Privacy policy

Last updated: November 2026. This is a translation for convenience. The German version is legally binding.

This privacy policy explains which personal data is processed when you visit this website and when you use the "Issue Stopwatch" app (Android app and web app at issue-stopwatch.web.app), for what purpose and on what legal basis, and which rights you have.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Stefan Steinert
Finkenweg 44
91629 Weihenzell
Germany
Email: issue-stopwatch@stefan-steinert.de

No data protection officer has been appointed, as there is no legal obligation to do so. If you have questions about data protection, please contact the email address above.

2. This website

2.1 Hosting and server log files

This website is served via GitLab Pages, a service of GitLab Inc. (USA). When you access the website, the hosting provider processes technically necessary data transmitted by your browser:

• IP address of the requesting device
• date and time of access
• page or file requested and amount of data transferred
• referrer URL (previously visited page), if transmitted
• browser type, browser version and operating system (user agent)

This processing is necessary to deliver the website and to ensure stable and secure operation. The legal basis is our legitimate interest in providing the website securely and reliably (Art. 6(1)(f) GDPR). The retention period of the log files is determined by GitLab. For more information, see GitLab's privacy statement.

2.2 No cookies, no tracking

This website does not set cookies, does not use analytics or tracking tools and does not embed third-party content. Stylesheets and images are loaded directly from the server of this website, and no external fonts are used. Only when you click a link, for example to Google Play or the web app, do you go to that service. Its privacy policy then applies.

2.3 Contact by email

If you contact us by email, we process your email address, your name (if provided) and the content of your message in order to respond to your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to the use of the app, and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete the data once your request has been dealt with, unless statutory retention obligations apply.

3. The Issue Stopwatch app

3.1 Technical basis: Google Firebase

The app uses services of the Google Firebase platform for user accounts, data storage and server functions. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google processes the data on our behalf under a data processing agreement (Art. 28 GDPR). Our server functions (Google Cloud Functions) run in the Frankfurt am Main data centre. A transfer of data to Google LLC in the USA cannot be ruled out (see section 4).

3.2 User account

A user account is required to use the app. We use Firebase Authentication and process:

• email address and password (Google stores the password only as a hash; we cannot see it)
• a unique user ID and the times of registration and sign-in
• optionally a display name and a profile picture, which is stored in Firebase Storage
• when signing in with Google: name, email address and profile picture of your Google account
• the IP address at sign-in, to detect abuse

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

3.3 Trackers, time tracking and reports

So that you can use the app across devices, we store your content in Google Cloud Firestore:

• Trackers: name, type (e.g. Jira, GitLab, YouTrack), URL, username or email address, password or access token, and your settings
• Tracks: issue ID or key, title, optional comment, start and end times, duration
• Reports: time aggregated by day, month and year from your tracks and synchronised worklogs

Passwords and tokens for your trackers are stored encrypted, using a key pair generated for your account. So that our server functions can communicate with your issue tracker on your behalf (e.g. during synchronisation), they briefly decrypt these credentials for that purpose. The legal basis is Art. 6(1)(b) GDPR.

3.4 Communication with your issue tracker

To search for issues and log time, the app sends requests to the issue tracker you configured. These requests contain the data required for the task, in particular your credentials, search terms, and the time entries and comments to be logged.

• For GitLab and YouTrack, the app sends requests directly to the issue tracker.
• For Jira Server and Jira Cloud, requests are routed through a forwarding function (proxy) on our server in Frankfurt am Main, because Jira often blocks direct requests from the browser. The proxy only forwards the requests and does not store their content.
• During synchronisation, either manual or, with Premium, automatically once a day, our server retrieves the worklogs from your issue tracker for the selected period and stores them for your reports.

The legal basis is Art. 6(1)(b) GDPR. The operator of the issue tracker, e.g. your employer, Atlassian, GitLab or JetBrains, is responsible for processing within the issue tracker itself, and their privacy policy applies.

3.5 Analytics: Google Analytics for Firebase

With your consent, we use Google Analytics for Firebase to understand how the app is used and to improve it. This processes, among other things, screens viewed, interactions, a random app instance ID, device and operating system data, language settings and an approximate location (country, region) derived from the IP address. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time with effect for the future. The data is retained for a maximum of 14 months.

3.6 Crash reports and performance monitoring

To find errors and keep the app stable, we use Firebase Crashlytics. In the event of a crash, data such as the stack trace, device model, operating system and app version, time and an installation ID is transmitted. With Firebase Performance Monitoring we measure loading times and the duration of network requests, processing technical data such as device type, operating system, app version, network type and measured values. The legal basis is our legitimate interest in a reliable, well-performing app (Art. 6(1)(f) GDPR). Crashlytics retains crash data for 90 days.

3.7 Abuse protection: Firebase App Check

In the Android app we use Firebase App Check with Google's Play Integrity API. It checks whether requests to our servers come from an unmodified app on a genuine device. For this, device and app integrity information is transmitted to Google. The legal basis is our legitimate interest in protecting our services against abuse (Art. 6(1)(f) GDPR).

3.8 Advertising: Google AdMob

The free Android app is funded by banner ads from Google AdMob (Google Ireland Limited). This processes, among other things, your device's advertising ID, IP address, device and app information and interactions with ads. You only receive personalised ads with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). We ask for it when you first start the app, and you can withdraw it at any time in the app. Without consent, non-personalised ads are shown. You can reset or delete your advertising ID in your Android settings. Premium users and users of the web app do not see ads. See Google's information on advertising for details.

3.9 In-app subscription (Premium)

Premium is billed as a subscription via Google Play. Payment is processed exclusively by Google; we do not receive your payment details. We receive from Google and store with your account: the product, purchase time, status and term of the subscription, and a purchase token we use to check the status via the Google Play Developer API. The legal basis is Art. 6(1)(b) GDPR and, where statutory retention obligations apply, Art. 6(1)(c) GDPR.

3.10 Storage on your device

The app stores settings locally on your device or in your browser's storage, e.g. the last view you opened. The web app also stores your sign-in session in the browser so that you stay signed in. This storage is strictly necessary for the function you requested (§ 25(2) no. 2 TDDDG).

4. Recipients and transfers to third countries

Google LLC and GitLab Inc. are based in the USA. For companies certified under the EU-US Data Privacy Framework, an adequacy decision of the European Commission applies (Art. 45 GDPR). In addition, transfers are based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Your data is not shared for any purposes other than those stated. We do not sell data.

5. Retention and deletion

We store your account and content data for as long as your user account exists. You can delete your account at any time in the app under Settings → Profile → "Delete Account". This deletes your user account, your profile picture, your trackers, tracks and reports, and the associated keys. The retention periods stated in section 3 apply to analytics and crash data. Data we are required to retain by law is restricted until the respective period expires and then deleted.

6. Your rights

You have the following rights regarding your personal data:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation.

To exercise your rights, simply send an email to issue-stopwatch@stefan-steinert.de.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

7. Other information

You are not legally or contractually required to provide your data. However, you cannot use the app without the data required for the user account. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

We update this privacy policy when the app, the services used or the legal situation change. The version published here applies.