Privacy Policy

Last updated: September 2026

Controller

Kevin Weinberger, Adalbert-Stifter-Str. 8, 70437 Stuttgart, Germany, e-mail: support@projektzeit.app

No data protection officer has been appointed, as the statutory conditions for doing so are not met (Art. 37 GDPR, § 38 BDSG).

In short

We receive none of the data recorded in the app: there is no user account, no server of ours and no analytics or tracking. The data stays on the user's own devices and, where turned on, in the user's own iCloud and in the backup folder the user chose.

Data on the device

The app stores the entered projects, time entries, notes, settings and an optional logo locally on the device. This storage is necessary for the app to work (§ 25 (2) no. 2 TDDDG, the German implementation of the ePrivacy rules) and needs no consent. We have no access to this data. Widgets, Live Activities and shortcuts only access this local data. For shortcuts through Siri, Apple processes the voice input under Apple's privacy policy. How long the data is kept is decided by the users themselves. It is deleted in the app with “Delete All Data…”, and on iPhone and iPad also by deleting the app.

iCloud sync

Syncing through iCloud is a separate decision on every device. The app asks during setup and only after consent transfers this data through the user's own iCloud account between the user's own devices. The data lives in the private iCloud database, which can only be read with that account. This service is provided by Apple under Apple's privacy policy: https://www.apple.com/legal/privacy/. A transfer to third countries, in particular the United States, may take place; the safeguards required under Chapter V GDPR are Apple's responsibility and are described in Apple's privacy policy. The legal basis for syncing is consent (Art. 6 (1) (a) GDPR). It can be withdrawn at any time with effect for the future by turning sync off in the app's settings (Art. 7 (3) GDPR), the device then keeps its data. Settings are synced through the app's iCloud key-value storage. In iCloud the data remains until it is removed with “Delete All Data…” while sync is on; turning sync off or deleting the app does not remove it there. So that the introduction can show whether iCloud already holds data, it asks iCloud for the number of stored projects and entries before the decision; no contents are read or transferred.

Automatic backup

If the automatic backup is set up, the app writes a file with the projects and entries into a folder chosen by the user, on the device or at a cloud storage service of the user's choice. That provider's terms apply to the files there. We have no access to that folder. The backup can be turned off at any time in the settings, and the files can be deleted.

In-app purchases

Subscriptions and the free trial are handled by the App Store. The trial is a free in-app purchase, ends by itself after seven days and does not turn into a subscription. Apple processes payment and purchase data as an independent controller. We do not receive any personal data in the process. The app verifies Apple's purchase confirmations on the device, also to know the trial's start date.

Diagnostics

The app contains no diagnostics or crash reporting service of its own. If the option “Share With App Developers” is turned on in the device settings, we receive anonymised crash reports and aggregated usage statistics from Apple with no link to a person. We use them solely to fix bugs. The legal basis is our legitimate interest in a stable app (Art. 6 (1) (f) GDPR). This option can be turned off at any time in the device settings.

Contact by e-mail

For a request by e-mail, we process the e-mail address and the content of the message to answer the request. The legal basis is Art. 6 (1) (b) GDPR where a subscription is concerned, otherwise our legitimate interest in answering (Art. 6 (1) (f) GDPR). The mailbox is run by Infomaniak Network SA in Switzerland as our processor (Art. 28 GDPR). The European Commission has found Switzerland to provide an adequate level of data protection, so a transfer there needs no additional safeguards (Art. 45 GDPR). Beyond that, we do not pass this data on and delete it once the request is settled and no statutory retention duty applies. Providing an e-mail address is required neither by law nor by contract; without one, however, a request cannot be answered. If the e-mail is created from within the app, the app fills in the app version, device model, system version and language and region; on iPhone and iPad it attaches a screenshot of the current screen if the user chooses. The draft can be seen and changed before sending.

The website projektzeit.app

The website projektzeit.app consists of static pages. It sets no cookies, stores nothing in the browser, uses no analytics or tracking services and loads no content from third parties.

When the pages are accessed, the hosting provider Infomaniak Network SA in Switzerland stores server log data: IP address, time of access, requested page and browser identifier (user agent). This data serves the operation and security of the website. The legal basis is our legitimate interest in secure operation (Art. 6 (1) (f) GDPR). The provider processes it as our processor (Art. 28 GDPR). It is deleted once it is no longer needed for the operation and security of the website; the provider states that access and error logs are kept for at least seven days. The European Commission has found Switzerland to provide an adequate level of data protection, so a transfer there needs no additional safeguards (Art. 45 GDPR).

Links to the App Store and to Apple's terms of use lead to third-party services. The privacy policy of the respective provider applies there. The controller for the website is the controller named above.

Rights of data subjects

Where we process personal data, the rights of access, rectification, erasure, restriction of processing and data portability apply (Art. 15 to 20 GDPR). Requests are received at the address above. The data recorded in the app is managed entirely by the users themselves. We can neither read it nor delete it. There is also the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place.

Right to object

Where we process personal data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), there is a right to object to that processing on grounds relating to the particular situation of the data subject (Art. 21 (1) GDPR). An informal message to the address above is enough. We will then stop processing the data, unless we can demonstrate compelling legitimate grounds that override the interests, rights and freedoms of the data subject.

Language versions

This privacy policy is written in German. The English version is a translation provided for convenience. In the event of any discrepancy between the two, the German version prevails.