Privacy Policy
Last updated: October 18, 2026
Who we are
WorkSnap is operated by Tomasz Stryczyński, trading as a sole proprietor registered in Poland, NIP PL7822007919.
Contact for any privacy question or request: info [at] worksnap [dot] eu . This email is the sole point of contact for data protection matters — no postal address is published.
What we collect
- Account data: email address, name (if provided), password (hashed) or Google account identifier if you sign in with Google, timezone, currency and billing-rate preferences.
- Time tracking data: the entries you create — descriptions, timestamps, project and client names, billable status, rates you set.
- Technical data: standard web server logs (IP address, user agent) for security and abuse prevention; error reports when the application crashes (see Flare, below).
- Feedback and reports: ratings, opinions and suggestions you send us through the app, your consents to be contacted about them or to have them published, and the display name you choose for publication.
We do not collect payment card data, government ID numbers, or any special category of data (Art. 9 GDPR) as part of normal product use.
Why we process it (legal basis)
| Purpose | Legal basis |
|---|---|
| Providing the time-tracking service you signed up for | Performance of a contract (Art. 6(1)(b) GDPR) |
| Account security, fraud and abuse prevention | Legitimate interest (Art. 6(1)(f) GDPR) |
| Sending transactional email (verification, password reset, and the forgotten-timer reminder if you turn it on) | Performance of a contract |
| Aggregate, non-identifying analytics (Umami) | Legitimate interest — no cookies, no personal identifiers, so this doesn’t require consent |
We do not use your data for advertising, profiling, or automated decision-making with legal effect.
Who else processes it
- Google Cloud — hosts the application and database in region
europe-west1(Belgium, EU), with backups stored in the EU. Infrastructure provider; does not use the data for its own purposes. - Flare (flareapp.io), operated by Facade BV, Antwerp, Belgium — receives error reports and performance traces when the application encounters a bug, to help us fix it. This data is stored in the EU (Frankfurt); error reports are deleted after 40 days, traces and logs after 30.
- Resend (resend.com) — delivers transactional email (verification links, password resets, the forgotten-timer reminder if you turn it on) on our behalf. Sees the recipient address and the content of those specific messages.
- Google — only if you choose “Sign in with Google”: confirms your identity for login. Does not receive access to your time entries or reports.
- Umami (self-hosted,
umami.eadmin.pl, EU) — counts page views and anonymous interactions on the public site: which pages are read and which buttons are clicked, never who clicked them. Configured without cookies and without personal identifiers; it cannot identify you.
We do not sell data to any of the above, and none of them are advertising companies.
International transfers
Google Cloud, for this deployment, is configured in the EU (europe-west1) — hosting and the database do not transfer data outside the EEA. Flare stores and processes the error reports and traces it receives in the EU (Frankfurt), so they do not leave the EEA either. Resend, our transactional email provider, is a US-based company; where sending your email involves a transfer outside the EEA, we rely on appropriate safeguards under GDPR Chapter V (such as Standard Contractual Clauses). You can ask for details of the safeguards that apply by writing to info [at] worksnap [dot] eu
.
How long we keep it
We keep your account data for as long as your account exists. If your account is deleted, we retain the underlying data for 30 days afterwards, then permanently and irreversibly erase it.
Your rights
Under GDPR, you have the right to:
- Access the data we hold about you.
- Rectify inaccurate data.
- Erase your data (“right to be forgotten”) — see account deletion, below.
- Restrict processing in the cases the GDPR provides for — for example while we check a correction you have asked for.
- Export your data in a portable format (the right to data portability) — CSV, XLSX or PDF, any time, free, from the Reports section.
- Object to processing based on legitimate interest.
- Lodge a complaint with your local data protection authority. In Poland, this is the Prezes Urzędu Ochrony Danych Osobowych (UODO).
Account deletion
You can close your account yourself, any time, from Settings → Close account. Closing is not immediate erasure: your data is kept for 30 days, during which you can restore the account yourself with a link we email you. After that period, everything is permanently and irreversibly deleted. If you can’t sign in, contact us at info [at] worksnap [dot] eu and we’ll close it for you.
Cookies
The only cookies WorkSnap sets are strictly necessary: the framework session cookie, a CSRF token, and a “remember me” cookie that keeps you signed in between visits. The session and remember-me cookies both expire after 90 days without a visit, and signing out deletes them immediately. Your theme (light/dark) follows your device’s system preference and isn’t stored in a cookie at all. None of these require consent under EU law, and none of them are used for tracking or advertising. See What we do with your data for the full explanation of why there’s no cookie banner.
Changes to this policy
We’ll update the “Last updated” date above whenever this policy changes. If a change materially affects how your data is used, we’ll also announce it inside WorkSnap.
Contact
Questions, requests, or complaints about your data: info [at] worksnap [dot] eu .