Privacy Policy

Overview

Chrontic is a time tracking app for companies to manage employee time, projects, and leave. This policy covers the Chrontic web app (chrontic.com) in Part 1, and our optional Chrome Extension & JetBrains plugin in Part 2 — those only activate once installed and configured with an API key, never just from visiting a page.

For most users, your employer is the data controller and Chrontic is the data processor. Please direct data requests to your employer first; we help them fulfill it. You can also reach us at support@chrontic.com.

What We Collect

• Account: name, email, bcrypt-hashed password, profile picture (if you sign in with Google)
• Employment data: an employee ID, plus optional fields your employer may fill in such as cost center, payroll code, hire date, or salary/hourly rate
• Time & leave data: time entries, leave requests and balances, organizational unit, job title
• Billing (company admins only): billing email/name shared with Stripe; we never see card numbers
• Optional integrations: if you or your admin connect Jira, Outlook, or Tempo, we read/write ticket info, calendar events, or worklogs from that service
• Server log files: our web server records each request with your IP address, date and time, the page requested, the response status, and your browser and operating system version

Where employee data comes from (Art. 14 GDPR). If you use Chrontic as an employee, most of the data above did not come from you directly — your employer entered it, or it was synced from an integration your employer connected. Your employer decides which optional fields (such as cost center, payroll code, or salary) are filled in at all.

Is providing this data required? Name, email, and time-tracking data are necessary for the Service to function and for your employer's working-time records; without them the account cannot be used. The employment fields listed above are optional and are set by your employer. Providing analytics consent is entirely voluntary and has no effect on your use of the Service.

Cookies, Security & Hosting

• No session cookies — sign-in uses a token stored in your browser's local storage. This storage is strictly necessary to provide the Service you requested and therefore needs no consent under §25(2) TDDDG
• Analytics (Google Analytics) stores cookies on your device only if you accept our cookie banner. If you decline, no cookies are set and no identifier is stored on your device. Be aware, though, that the Google Analytics script is loaded when the page opens, before you answer the banner — so Google receives your IP address and browser information on that first page view either way. You can change your choice at any time via "Cookie Settings" in the footer of this page
• Server log files are kept for up to 14 days for security and fault diagnosis, then deleted
• All traffic is encrypted (HTTPS); servers are hosted in Germany, within the EU

Who We Share Data With

Hetzner (hosting, in Germany), Zoho (sending our transactional email), Sentry (server error monitoring, EU region), Stripe (billing), Google (sign-in and analytics), and Atlassian/Microsoft/Tempo (only if you connect those integrations). We don't sell your data or share it with advertisers. Some providers may transfer data outside the EU/EEA; our Subprocessors page names each provider, its location, and the transfer safeguard relied on, and you can request a copy of those safeguards from us.

Legal Basis for Processing

• Employee time tracking & employment data: Art. 6(1)(b) GDPR — performance of the contract between your employer and Chrontic
• Billing data: Art. 6(1)(b) GDPR — performance of the contract
• Analytics cookies (only if accepted): Art. 6(1)(a) GDPR — consent, which you can withdraw anytime via "Cookie Settings" in the footer
• Loading the analytics script before your choice (and cookieless measurement if you decline): Art. 6(1)(f) GDPR — our legitimate interest in understanding aggregate site usage; no identifier is stored on your device
• Server log files, security & fraud prevention: Art. 6(1)(f) GDPR — our legitimate interest in operating the Service securely and diagnosing faults

No automated decision-making. We do not use your personal data for automated decision-making or profiling that produces legal effects for you or similarly significantly affects you (Art. 22 GDPR).

Retention & Your Rights

We retain personal data for as long as your organization's Chrontic account is active. When the account is closed, identifying employee data (name, email, and other identifying profile fields) is irreversibly anonymized, and stored integration credentials are deleted.

Time entry and leave records are not deleted at that point. They are kept in pseudonymized form — no longer attributable to a named person — because your employer is typically subject to statutory retention duties for wage and working-time records (for example §257 HGB, §147 AO, and §41 EStG, which run for six to ten years from the end of the relevant calendar year). Your employer, as the controller, can instruct us in writing to delete those records where no such duty applies. We do not currently run an automated job that purges pseudonymized records once their retention period expires.

Server log files are kept for up to 14 days. Billing records are kept for the statutory periods above.

Your rights. You have the right to access your data (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20), and to withdraw any consent you have given at any time with effect for the future (Art. 7(3)) — for analytics consent, via "Cookie Settings" in the footer of this page.

Right to object (Art. 21 GDPR). Where we process your personal data on the basis of our legitimate interests — which, on this site, means the analytics script load, cookieless measurement, server log files, and security — you have the right to object to that processing at any time on grounds relating to your particular situation. If you object, we will stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. To object, write to support@chrontic.com.

You can review and correct your profile directly in the app. For erasure, export, or other GDPR requests, email support@chrontic.com (self-service tools are on our roadmap), or contact your employer if they're the data controller. You may also lodge a complaint with a data protection authority. If you're located in Berlin, the competent authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), www.datenschutz-berlin.de; other locations have their own competent authority.

Chrontic UG (haftungsbeschränkt) is not required to appoint a Data Protection Officer under Art. 37 GDPR / §38 BDSG.

Only Active When Installed & Configured

Our Chrome Extension and JetBrains plugin are optional and collect nothing until you've installed and configured them with a Chrontic API key — visiting chrontic.com, a JIRA page, or using your IDE otherwise triggers no data collection.

Once set up, they read JIRA ticket IDs, page titles, and activity timestamps from pages you view, and store settings/tracking state locally in your browser — never on our servers. Time entries are sent only to the Chrontic server URL you configure. No analytics, tracking, or third-party sharing. They never access passwords, financial data, screenshots, or non-JIRA browsing history.

You can pause tracking, change settings, or uninstall at any time; uninstalling removes all locally stored data.

Children's Privacy & Policy Changes

Chrontic is a workplace product, not directed at children under 16, and we don't knowingly collect their data. We may update this policy from time to time; changes are reflected in the "Last Updated" date above.

Company Information

Chrontic UG (haftungsbeschränkt)
Kolonnenstraße 8, 10827 Berlin, Germany
Managing Director: Abdullah Sohrab Khan
Email: support@chrontic.com