iboChron · Android & iOS

Privacy Policy for iboChron

Last updated: 18 October 2026

This Privacy Policy explains how personal data is processed when you use iboChron for Android and iOS, including iPadOS and the associated extensions. The availability of individual features depends on your platform, device and app version.

1. Controller and contact details

Tobias Hauß
Roonstr. 23A
76137 Karlsruhe
Germany

Privacy and general enquiries: info@ibochron.de
App support: support@ibochron.de

2. Time tracking and local storage

iboChron processes the information you enter to record, calculate and display working time. This may include:

• start and end times, breaks, target working hours and overtime;
• projects, project descriptions, manually created work locations and notes;
• annual leave, sick days, public holidays and other absences;
• hourly rates, earnings, additional payments and expenses;
• app settings, such as reminders, appearance and export preferences.

This information is stored in the local app database or local app storage. It is not automatically transmitted to me. I have no remote access to your time records. If you send me data yourself, for example as an attachment to a support request, I process it as part of that request.

Sick-day entries may constitute health data. These entries are also processed locally within the app. Recording them is optional; you do not need to enter sick days or medical information to track ordinary working time.

The work-location feature uses labels you create or select. The app does not obtain your GPS location for this feature or create a movement profile. Public holidays are calculated locally using your selected region, without contacting an external holiday service.

3. Backups, restoration and exports

You can create and restore backups of your app data and, where enabled, have backups created automatically. The storage location depends on your selection and the available file services. If the selected folder belongs to a cloud service, its provider may process the backup file. When you import a backup, the selected file is read to restore the local data.

Export and sharing features allow you to create files such as CSV or PDF documents and send them to another app, storage provider or recipient. The information included and its destination depend on your export and your selection. Backup files may contain the complete time-tracking database, including notes, earnings and absences. The app does not add its own password protection to these files.

Device backups provided by the operating system may also include app data. This applies in particular to iCloud backups on iOS and enabled Android device backups, for example through Google. App data may also be transferred when you change devices. Your device and account settings and the provider’s rules determine this processing. I have no access to your personal cloud backups.

Platform information: iCloud Backup and Android Auto Backup.

4. Optional device features and permissions

• Biometric app lock: If you enable the lock, authentication is performed by the operating system, for example using Face ID, Touch ID, Android biometrics or a device passcode. iboChron receives the authentication result, but not your fingerprint data, facial templates or device passcode.
• NFC: When you use NFC, the tag contents are evaluated locally to perform an associated action, such as starting or stopping a time record.
• File access: Backups, restoration and exports use the operating system’s file picker or storage permissions. Older Android versions may require a storage permission.
• Notifications: Reminders are scheduled locally through the operating system. Notifications may display time-tracking information. You control their visibility on the lock screen in your system settings.
• Widgets, Live Activities and shortcuts: When you use these features, the project, time and status information they require is passed to the relevant system component. The platform provider’s privacy information also applies to voice assistants.
• Apple Watch: If you use the Watch extension, the required project, time and status information is exchanged between your iPhone and paired Apple Watch using Apple’s device connectivity services.

You can manage or revoke optional permissions in your system settings. The corresponding features may then become unavailable. An operating system permission does not automatically constitute data-protection consent for additional processing purposes.

5. In-app purchases and subscriptions

Paid features and subscriptions are handled through the Apple App Store or Google Play, depending on your platform. The relevant provider processes the information required for your account, purchase and payment.

iboChron processes technical purchase information to unlock features, restore purchases and check subscription status. This may include product identifiers, receipts, transaction identifiers or purchase tokens, and information about subscription periods, renewals or refunds. These checks use the relevant platform’s purchasing services. Your time records are not sent to the store as part of this process.

I do not receive your full credit card or bank details through this purchasing process. The platforms may provide me with purchase, revenue and subscription reports. Further information: Apple Privacy Policy and Google Privacy Policy.

6. YouTube videos and thumbnails

The app includes help, video and news areas containing YouTube videos and thumbnails. For users in the European Economic Area, the provider of YouTube is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Thumbnails may be loaded from Google’s servers as soon as one of these areas is displayed. Google consequently receives, in particular, your IP address and technical information about the request. Loading the embedded player and playing a video may involve the processing of additional device, usage and video information, as well as cookies or similar storage technologies. Transmission may therefore begin before video playback starts. This may also occur when the app automatically displays a video or news notice.

Depending on your Google sign-in status and settings, requests may be associated with your Google account. If you open a video or channel outside the app, subsequent processing takes place in the relevant YouTube app or browser. Your local time-tracking database is not transmitted to Google to display videos.

Embedding external content that requires consent requires your prior consent under Article 6(1)(a) GDPR. Access to information on your device that requires consent is also subject to section 25(1) of the German Telecommunications and Digital Services Data Protection Act (TDDDG). Merely displaying an area or automatically showing a notice does not constitute such consent.

For details of Google’s processing and retention periods, see the Google Privacy Policy. International transfers are also addressed in section 9.

7. Contact and support

If you email me, I process your email address, your name if provided, the contents and attachments of your message, and the communication data needed to handle your request. The feedback feature opens an email draft with the app version in the subject line. You decide whether to send the message and what to include.

The purpose is to answer your enquiry and resolve reported issues. The legal basis is Article 6(1)(b) GDPR for contract-related enquiries and Article 6(1)(f) GDPR for other enquiries. My legitimate interest is to handle and follow up on your request. Email and IT service providers process the information needed to provide email communications.

8. Analytics, diagnostic data and libraries

iboChron does not contain a dedicated analytics or advertising-tracking service or an integrated advertising network. The app uses technical libraries for purposes including the user interface, purchase validation and video playback. Using a local library does not by itself transmit data to its developer. Section 6 applies to the network-based YouTube integration.

Separately, Apple and Google may process diagnostic, crash and usage information through their platform services. This depends on the relevant service, settings and sharing choices. Developer tools may provide me with aggregated statistics and technical error or crash reports, for example containing the app version, operating system version, device model and error details. Such a report does not give me remote access to your local time-tracking database.

To the extent that I process these reports for troubleshooting, the legal basis is Article 6(1)(f) GDPR. My legitimate interest is the stability, security and improvement of the app. Collection by the platform provider is governed by that provider’s own legal basis and privacy policy.

9. Recipients, external links and international transfers

Within the scope described above, recipients may include Apple and Google, file, cloud and communication services you select, your chosen export recipients, and the email and IT providers used for my support communications. Data may also be disclosed to competent authorities where necessary to fulfil legal obligations. I do not sell your personal data.

When you open an external link, the destination provider processes the connection information needed to deliver its service, particularly your IP address. The visited websites and services have their own privacy information. This policy covers the app; processing when you visit this WordPress website is explained in its separate website privacy information.

External services may process data outside the EU or European Economic Area, particularly in the United States. Google identifies adequacy decisions, the EU-US Data Privacy Framework for appropriately certified recipients, and standard contractual clauses as mechanisms for international transfers. Google provides details of the applicable mechanisms and safeguards in its international data transfer information. Apple’s transfer information is available in the Apple Privacy Policy. For other services you select, processing locations and safeguards depend on the relevant provider.

10. Legal bases and required information

Where processing falls within my responsibility as a controller, it relies on the following legal bases, depending on the purpose described above:

• Article 6(1)(b) GDPR: providing agreed app features, managing purchase entitlements and handling contract-related support;
• Article 6(1)(f) GDPR: handling other enquiries and analysing technical errors in the interest of reliable and secure app operation;
• Article 6(1)(c) GDPR: fulfilling legal obligations where applicable;
• Article 6(1)(a) GDPR: processing for which valid consent is obtained.

Storage on, or access to information on, your device that is strictly necessary to provide features you expressly request is governed by section 25(2), point 2 TDDDG. Additional access requiring consent is governed by section 25(1) TDDDG.

You are not required to send me your local time records. However, the app cannot calculate working time without the relevant entries, and paid features cannot be unlocked without the necessary purchase information. I need a means of contacting you to respond to a support request.

11. Retention and deletion

Local app data: This remains stored until you delete the relevant entries or app data. You can manage entries within the app. On Android, you can also clear app data in the system settings. On iOS, fully deleting the app removes its local app storage; offloading the app retains its data. Data on paired devices or in extensions may need to be removed separately.

Backups and exports: Copies stored separately, shared with others or backed up by the operating system are not automatically removed everywhere when you delete the app. Manage and, where appropriate, delete these copies at the relevant storage location, recipient or provider. Restoring a backup may return previously saved data to your device.

Support data and technical reports: Data within my responsibility is deleted once the enquiry or troubleshooting is complete and further retention is no longer necessary for essential follow-up, legal obligations or the establishment, exercise or defence of legal claims. Where statutory retention obligations apply, processing is restricted to those purposes. Data held by Apple, Google or services you select is subject to their retention and deletion rules.

12. Your rights

Subject to the applicable legal requirements, you have the rights of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR) and data portability (Article 20 GDPR).

Right to object: You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation (Article 21 GDPR).

Withdrawal of consent: You may withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, contact info@ibochron.de. I cannot remotely access information held exclusively on your devices; you manage it through the app or operating system. For processing carried out by Apple, Google or other providers as independent controllers, you may also contact those providers directly.

I do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects within the meaning of Article 22 GDPR.

13. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, place of work or the alleged infringement (Article 77 GDPR).

The supervisory authority responsible for my place of business is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Germany
Information and online complaints, in German

14. Updates

This Privacy Policy will be updated when app features, processing activities or legal requirements change. The current version is available through the app’s privacy link.