We built Patchtime to collect as little data as possible. This policy explains what is processed when you visit this website and when you use the Patchtime app, why, and what rights you have.
Who is responsible
The controller within the meaning of the EU General Data Protection Regulation (GDPR) is Ahrbit UG (haftungsbeschränkt). Our full address and registration details are listed in our imprint. You can reach us about privacy at any time at hello@patchtime.app.
The short version
- No ads, no tracking, no analytics — neither on this website nor in the app.
- We never sell your data or pass it on for advertising or marketing.
- Without an account, your data stays on your device.
- With an account, we process your data only to provide sync and sharing, using carefully selected service providers under data processing agreements.
- You can delete your account and all its data at any time, right in the app.
This website
Hosting and delivery
This website is delivered by Cloudflare, Inc. (via Cloudflare’s global network). When you open a page, your browser necessarily transmits technical data such as your IP address, the date and time, the requested page, the referrer and your browser type. Cloudflare processes this data to deliver the website and to protect it against attacks. The legal basis is our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with Cloudflare. Transfers to the USA are based on the EU–US Data Privacy Framework and the EU standard contractual clauses.
No cookies, no external resources
This website sets no cookies and does not use analytics or tracking tools. Fonts and all other resources are served from our own domain — your browser does not contact third parties such as Google Fonts.
Language selection
When you open a page without a language in its address, we read the language preference your browser sends (the Accept-Language header) to forward you to the matching language version. This information is not stored.
The Patchtime app
Using the app without an account
You can use Patchtime entirely on your device. In this mode, everything you enter — people, schedules, patch records and photos — is stored only on your device, in an encrypted database. It is not transmitted to us. You can delete all data at any time in the app’s settings or by uninstalling the app.
Using the app with an account
If you create an account, we process:
- Account data: your email address, an optional name and your password (stored only as a secure hash) — or, if you sign in with Google, the basic profile data Google provides (name, email address).
- Sign-in sessions: while you are signed in, the IP address and the browser or device type of each sign-in, to keep you signed in and to protect your account.
- Content you enter: people (nickname, optional photo or avatar), patch schedules (with an optional name) and patch records (confirmed or skipped days).
- Sharing data: invitations you create, the email address of people you invite by email, and the permissions you grant.
We process this data to provide your account, to sync your data between your devices and to enable sharing (Art. 6(1)(b) GDPR); sign-in sessions also serve the security of your account (Art. 6(1)(f) GDPR). Photos are stored only in reduced size (at most 512 × 512 pixels).
When your account is ready, we send you a short welcome email once. Apart from that, we only send emails you trigger yourself (confirming your address, resetting your password, invitations).
Patch schedules may allow conclusions about the health of the person concerned. Where this is health data within the meaning of Art. 9 GDPR, we process it on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give when you create an account and store such data. You can withdraw your consent at any time by deleting the data or your account (Settings → Delete account).
Data about other people
If you enter data about another person, please make sure you are authorized to do so.
Sharing with others
When you share a person, the people you invite can see that person’s basic information and schedule, and — if you allow it — confirm patches. You can remove access at any time. If you send an invitation by email, your name and email address are visible to the recipient.
Purchases (Patchtime Pro)
Pro is purchased through Google Play (Google Ireland Limited). We do not receive your payment details. To manage your Pro status across devices we use RevenueCat, Inc., which receives a pseudonymous app user ID linked to your account and the purchase information provided by the store. When you delete your account, we also delete your customer record at RevenueCat. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Transfers to the USA are based on the EU standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.
Service providers
To provide accounts, sync and sharing, we work with the following service providers, each under a data processing agreement (Art. 28 GDPR):
- Cloudflare, Inc. — hosting of the app’s backend; storage of account data, content and reduced-size photos in the EU; protection against abuse
- Hetzner Online GmbH (Germany) — sending of verification, welcome, password reset and invitation emails
- Google Ireland Limited — optional sign-in with Google
- RevenueCat, Inc. — management of Pro purchases
Cloudflare, Inc. is based in the USA. Even though this data is stored in the EU, transfers to the USA cannot be ruled out entirely; they are based on the EU–US Data Privacy Framework and the EU standard contractual clauses.
Security and technical logs
To protect the service against abuse, requests to the app’s backend are limited per IP address and per account; Cloudflare keeps these counters only for about a minute. The backend writes technical logs to detect and fix errors. They contain no email addresses, names or content you enter. The legal basis is our legitimate interest in a secure and reliable service (Art. 6(1)(f) GDPR).
Notifications and reminders
Reminders and alarms are scheduled locally on your device. Their content is not sent to us.
No profiling
We do not use your data for profiling, automated decision-making, advertising or analytics.
How long we keep data
We keep account data and content for as long as your account exists. You can delete your account at any time in the app under Settings → Delete account; how this works and what happens is explained on Delete your account.
- When you delete your account: your account, the people you added with their schedules, records and photos, and the access you gave or received are deleted immediately from our database and photo storage. Your customer record at RevenueCat is deleted at the same time; if RevenueCat can’t be reached, we retry daily until it is done.
- Backups: our database keeps automatic backups for up to 30 days. Deleted data disappears from them after that time.
- Content you delete while keeping your account: it is removed from our servers and your devices. A record without names, photos or other personal content is kept for up to 30 days, so your other devices learn about the deletion.
- Sign-in sessions: they end 7 days after their last use and are then deleted. Links to confirm your email address or reset your password are valid for one hour and are deleted once expired.
- Accounts whose email address is never confirmed: deleted after 7 days.
- Invitations: deleted when they are accepted, and within a day after they are revoked or expire.
- Email delivery logs: kept by our email provider for 7 days.
- Technical logs: kept for up to 7 days.
- Purchases: the app store keeps its own purchase records. We keep the payout reports we receive from the store for as long as tax law requires.
- Data on your device: data you use without an account stays on your device until you delete it in the app’s settings or uninstall the app.
Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7(3)). You can delete your account and its data yourself at any time in the app. To exercise your other rights, simply write to us.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence.
Changes to this policy
We update this policy when the app or the law changes. The current version is always available on this page.