Privacy Policy
Last updated: July 29, 2026
Who we are
WorkSnap is operated by Tomasz Stryczyński, trading as a sole proprietor registered in Poland, NIP PL7822007919.
Contact for any privacy question or request: info [at] worksnap [dot] eu . This email is the sole point of contact for data protection matters — no postal address is published.
What we collect
- Account data: email address, name (if provided), password (hashed) or Google account identifier if you sign in with Google, timezone, currency and billing-rate preferences.
- Time tracking data: the entries you create — descriptions, timestamps, project and client names, billable status, rates you set.
- Technical data: standard web server logs (IP address, user agent) for security and abuse prevention; error reports when the application crashes (see Flare, below).
We do not collect payment card data, government ID numbers, or any special category of data (Art. 9 GDPR) as part of normal product use.
Why we process it (legal basis)
| Purpose | Legal basis |
|---|---|
| Providing the time-tracking service you signed up for | Performance of a contract (Art. 6(1)(b) GDPR) |
| Account security, fraud and abuse prevention | Legitimate interest (Art. 6(1)(f) GDPR) |
| Sending transactional email (verification, password reset) | Performance of a contract |
| Aggregate, non-identifying analytics (Umami) | Legitimate interest — no cookies, no personal identifiers, so this doesn’t require consent |
We do not use your data for advertising, profiling, or automated decision-making with legal effect.
Who else processes it
- Google Cloud — hosts the application, database and backups, region
europe-west1(Belgium, EU). Infrastructure provider; does not use the data for its own purposes. - Flare (flareapp.io) — receives error reports and performance traces when the application encounters a bug, to help us fix it. Does not receive your time-entry content as a matter of course.
- Resend (resend.com) — delivers transactional email (verification links, password resets) on our behalf. Sees the recipient address and the content of those specific messages.
- Google — only if you choose “Sign in with Google”: confirms your identity for login. Does not receive access to your time entries or reports.
- Umami (self-hosted,
umami.eadmin.pl, EU) — counts page views and anonymous interactions on the public site: which pages are read and which buttons are clicked, never who clicked them. Configured without cookies and without personal identifiers; it cannot identify you.
We do not sell data to any of the above, and none of them are advertising companies.
International transfers
Google Cloud, for this deployment, is configured in the EU (europe-west1) — hosting and the database do not transfer data outside the EEA. Resend, our transactional email provider, is a US-based company; where sending your email involves a transfer outside the EEA, we rely on appropriate safeguards under GDPR Chapter V (such as Standard Contractual Clauses).
How long we keep it
We keep your account data for as long as your account exists. If your account is deleted, we retain the underlying data for 30 days afterwards, then permanently and irreversibly erase it.
Your rights
Under GDPR, you have the right to:
- Access the data we hold about you.
- Rectify inaccurate data.
- Erase your data (“right to be forgotten”) — see account deletion, below.
- Export your data in a portable format — CSV, XLSX or PDF, any time, free, from the Reports section.
- Object to processing based on legitimate interest.
- Lodge a complaint with your local data protection authority. In Poland, this is the Prezes Urzędu Ochrony Danych Osobowych (UODO).
Account deletion
You can close your account yourself, any time, from Settings → Close account. Closing is not immediate erasure: your data is kept for 30 days, during which you can restore the account yourself with a link we email you. After that period, everything is permanently and irreversibly deleted. If you can’t sign in, contact us at info [at] worksnap [dot] eu and we’ll close it for you.
Cookies
The only cookies WorkSnap sets are strictly necessary: the framework session cookie, a CSRF token, and a “remember me” cookie that keeps you signed in between visits. The session and remember-me cookies both expire after 90 days without a visit, and signing out deletes them immediately. Your theme (light/dark) follows your device’s system preference and isn’t stored in a cookie at all. None of these require consent under EU law, and none of them are used for tracking or advertising. See What we do with your data for the full explanation of why there’s no cookie banner.
Changes to this policy
We’ll update the “Last updated” date above whenever this policy changes, and material changes affecting how your data is used will be communicated by email.
Contact
Questions, requests, or complaints about your data: info [at] worksnap [dot] eu .