passed to subscription management. The account email address is provided during web checkout. Account association and attribute submission can occur when subscription management is initialised, rather than only after a purchase.
Processing also involves purchase/transaction identifiers, products/plans, subscription periods, status and entitlements. The integrated SDKs may process additional device and connection data necessary for operation. Processing necessary to associate and provide paid access is based on Article 6(1)(b) GDPR.
7. Paddle web purchases and in-app purchases
Web checkout is processed through Paddle. Paddle acts as merchant of record, meaning a reseller and independent controller for its processing in connection with the sale. Paddle processes the contact, payment and billing details provided during checkout and sends the corresponding invoice emails.
In-app purchases are processed through the Apple App Store or Google Play. The relevant store processes the account, payment and billing data provided for the purchase and sends the relevant purchase/invoice messages. Purchase and entitlement information is associated with the timeasy account through RevenueCat.
The relevant Paddle or store privacy notice also applies to its processing. The company acting as your purchase contracting party is identified in checkout and on the purchase receipt. This processing does not imply that timeasy receives every payment detail, including full card details, or forwards them to all providers involved.
Our processing necessary to fulfil the contract and enable access is based on Article 6(1)(b) GDPR. Where our own statutory retention obligations apply, Article 6(1)(c) GDPR is the basis for that retention.
8. Email and support
Email we send and receive is processed through a self-hosted mail server in Germany. When you contact us, we process your email address, any name provided, message content, attachments and technically necessary delivery information.
Contract-related enquiries are processed under Article 6(1)(b) GDPR. Other enquiries are processed under Article 6(1)(f) GDPR based on our legitimate interest in handling communications appropriately. Invoice emails sent by Paddle or the app stores are separate from our own email processing.
9. Self-hosted Umami website analytics
We use a self-hosted Umami installation in Germany for website analytics. Analytics data is not sent to an Umami cloud service.
This includes visited pages and URL information, referrers, timestamps and browser, device, language and approximate location information. Umami can group sessions using an identifier derived from the IP address, browser information and other inputs. An IP address not being stored as a separate analytics field does not mean it is not processed when receiving requests or calculating identifiers.
Our legitimate interest in audience measurement is to understand how the website is used and improve our offering (Article 6(1)(f) GDPR).
10. Retention, deletion and backups
Retention follows the relevant purpose. Account data and project content are needed while required for use and performance of the contract. When deletion is requested, we assess which data must be erased and which must remain to satisfy legal requirements or establish, exercise or defend specific legal claims.
Support messages are needed to handle enquiries and necessary follow-up communication. Applicable statutory retention obligations govern relevant correspondence and billing records; they do not justify retaining every project entry for the same period. Cancelling a subscription and deleting an account are separate actions.
Backups are used for recovery. After data is deleted from the live system, copies may remain until the relevant backup reaches the end of its retention period.
| Data | Planned retention |
|---|---|
| Routine server logs | 30 days |
| Daily backups | 30 days |
| Weekly backups | 12 weeks |
| Monthly backups | 12 months |
| Production Umami analytics data | 12 calendar months |
11. Recipients and international processing
For the hosted service, Hetzner Online GmbH supplies the server infrastructure on which data is stored and processed. We manage the operating system and application ourselves.
For subscription management and purchases, the data described above is transmitted to RevenueCat and, depending on the purchase channel, Paddle, Apple or Google. Enabled issue integrations exchange the necessary data with the destination you configure. Team features make content available to appropriately authorised team members.
Hosting in Germany does not mean subscription, purchase and integration providers only process data in Germany or the European Economic Area. RevenueCat in particular may process data in the United States. Its published DPA provides Standard Contractual Clauses for relevant transfers.
You can request further information about the relevant recipients and transfer safeguards through the privacy contact above.
12. Your rights
Contact us using the details above to exercise your rights. Each right applies subject to its legal conditions.
- Access to your personal data and a copy of that data (Article 15 GDPR).
- Rectification of inaccurate data and completion of incomplete data (Article 16 GDPR).
- Erasure and restriction of processing (Articles 17 and 18 GDPR).
- Data portability where the conditions apply (Article 20 GDPR).
- Objection on grounds relating to your particular situation to processing based on Article 6(1)(f) GDPR; no such grounds are required for objection to direct marketing (Article 21 GDPR).
- Withdrawal of consent at any time for future processing, without affecting the lawfulness of processing carried out before withdrawal.
13. Complaints
You may lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, workplace or the alleged infringement. The State Commissioner for Data Protection of Lower Saxony is a competent contact for our establishment in Lower Saxony.
14. Self-hosted installations
When you operate timeasy on your own infrastructure, your account, project and time-entry data is not transmitted to us. The operator of that installation is responsible for the processing within it. This notice does not describe the individual configuration of such installations. The relevant sections still apply when you visit our website or contact us.