Privacy Policy Last updated: August 18, 2026 In Short We keep your work logs and timesheets so the app can show them back to you. We never sell your data and never give it to advertisers. Analytics run only if you say yes, and the app works the same if you say no. Your email address is never stored in our database. You can download or delete everything yourself, at any time, from the My Footprint page. The rest of this page is the detail behind those promises. Who We Are Timesheet Buddy (tsbuddy.pro) is built and run by a small independent team. For anything about your data — a question, a request, or a complaint — write to support@tsbuddy.pro and a person will answer. For the record, the law requires us to name who is responsible for your data. That is Vitalie Andries, Chisinau, Moldova, reachable at the same address. Where you use Timesheet Buddy through an organization, responsibility is shared — see the "Organizations" section below. Data We Collect To provide Timesheet Buddy, we collect and store information you provide when using the platform: - Account information — your name and email address are held by our authentication provider (WorkOS). Your email address is never stored in our own database. What we store is your WorkOS user ID, and — if you are part of an organization — your display name and role. - Organization and client data — organization name, client names, and project names you create to organize your timesheets. - Work logs — task descriptions and timestamps you submit via the web app, mobile companion, or Slack integration. - Timesheets and templates — timesheet layouts, saved presets, and generated timesheet archives. - Calendar data — holiday calendars and day-off exceptions you configure for timesheet generation. If you connect Slack, we receive only the data sent when you use the timesheet command: your Slack user ID, the workspace and channel identifiers, the message text you submit, and its timestamp. We do not read your channels or messages beyond what you explicitly send to Timesheet Buddy. Account information is needed to sign you in — without it we cannot give you an account. Everything else is optional: the app works without Slack, without the phone app, and without analytics. Work logs sent via Slack are matched to your account through your Slack user ID, which is linked to your account when you set up the integration. Why We Process Your Data (Legal Bases) Under the GDPR, every use of your data rests on a legal basis: - Providing the service (accounts, work logs, timesheets, calendars, Slack integration) — performance of our contract with you (Art. 6(1)(b) GDPR). - Product analytics (PostHog) — your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time; withdrawing does not affect the lawfulness of processing before withdrawal. - Keeping the platform secure and preventing abuse — our legitimate interest in protecting the service and its users (Art. 6(1)(f) GDPR). Your data is used solely to operate and improve Timesheet Buddy. We do not sell, rent, or share your information with third parties for marketing or advertising purposes. Cookies We use the following cookies: - Session cookies (wos-session, en_session, en_toast) — strictly necessary to keep you signed in and the app functioning. They last for your sign-in session (en_toast is removed as soon as its notification is shown). These do not require consent. - cookie_consent — stores your analytics consent choice for 365 days. Strictly necessary. - en_theme — stores your light/dark theme preference for one year. Strictly necessary for the setting to work; set only if you pick a theme. We do not use advertising cookies or tracking pixels. Analytics With your consent, we use PostHog (hosted in the EU, Frankfurt) for product analytics. PostHog collects: - Page views, referring domains, and navigation patterns. - Browser type and version, operating system, and device type. - Approximate location (city-level, derived from your IP address; the raw IP is not stored by PostHog). - Performance metrics (page load times, web vitals). - Session data via cookies to recognize returning visitors. PostHog data is used solely to understand how the platform is used and to improve it. It is not linked to your name or email address — PostHog never receives either from us. You can accept or decline analytics cookies when first visiting the site. You can change your choice at any time from the user menu in the app. If you decline, PostHog is not loaded and no analytics data is collected — the app works the same either way. Third-Party Processors We rely on a small number of service providers that process data on our behalf. Each is bound by a data processing agreement, or by equivalent terms in their standard contract, to use it only to deliver their service to us: - WorkOS (US) — authentication and single sign-on. https://workos.com/legal/privacy - Fly.io (US company; our servers and database are located in Frankfurt, EU) — application hosting and storage. https://fly.io/legal/privacy-policy/ - Slack (US) — only if you choose to connect your Slack workspace for work logging. https://slack.com/trust/privacy/privacy-policy - PostHog (EU Cloud, Frankfurt) — product analytics, only with your consent. https://posthog.com/privacy International Transfers We do not store your data in the United States. Our application database and analytics data are hosted in Frankfurt (EU), and work-log messages you send via Slack are received and stored there too — Slack's own handling of your messages is governed by your (or your employer's) agreement with Slack. Two situations still involve US providers: - Authentication — WorkOS processes your name and email address in the United States to operate sign-in. - Hosting — Fly.io is a US company; our servers and data are in Frankfurt, but limited administrative access from the US can occur. Where that happens, the transfer is protected by safeguards approved under the GDPR. Depending on the provider, that is either the EU–US Data Privacy Framework (https://www.dataprivacyframework.gov/) or the European Commission's Standard Contractual Clauses (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en). Both are official mechanisms that require the provider to protect your data to EU standards. Data Retention and Deletion We retain your data for as long as your account is active. In addition: - We keep no backups of our own. When you delete your data it is removed from the live database at once, and we cannot bring it back. Our hosting provider takes automatic encrypted snapshots of the server disk for disaster recovery; those roll over on the provider's own schedule and we never use them to restore deleted data. If you also choose to remove your account, your WorkOS sign-in account is deleted, so the name and email held for authentication are removed too. - Account-event notifications received from WorkOS are stripped to identifiers and role before they are stored, and the records are deleted automatically at most 30 days after they are processed. - Analytics data in PostHog is kept for up to one year, which is the retention period of our current PostHog plan. - Server logs used for security and troubleshooting are kept by our hosting and error-reporting providers for their standard retention periods, and are not used for anything else. You can export or delete your data at any time from the My Footprint page (/footprint). You can also contact us at support@tsbuddy.pro if you need assistance. Your Rights Under the GDPR, you have the right to: - Access your data — export a copy of all the data we hold about you in JSON format from the My Footprint page (/footprint). The file covers your projects, work logs, timesheets and palettes, plus your Slack entries, settings, organization membership, and AI usage records. - Rectification — correct inaccurate data, either directly in the app or by contacting us. - Erasure — from the My Footprint page you can either delete all your data and keep your account, or remove your account entirely, which also deletes the name and email held for authentication. Both actions are irreversible. - Restriction — ask us to restrict processing of your data in the situations set out in Art. 18 GDPR. - Object — object to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21 GDPR). - Withdraw consent — change your analytics cookie preference at any time from the user menu in the app. - Data portability — your exported data is in a standard, machine-readable format (JSON). You can exercise any of these rights in the app or by emailing support@tsbuddy.pro. We respond within one month. You also have the right to lodge a complaint with your local data protection authority (the supervisory authorities of all EU member states are listed at https://www.edpb.europa.eu/about-edpb/our-members_en). Organizations If you use Timesheet Buddy as part of an organization, your organization decides what work data its members log and how it is used. For work logs and timesheets managed by your organization, the organization is the data controller and we process that data on its behalf as a processor. Requests about organization-managed data may need to be directed to your organization; we will assist either way. Organizations that need a data processing agreement can contact us at support@tsbuddy.pro. Automated Decision-Making We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects for you. Security We use HTTPS encryption for all data in transit and follow industry-standard practices to protect your data at rest. If a data breach ever affects your personal data, we will notify the competent supervisory authority and, where required, affected users, as the GDPR obliges us to. Children Timesheet Buddy is a work tool and is not directed at children under 16. We do not knowingly collect data from children. Changes to This Policy We may update this policy from time to time. Changes will be posted on this page with an updated date, and we will notify you of material changes by email or an in-app notice before they take effect. Contact Questions about this policy? Reach us at support@tsbuddy.pro.