hourino

Privacy Policy

Last updated: [[TODO: date this takes effect]]

1. Who is responsible for your data

Hourino is operated by [[TODO: legal entity name]], registered at [[TODO: registered address]], company ID [[TODO: company ID / IČO]] ("we", "us"). We are the data controller for the personal data described below.

For anything in this policy, write to [[TODO: privacy contact e-mail]].

2. Two kinds of data, and why the difference matters

Hourino holds two things that are easy to confuse. Keeping them apart is the whole shape of this policy.

  • Your account data. What we need to give you an account: your e-mail address, your name, a hash of your password, and your workspace membership. For this we are the controller.
  • Your work content. Everything you track: time entries and their descriptions, clients, projects, tags, rates and reports. Some of it describes your clients, not you. For this content we act on your behalf — you decide what goes in, and you can export or delete it.

If you use Hourino for clients in the EU and their personal data ends up in your entries, you are the controller of that data and we are your processor. Ask us for a data processing agreement at the address above.

3. What we collect

Because you have an account

  • e-mail address, name, hashed password, chosen language,
  • workspace and team membership, role, hourly rate if one is set,
  • two-factor authentication secret, if you turn 2FA on,
  • invitation records (who invited whom, and when).

Because you use the service

  • time entries: description, start and end, billable flag, project, client, tags,
  • projects, clients, tags, rates and the reports built from them,
  • access tokens for integrations you connect yourself — encrypted, see section 7.

Because the service runs on the internet

  • IP address and browser user agent, in server logs and for rate limiting — this is how we stop someone hammering the login form,
  • technical details of errors: which request failed, on what version, with what stack trace. What we deliberately keep out of error reports is in section 6.

We do not buy data about you, we do not build advertising profiles, and we do not sell anything to anyone.

4. Why we are allowed to process it

  • Performance of a contract (Art. 6(1)(b) GDPR) — running your account and the service, including transactional e-mails such as e-mail verification, password reset and workspace invitations. You cannot opt out of these and still have a working account.
  • Legitimate interest (Art. 6(1)(f)) — keeping the service up and secure: server logs, rate limiting, captcha on sign-up, error monitoring, backups. Our interest is a service that works and is not abused; the data used for it is minimal and technical.
  • Consent (Art. 6(1)(a)) — optional features you switch on yourself, such as connecting an integration or dictating an entry. Withdraw it by disconnecting the integration or not using the feature.
  • Legal obligation (Art. 6(1)(c)) — keeping invoices and accounting records for as long as the law requires.

5. Who else sees it

Only the providers we need to run the service, and only the data each of them needs. The full list — what each one is for, what it receives and where it sits — is on the sub-processors page, which we keep current because it is the honest answer to "where does my data actually go".

Where a provider processes data outside the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision. The sub-processors page says which applies to whom.

6. What we keep out of error reports

Error monitoring is where a service quietly leaks its customers' data, so we cut it at the source instead of promising to be careful:

  • request bodies are discarded whole — that is where entry descriptions and passwords live,
  • cookies and query strings are discarded — links from our e-mails carry one-time tokens,
  • fields named like secrets (password, token, apiKey…) are masked, and so are description and note, because that is your clients' work and not a technical detail,
  • in the browser, console messages are dropped entirely and click descriptions lose their attribute values — a project row's tooltip would otherwise carry a client's name,
  • IP addresses are not attached to error reports.

Your e-mail address is not masked. Without knowing whose account broke, an error report is not worth having.

7. How we protect it

  • passwords are hashed with Argon2id — we never store or see the password,
  • access tokens for integrations are encrypted with AES-256-GCM before they touch the database,
  • two-factor authentication (TOTP) is available on every account, and we recommend turning it on,
  • database backups are encrypted before they leave the server, so the storage provider holds a file it cannot read,
  • traffic is encrypted in transit (HTTPS/TLS),
  • access to production is limited to people who need it, and the database is not reachable from the internet.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify the supervisory authority within 72 hours where required, and you directly where the risk to you is high.

8. How long we keep it

  • While your account exists — account data and work content stay until you delete them or close the account.
  • After you close your account — [[TODO: confirm 30]] days, so an accidental deletion can be undone. After that, deletion is permanent.
  • Backups — up to [[TODO: confirm 30]] days, after which older copies are removed automatically. Data deleted from the live service can therefore persist in backups for that long.
  • Server logs — [[TODO: confirm log retention]].
  • Error reports — [[TODO: confirm Sentry retention]].
  • Invoices and accounting records — as long as tax law requires, whether or not your account still exists.

9. Your rights

You can ask us to:

  • tell you what we hold about you and give you a copy (access, portability),
  • correct anything wrong (rectification),
  • delete your data (erasure),
  • restrict or stop a particular processing (restriction, objection),
  • withdraw a consent you gave — without affecting what happened before.

Write to [[TODO: privacy contact e-mail]]. We answer within one month. Some of this you can do yourself: export reports from the app, edit or delete entries, and delete your account from settings.

If you think we are handling your data wrongly, you can complain to your local data protection authority. In the Czech Republic that is the Office for Personal Data Protection (ÚOOÚ).

10. Cookies and local storage

The marketing site sets no cookies and does no advertising or cross-site tracking.

The app stores your session and a few preferences (chosen language, for instance) in your browser's local storage. It is not used for tracking and cannot be switched off without breaking sign-in — without it you would be logged out on every page load.

If web analytics is switched on, it measures page views and clicks on a few buttons — no cookies, no cross-site identifiers, no profiles — and it is listed on the sub-processors page. Where the tool stores something in your browser, nothing loads before you allow it.

The full list of what is stored, under which name and for how long, is on the cookies and local storage page.

11. Children

Hourino is a tool for work and is not intended for anyone under 16. We do not knowingly collect their data; if you believe a child has an account, tell us and we will remove it.

12. Changes

When we change this policy we update the date at the top. If a change materially affects you we will tell you by e-mail or in the app before it takes effect — not by quietly editing this page.