Wakto Privacy Policy
In short: we collect what Wakto needs to track your time and bill your clients, plus analytics when enabled. The free plan shows Google ads. We never sell your data, and you can export your time entries or delete your account whenever you like.
Last updated:
1. Who we are
Wakto is a time-tracking and timesheet service for freelancers and agencies who bill by the hour. It is made up of the landing page, the web app, the Android app and the server behind them. In this policy, "Wakto", "we" and "us" mean the operator of the service, [OPERATOR NAME AND ADDRESS]. "You" means anyone who visits the landing page or uses the web app or the Android app.
We are the controller of the personal data described here. You can reach us at [PRIVACY EMAIL].
2. What we collect
Account data. Your email address, your display name and a hashed version of your password. We never store your password in plain text.
Preferences. Your time zone, the currency you work in and the currency for summaries, your week start day and your rounding settings.
Your work data. The clients, projects and tags you create, your time entries (start and stop times, descriptions, billable status) and the hourly rates you set. Descriptions and names are free text, so they contain whatever you choose to type. Please avoid putting sensitive personal data about other people in them.
Purchase data. If you remove ads with "Buy me a coffee" (the monthly subscription or the one-time purchase that removes ads), we store the purchase type, amount, currency, date and the transaction and subscription IDs that Paddle, our payment provider, gives us. We never see or store your card number or bank details.
Session data. Sign-in tokens that keep you signed in. Refresh tokens are stored on our server only as a hash.
Usage data (only when enabled). If analytics is switched on, we record in-app events (for example "time entry created") together with your Wakto user ID and non-personal details such as the platform. We do not send your email, entry descriptions or client names to analytics.
Advertising data. If you use the free plan, our ad partners may collect device identifiers, IP address and browsing information to show and measure ads (see section 4).
Technical data. Like any website, our servers and hosting provider receive your IP address, browser type and request details when you connect.
3. Why we use it and our legal bases
If you are in the European Economic Area or the United Kingdom, the GDPR requires us to name a legal basis for each use.
| Purpose | Legal basis |
|---|---|
| Creating your account, storing and showing your time data, reports and exports | Contract (we need it to provide the service) |
| Processing ad removal purchases and keeping purchase records | Contract, and legal obligation for tax and accounting records |
| Keeping the service secure, preventing abuse, rate limiting | Legitimate interest |
| Converting amounts between currencies | Contract |
| Product analytics and feature flags | Consent where the law requires it, otherwise legitimate interest in improving Wakto |
| Showing ads on the free plan | Consent where the law requires it (for example personalised ads in the EEA and UK) |
| Answering your messages | Legitimate interest, or contract if it concerns your account |
Where we rely on consent, you can withdraw it at any time. Withdrawing does not affect what happened before.
We do not sell your personal data, and we do not use your time entries to profile you.
4. Third parties we work with
We share data only with providers that help us run Wakto, and only what each one needs.
- Paddle (payments). Paddle is our reseller and merchant of record for ad removal purchases. When you pay, you give your payment details to Paddle, not to us. Paddle handles billing, tax and invoices under its own privacy policy: https://www.paddle.com/legal/privacy
- Google Firebase and Google Analytics (analytics and feature flags). When enabled, we use them to count in-app events and to switch features on or off remotely (Firebase Remote Config). https://policies.google.com/privacy
- Google AdSense (ads on the web app) and Google AdMob (ads in the Android app). Ads are shown only to users who have not removed them. Google may use cookies and device identifiers for this. You can manage ad personalisation at https://adssettings.google.com
- Cloudflare (hosting and network). The landing page and the web app are served through Cloudflare Pages, which processes connection data such as your IP address and country. https://www.cloudflare.com/privacypolicy/
- [HOSTING PROVIDER] (server and database). Your account and time data are stored with our hosting provider.
- Frankfurter (exchange rates). Our server downloads daily public exchange rates from Frankfurter. No personal data is sent.
We may also disclose data when the law requires it, or to protect our rights and the safety of our users.
5. Cookies and local storage
We keep this small.
- Web app: your browser's local storage holds your refresh token (so you stay signed in) and small preferences such as your theme and timer mode. Your short-lived access token is kept only in memory.
- Android app: your sign-in tokens are kept in the device's secure storage, and preferences in the app's local settings.
- Landing page: local storage remembers your theme and language choice.
- Third parties: Firebase, Google Analytics, AdSense and AdMob may set their own cookies or identifiers when they are active.
The items we set ourselves are strictly necessary or simple preferences. You can clear them at any time in your browser settings. Clearing them signs you out.
6. How long we keep data
- Account and work data: for as long as your account exists. When you delete your account, it is removed from our database immediately (see section 7).
- Purchase records: Paddle keeps its own records as merchant of record, as tax law requires.
- Backups and logs: copies may remain in backups and server logs for a short period before they are overwritten.
- Analytics data: kept by Google according to the retention settings we choose.
7. Your rights
Depending on where you live, you have the right to:
- Access the personal data we hold about you.
- Correct it. You can edit most of it yourself in Settings.
- Export it. You can download your time entries as a CSV file from Reports.
- Delete it. You can delete your account from Settings. This removes your account together with all your clients, projects, tags, time entries, purchase records and sessions. If you have an active subscription, we cancel it with Paddle first.
- Port your data to another service in a common format.
- Object to processing based on legitimate interest, and restrict processing in some cases.
- Withdraw consent for analytics and ads where we rely on consent.
- Complain to a data protection supervisory authority, usually the one where you live or work.
To use a right you cannot exercise in the app, email [PRIVACY EMAIL]. We will answer within one month.
8. International transfers
Our providers may process data outside your country, including in the United States. Where data leaves the EEA or UK, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses offered by those providers.
9. Security
Billing data deserves care, so we protect it in layers:
- All traffic uses HTTPS.
- Passwords are stored as one-way hashes.
- Sessions use short-lived access tokens and rotating refresh tokens. Refresh tokens are stored only as hashes on our server.
- Every record belongs to a single user, and every request is checked against the signed-in user.
- Text you enter is cleaned before it is stored, and our web pages use a strict Content Security Policy.
No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.
10. Children
Wakto is a professional tool and is not aimed at children. You must be at least 16 years old to use it. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.
11. Changes to this policy
We may update this policy when Wakto or the law changes. We will change the "Last updated" date above, and for important changes we will tell you in the app or by email before they take effect.
12. Contact
Questions, requests or complaints: [PRIVACY EMAIL]