Privacy Policy

1. Who is responsible

The controller for the Hourlo app and the website hourlo.donner.io under the General Data Protection Regulation (GDPR) is:

Dennis Donner
Eduard-v-Winterstein-Straße 11
14480 Potsdam
Germany
Email: app-support@donner.io

There is no data protection officer, as none is required by law. Send any privacy question or request to the email address above.

2. In short

3. Data stored on your device

Everything you enter in Hourlo stays in a local database on your iPhone: workspaces, clients, projects, categories, tags, time entries with notes, hourly rates, currencies, targets and schedules, places for automations and your settings. I have no copy of it and cannot see it.

The data is part of your iPhone backup (iCloud or computer) if you have device backups turned on; Apple’s terms apply to those backups. You can delete single records at any time or erase everything with Delete All Data in the app. Deleting the app removes the local data as well.

Legal basis: performance of the contract for using the app (Art. 6(1)(b) GDPR).

4. Apple Watch, widgets, Live Activity and Siri

The Watch app exchanges the running timer and recent entries directly with your iPhone through Apple’s WatchConnectivity. Widgets, the Live Activity on the Lock Screen and in the Dynamic Island, and the Siri and Shortcuts actions read the same local data through a shared container on the device. None of this passes through a server.

A Live Activity and widgets can be seen by anyone who looks at your screen. Requests you speak to Siri are processed by Apple under Apple’s own privacy policy.

5. Calendar (Fix My Day)

Fix My Day can match untracked gaps in your day with your calendar events. Hourlo only asks for calendar access when you choose this option. It then reads the titles and times of events for the day shown, on your iPhone, to suggest entries. Hourlo never changes your calendar and never uploads events. A suggestion only becomes an entry when you apply it.

Legal basis: your permission in iOS (Art. 6(1)(a) GDPR), which you can withdraw at any time in the iOS settings.

6. Location and place automations

Place automations start or stop a timer when you arrive at or leave a place. For this, Hourlo stores the place’s coordinates, radius and name on your iPhone and registers the area with iOS region monitoring. iOS wakes the app when you cross the area, also in the background, which is why automations need the location permission “Always”. Hourlo does not record a route or location history and does not send your location to the developer or to analytics services.

When you search for a place or an address, the search text and the visible map region are sent to Apple Maps to return results (Apple’s privacy policy applies). Showing your current position on the map uses location access while the app is in use.

Automations are best-effort: iOS decides when region events are delivered, so times can be late or missing. Legal basis: your permission in iOS (Art. 6(1)(a) GDPR). Without it, the rest of Hourlo works normally.

7. Notifications

Hourlo only uses local notifications that are scheduled on your iPhone, for example timer reminders, questions from place automations and backup reminders. There is no push server. You decide in iOS whether Hourlo may show notifications (Art. 6(1)(a) GDPR).

8. Reports, exports and backups

PDF reports, CSV files, invoices and JSON backups are created on your iPhone. They contain the records you select, such as clients, projects, times, notes, rates and totals. Hourlo hands the file to the iOS share sheet; you decide where it goes, and the receiving app or person is responsible from then on. Restoring a backup reads a file you pick and replaces the data on the device.

9. Usage analytics (Amplitude)

To understand which features are used and where the app fails, Hourlo sends usage events to Amplitude, Inc., stored in Amplitude’s EU data centre. Analytics run from the first launch; the app currently has no switch to turn them off (see “Your rights” for how to object).

What is sent: events such as onboarding steps, the notification permission request and its result, a timer started, paused, resumed, switched or stopped, an entry edited or deleted, a workspace, client, project or automation created, Fix My Day applied, a report exported (with its format and period) or a failed export, tab switches, a rating prompt requested, sessions and app open/close, and an error message being shown (with the screen and a technical error code). With them go a random device ID created by the Amplitude SDK, the app version, platform, device model, operating system, app language and region, an internal flag for unlocked features (currently the same for everyone, because no purchases are offered) and, if available, the App Store attribution data described below.

What is not sent: names of clients, projects or places, notes, rates or totals, coordinates, calendar content or your contacts. Amplitude is configured not to store your IP address and not to collect the iOS vendor ID, mobile carrier, city or region. Hourlo does not use the advertising identifier (IDFA) and does not track you across other companies’ apps.

Provider: Amplitude, Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA. Privacy policy: amplitude.com/privacy.

Legal basis: my legitimate interest in improving the app and fixing problems (Art. 6(1)(f) GDPR).

10. Crash reports and performance (Google Firebase)

Hourlo uses Firebase Crashlytics, Firebase Performance Monitoring and Google Analytics for Firebase from Google Ireland Limited. When the app crashes, a crash report with the stack trace, device model, operating system, app version and an installation ID is sent. Performance Monitoring measures, for example, app start time and the duration of network requests made by the app. Google Analytics for Firebase records basic usage events collected automatically by the SDK, such as first open, sessions and app updates, with an app instance ID; Google derives an approximate country from the IP address. None of this contains your records.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company Google LLC, USA). Privacy policies: policies.google.com/privacy and firebase.google.com/support/privacy.

Legal basis: my legitimate interest in a stable, fast app (Art. 6(1)(f) GDPR).

11. App Store attribution (Apple AdServices)

Once per installation, Hourlo asks iOS for an attribution token and sends it to Apple’s attribution service (api-adservices.apple.com). Apple answers whether the download came from an Apple Search Ads campaign and, if so, the campaign and country. Hourlo keeps this result on the device and adds it to the analytics data above as “acquisition” properties. No advertising identifier is used and no tracking permission is requested. Apple’s privacy policy applies: apple.com/legal/privacy. Legal basis: my legitimate interest in knowing which campaigns work (Art. 6(1)(f) GDPR).

12. In-app purchases (not active)

Hourlo currently offers no in-app purchases; every feature can be used without paying. The app contains the software library of RevenueCat, Inc. (USA) for a possible paid version later. It is not activated and sends no data. Before purchases are introduced, this policy will be updated. RevenueCat’s privacy policy: revenuecat.com/privacy.

13. Rating prompt

After you have used Hourlo for a while, the app may ask iOS to show Apple’s standard rating dialog. Whether it appears, and what you submit, is handled by Apple. I only see the public ratings and reviews in the App Store.

14. Contact and support

If you email me at app-support@donner.io, I process your address, your message and whatever you include (for example device and iOS version) to answer you. Legal basis: Art. 6(1)(b) GDPR for questions about the app you use, otherwise my legitimate interest in answering (Art. 6(1)(f) GDPR). Please do not send exports or backups unless I ask for them.

15. This website

hourlo.donner.io is a static website. It sets no cookies, uses no analytics or tracking, has no forms or embedded content and loads fonts, images and scripts only from its own server. No cookie banner is needed for that reason.

When you click EN or DE, the site stores your choice under the key hourlo-lang in your browser’s local storage, and the English start page reads it (or your browser language) to show the German version. The value never leaves your browser; you can delete it with your browser data.

To deliver the pages, the web server processes your IP address, date and time, the requested address, the referring page and your browser’s user agent. Such server logs serve operation and security only and are deleted by the hosting configuration. Legal basis: my legitimate interest in a secure website (Art. 6(1)(f) GDPR). Links to the App Store lead to Apple, where Apple’s privacy policy applies.

16. Recipients

Amplitude, Google and the hosting and email providers act as processors under data processing agreements where the GDPR requires one. Apple acts under its own responsibility. Personal data is not sold.

17. Transfers outside the EU

Amplitude, Google and Apple are or belong to US companies, so access from the USA cannot be ruled out even when data is stored in the EU. Transfers rely on the EU–U.S. Data Privacy Framework where the company is certified, and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

18. How long data is kept

• On your device: until you delete it, use Delete All Data or remove the app.
• Analytics, crash and performance data: only as long as needed to analyse use and errors, then deleted or anonymised according to the retention settings of each service.
• Support emails: deleted when your request is closed, unless commercial or tax law requires them to be kept longer.
• Server logs: only as long as needed for operation and security.

19. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw a consent at any time with effect for the future (Art. 7(3)).

Because there is no account and your records stay on your device, I can often only identify analytics data if you give me the device ID concerned; I will help you with this. You can also lodge a complaint with a supervisory authority, for example the one responsible for me:

Brandenburg Commissioner for Data Protection and Access to Information (Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg)
Stahnsdorfer Damm 77
14532 Kleinmachnow
Germany

20. Children

Hourlo is a tool for tracking working time and is not directed at children under 16. I do not knowingly process personal data of children.

21. Permissions and how to revoke them

• Location (place automations): iOS Settings → Hourlo → Location. Choose “Never” to stop automations; “While Using” only allows showing your position on the map.
• Calendars (Fix My Day): iOS Settings → Hourlo → Calendars.
• Notifications: iOS Settings → Hourlo → Notifications.

Revoking a permission only switches off the feature that needs it; your records are not affected.

22. Security

Your records are protected by the data protection of iOS when your iPhone has a passcode. All connections of the app and of this website are encrypted with TLS. Because the data is not on a server, it cannot leak from one. Keep your exports and backups as safe as the records themselves.

23. Changes to this policy

I update this policy when the app or the website changes. The current version is always available at hourlo.donner.io/privacy/.