← Back

Privacy policy

Last updated: 7 November 2026

Who we are

Hourcrumb is made by TENDANTO LTD, a company registered in England and Wales (company number 17481182), registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are the controller of the personal data described in this policy.

Questions or requests: privacy@hourcrumb.com.

The short version

  • You can use Hourcrumb for free without an account. Your time data then stays on your device and we receive none of it.
  • An account is optional. With Hourcrumb Plus, your time data is synced through our server in Germany.
  • AI is optional: days are drafted without it unless you choose otherwise. On-device AI keeps what you write on your device. Cloud AI, only if you turn it on, sends the day being drafted to Google, which drafts it for us.
  • AI apps and coding tools are optional too: they connect only after you sign in and allow them, and coding tools send only a folder's name and the time.
  • The free version shows small ads for our own other apps; Plus has none. No ads from anyone else and no third-party analytics or tracking; the app counts anonymous daily totals of what's used, which you can turn off. We never sell your data.
  • You can delete your account and everything synced to our server at any time.

Using Hourcrumb without an account

Your projects (with any hourly rates you set), time entries, notes, the days you mark as a day off or as reviewed, and your settings are stored only on your device: inside the app, or in your browser's storage when you use the web app. They are not sent to us. Deleting the app, or clearing the browser's site data, deletes them from your device, so export a backup in Settings if you want to keep a copy.

Weekly summaries, reports and the amounts worked out from your hourly rates, suggestions from your notes and the matches the app learns from your corrections are worked out on your device.

In the Android app, if you turn on suggestions from app use and allow Usage access, Hourcrumb reads which apps were on your screen and when, from Android's own record, to suggest blocks. This is read and kept only on your phone: those suggestions and the projects learned for each app are never synced or sent to us. You can turn it off in Settings or in your phone's settings at any time. A block you confirm becomes time like any other, and is synced with Plus.

If your phone's own backup (iCloud or Google) is turned on, it may include this data. That backup is controlled by you and Apple or Google, not by us. Your sign-in token is never included in it.

Backup files, CSV files and timesheets (PDF or CSV) you export are created on your device and go only where you choose to send them. Files you import, including exports from Toggl, Clockify or Harvest, are read on your device.

Some technical data reaches servers even without an account. The website and web app are delivered by Vercel, and the mobile app asks our server which sign-in options are available each time it starts (the web app asks when it shows the sign-in options). Like any web request, these show your IP address and your browser or device type. They contain none of your time data, and our server keeps them only in its short-lived logs.

Cookies and storage on your device

We don't use advertising or analytics cookies; neither the ads in the free version nor the anonymous usage counts use cookies at all. Hourcrumb only stores what it needs to work:

  • your projects (with their hourly rates and currencies), time entries, notes, day marks (days off and reviewed days), weekly plans, learned matches and settings, in the app or in your browser's storage for hourcrumb.com;
  • in the Android app, for the home-screen widget: the running timer's project and times, your recent projects and any taps on the widget the app hasn't applied yet, in the app's own storage on your phone; none of it is sent to us, and if you add the widget, it shows the timer and those projects on your home screen (you can hide project names in Settings);
  • when you're signed in, your sign-in token: in the iOS Keychain or in storage encrypted with an Android Keystore key in the apps, and in the browser's local storage in the web app;
  • when you're signed in, whether your account has Plus and until when, so Plus features also work offline;
  • for the anonymous usage counts, the random installation ID, the dates the app last counted itself as opened, and whether you turned the counts off;
  • a cookie named hc_locale on hourcrumb.com, set when you choose a language so the site opens in it next time, kept for one year;
  • while you sign in with GitHub or Facebook, or with Apple on Android, a cookie on api.hourcrumb.com that expires after 10 minutes and, in the web app, a one-time code kept only in that browser tab.

These are strictly necessary for the service or remember a choice you made, so we don't ask for cookie consent. Deleting the app or clearing the site's data removes them.

Calendar suggestions

Calendar suggestions are optional and stay off until you turn them on in the mobile app. The app then asks for permission to read your device calendar. It reads events on your device only, to suggest time blocks. We don't receive your calendar, and the app never changes it.

The app adds matching events to your day as suggested blocks. They count as logged time only after you confirm them. Suggested blocks are stored like your other time entries, with the event's title and times and an event identifier used to avoid duplicates: on your device, and on our server only if you use Plus sync. You can turn calendar access off at any time in your device settings.

Suggestions and learned matches

The app can turn your quick notes into suggested blocks, and it learns from your corrections: when you give a suggested block a project, it remembers the block's title, or words you add yourself, and suggests that project next time. This happens on your device. You can see and delete what it has learned in Settings, or turn learning off. Suggested blocks count as logged time only after you confirm them. Learned matches are stored like your other data: on your device, and on our server only if you use Plus sync.

AI day drafts

You choose in Settings how your days are drafted:

  • No AI (the default): the rules on your device described above.
  • On-device AI (Plus, in the web app in Chrome on a computer): the AI model built into Chrome drafts the day on your computer. What you write is processed there and isn't sent to us or to Google. Chrome downloads the model from Google the first time, under Google's terms for Chrome.
  • Cloud AI (Plus): off until you agree to it in the app, as described below.

When Cloud AI drafts a day, the app sends our server that day's quick notes, the times of its blocks and which of your projects they belong to, the titles and times of calendar events and other suggested blocks still waiting for a project, your project names, up to 30 words the app has learned from your corrections (each with the project it points to) and the weekday. Times are sent as minutes after midnight. Quick notes go as you wrote them, including any names of people in them, except that email addresses, links and long numbers are replaced. We don't send your name, email address, account details, location, the date, your time zone, anything about the apps you use, or the notes you add to blocks.

To check that Cloud AI is offered where you are, our server looks up the country of your IP address when you agree to Cloud AI or a day is drafted. It doesn't store the address or the country for this check. IP geolocation by DB-IP (db-ip.com).

Our server passes the request to Google's Gemini API, which drafts the day, and returns the draft to your device. Google receives the request from our server, not from your device. Our server doesn't keep the request or the draft and doesn't write them to its logs: it records only that a draft was made, with its size in tokens, never what it said. Google processes the request on our behalf, under its data processing terms, and doesn't use it to train or improve its models. Google keeps requests and drafts for a limited period (55 days, according to its documentation), only to detect misuse of its service and for disclosures the law requires: automated systems check them, and Google's staff may review a request that's flagged. Google may process them in any country where it or its subprocessors have facilities, including the United States.

AI drafts are suggestions. They can be wrong, the app marks them as AI drafts, and nothing counts as logged time until you confirm it. The suggestions an AI makes are stored like your other suggested blocks. You can choose another way to draft your days at any time in Settings; leaving Cloud AI withdraws your agreement to it.

AI apps and coding tools

With Plus, you can connect AI apps such as Claude, Codex, Cursor or Antigravity to Hourcrumb, and let Hourcrumb record the time you spend in coding tools. Both stay off until you set them up.

  • Connecting an AI app: the app sends you to Hourcrumb, where you sign in and choose Allow. It can then read your projects (with their hourly rates), your time entries with their titles, and the totals our server works out from them, and add time entries when you ask it to. It can't delete or change your entries or see your account details. What it reads goes to that app's provider (for example Anthropic, OpenAI, Anysphere or Google), which handles it as an independent controller under its own privacy policy, as it does everything you ask that app.
  • For each connection we store the app's name and the address it registered, when you allowed it and last used it, and its access and refresh tokens as one-way hashes; the app keeps the tokens. Settings lists your connected apps. Disconnect, or deleting your account, ends a connection straight away, and a connection unused for 90 days ends by itself.
  • Coding time: the Hourcrumb extension for Antigravity, VS Code and Cursor, and the hourcrumb tool for Claude Code and Codex, sign in the same way and keep their tokens on your computer (in the editor's secret storage, or in a file in your home folder only you can read). While you work, they send our server the tool's name and the folder's name (its last part, not the path), at most once a minute. Prompts, code, file names and replies are read on your computer and never sent. Our server turns this into suggested blocks named after the tool and folder, stored and synced like your other suggested blocks.

We do this to provide the Plus features you choose to use (contract).

Reminders

Reminders are local notifications scheduled on your device. Nothing about them is sent to us or to a push service.

Ads in the free version

Without Plus, the app shows a small card above the tab bar with an ad for one of our own other apps, such as InkDone, Oftaro or Dotlumo. We don't show ads from anyone else. With Plus there are no ads, and the app doesn't request any.

To get an ad, the app contacts our own ad server at api.tendanto.com and sends only the app's name (Hourcrumb), your language, your platform (Android, iOS or web) and which ad it is replacing. While the card is on screen, it may ask for a new ad about once a minute. When an ad has been shown, and when you tap it, the app tells the server which ad it was, with the random installation ID described under Anonymous usage counts if those are on. It sends no cookies, no account identifier, no advertising ID and nothing about your time data. Like any web request, these show your IP address and your browser or device type, which the server keeps only in routine logs that are deleted after 14 days.

The server keeps only daily totals of views and taps for each ad and app, which don't identify you. We don't build a profile of you or track you across apps or websites. Tapping an ad opens that app's page in the app store or on the web, with a tag saying the visit came from Hourcrumb; from there, the store or website handles your data under its own privacy policy.

We show these ads on the basis of our legitimate interest in promoting our own apps in the free version of Hourcrumb.

Anonymous usage counts

To see which features are used and to fix what isn't working, the app and the website count how often some things happen: opening the app, viewing a screen, finishing or skipping onboarding, starting or stopping the timer, adding a quick note, confirming a block, finishing a day's review, exporting or importing, opening the Plus page, buying Plus and tapping an ad. About every 30 seconds, and when you leave, the app sends our metrics server at api.tendanto.com (our own server, shared by Tendanto's apps) the names of these events, the app name, your platform (Android, iOS or web) and the app version. Your language and whether you use the free version or Plus are sent once a day, as event names too (for example lang_en or plan_free). The website sends only which page was viewed.

No cookies are used, and nothing is sent about your account, your time data, projects or notes, even when you're signed in. On first launch the app creates a random installation ID that stays on your device (it isn't included in backups or moved to a new phone) and goes with these events. This ID is not linked to your account, your advertising ID or your device hardware. Our server never stores the ID itself, only an irreversible hash of it: with the events for 48 hours, and as a daily summary (the day it was first seen, the days it was active and the day it moved to Plus) for 35 days, to understand whether people come back. The app also counts itself as active at most once a day, once a week and once a month, and counts its first opening once, remembering on your device the dates of the last day, week and month it did so. Our server adds each event to a daily total per app, event, platform and version; it doesn't store your IP address with them. It uses your IP address only to limit abuse, and records it in routine server logs that are deleted after 14 days. The daily totals are kept for 25 months.

You can turn this off at any time in Settings, under Data & backup (Share anonymous usage counts), in the app or the web app; nothing is sent then, not even the ID. You can also reset the ID there (Reset analytics ID): the app creates a new one, which can't be linked to the old one. If your browser sends a Global Privacy Control signal, nothing is sent either. We do this on the basis of our legitimate interest in understanding how Hourcrumb is used, so we can improve it.

If you create an account

An account is needed only for Plus. We need your name and email address to create one. When you create an account, you confirm that you're 18 or older and accept our Terms of Use. We then store:

  • your name and email address, and whether the address has been verified (if a sign-in provider doesn't share your name, we use the part of your email address before the @);
  • your password as a secure one-way hash, or, if you continue with Apple, Google, Facebook or GitHub, the account identifier that provider gives us and the email address it shares;
  • for Sign in with Apple, an encrypted token we keep only so we can revoke Hourcrumb's access at Apple when you delete your account, and the name Apple shares the first time you sign in;
  • your language preference (for emails), your plan and your subscription status;
  • a random billing ID that links your account to your subscription (see Purchases);
  • when you accepted the Terms of Use, and which version you accepted;
  • if you turn on Cloud AI, when you agreed to it and to which version of its text;
  • a sign-in token for each device you're signed in on, labelled with that device's browser identification (its user agent, which shows the device type and system version), and when it was created and last used.

We use this to run your account, keep it secure, send the password-reset emails you ask for and tell you when a new way to sign in is added to your account. We don't send marketing emails.

When you continue with Facebook or GitHub, you sign in on their site. Each time, our server receives your profile from them and keeps only your name, email address and account identifier. We don't keep the access token they issue, we don't read anything else from your account there, and we never post for you. From GitHub we only accept your primary, verified email address.

In the web app, when Sign in with Apple is offered, Apple's sign-in script is loaded from Apple as soon as the sign-in buttons appear, so Apple receives your IP address and browser details even if you don't use it.

Hourcrumb Plus and cloud sync

With Plus, the app syncs your projects (including their hourly rates and currencies), time entries (including their titles and notes, and the titles of calendar events brought in as suggestions), notes, day marks, weekly plans and learned matches with our server, so they are backed up and available on your other devices and in the web app. When you delete a synced item, or delete all data in Settings, it is marked as deleted so your other devices remove it too, and what you wrote in it (names, titles, notes, learned words and hourly rates) is erased from our server; only its identifier, dates and times are kept. Our server and database are hosted by Hetzner in Germany.

Purchases

Plus is bought through the App Store or Google Play. Apple or Google process your payment under their own privacy policies. We never see your card or bank details.

RevenueCat, our subscription service provider, processes your purchase and subscription status on our behalf. It links them to a random billing ID, not to your name, email address or account number. When your subscription changes, RevenueCat tells our server, and our server then checks with RevenueCat whether Plus is active on your account. The apps only start RevenueCat once you are signed in; it then also receives basic technical data such as your device model, app version and IP address.

Security

Data travels between the app and our server over encrypted connections (HTTPS). Our server processes your IP address to protect the service, for example to limit repeated sign-in attempts, and records it in routine server logs, which are deleted after 14 days.

When you choose a password, our server checks whether it appears in known data breaches using the Have I Been Pwned service. Only the first five characters of a one-way hash of the password are sent, never the password itself.

Who receives data

Service providers that process personal data for us under contract:

  • Hetzner Online GmbH (Germany): hosts our server and database;
  • Vercel Inc. (United States): hosts the website and web app at hourcrumb.com, and processes technical request data such as IP addresses when you open them;
  • RevenueCat, Inc. (United States): subscription status;
  • Resend (Plus Five Five, Inc., United States): sends password-reset emails and account security notices;
  • Cloudflare, Inc. (United States): forwards the emails you send to our hourcrumb.com addresses;
  • Zoho, in its data centres in the EU: hosts the inbox those emails arrive in.

Companies you choose to use with Hourcrumb, which process data as independent controllers under their own privacy policies:

  • Apple and Google: app stores, payments, and Sign in with Apple or Google if you use it;
  • Meta Platforms and GitHub, Inc.: signing in with Facebook or GitHub, if you use it.

We may also disclose data where the law requires it. We don't sell or rent personal data, show ads from other companies, or use third-party analytics or tracking tools.

Legal bases

Under the UK GDPR and the EU GDPR we rely on:

  • contract: to provide your account, sync (including the calendar suggestions, plans, learned matches, hourly rates and day marks you sync) and Plus;
  • legitimate interests: to deliver the website and apps and answer their requests (including loading Apple's sign-in script in the web app), keep the service secure, prevent abuse, fix problems, and keep a record of the Terms you accepted and of your agreement to Cloud AI;
  • legitimate interests: to show ads for our own other apps in the free version and count how often they are seen and tapped;
  • legitimate interests: to count anonymous daily totals of how the app and website are used, so we can improve them (you can turn this off in Settings);
  • consent: for calendar access, which you give through your device's permission prompt and can withdraw at any time in your device settings (the calendar itself is read only on your device), and for Cloud AI, which you give in the app before anything is sent and can withdraw at any time by choosing another way to draft your days in Settings;
  • legal obligations: where the law requires us to keep or disclose data.

Suggestions, learned matches and AI drafts are made for you to review and change, and weekly summaries only for you to read. We don't make decisions about you based solely on automated processing, and we don't profile you.

International transfers

We are based in the UK and our server is in the EU (Germany). Personal data from the EU reaches us under the EU's adequacy decision for the UK, and data we store in Germany is covered by the UK's adequacy regulations for the EEA. Some of the providers and companies listed above, such as Vercel, RevenueCat, Resend, Cloudflare, Apple, Google (including for Cloud AI), Meta and GitHub, may process data in the United States or other countries. When personal data leaves the UK or the EEA, we rely on appropriate safeguards: adequacy decisions (including the EU–US Data Privacy Framework and the UK extension to it, where the provider is certified) or standard contractual clauses with the UK Addendum.

How long we keep data

  • Your account and synced data: until you delete your account, also after Plus ends. When you delete an item, what you wrote in it is erased straight away; its identifier, dates and times stay until you delete your account.
  • Your purchase record at RevenueCat: until you delete your account; we then ask RevenueCat to delete it.
  • Cloud AI requests and drafts: our server passes them on and keeps neither. It keeps only how many drafts each account made per day, and their size in tokens, for 35 days. Google keeps them for a limited period (55 days, according to its documentation), only to detect misuse.
  • Your agreement to Cloud AI (when you gave it, and to which version of the text): until you withdraw it or delete your account.
  • Sign-in tokens: deleted when you sign out on that device, after 30 days without use, or at the latest about 180 days after they were created.
  • Password-reset requests: the link expires after 60 minutes. The request (your email address and a hashed code) is deleted when you use it, ask for a new link or delete your account, and otherwise about an hour after the link expires.
  • Apple tokens that end up linked to no account: revoked and deleted automatically, normally within two hours (if Apple can't be reached, we keep trying until it works).
  • Sign-ins that pass through our server (GitHub, Facebook, and Apple on Android), and Apple or Google sign-ins waiting for you to accept the Terms: deleted within three hours, finished or not.
  • Facebook deletion requests: when Facebook tells us you removed Hourcrumb and asked for your data to be deleted, we straight away delete the Facebook identifier and email address we keep for signing in, and a Hourcrumb account made with Facebook that has no other way to sign in, with everything synced to it. We keep only the confirmation code, for 90 days, so you can check the request.
  • Anonymous usage counts: daily totals with no identifiers, kept for 25 months; the hash of the installation ID, with individual events for 48 hours and in a daily summary for 35 days.
  • Server logs, which include IP addresses: deleted after 14 days.
  • Emails you send us: as long as we need them to answer you and deal with any follow-up.
  • Backups: copies of deleted data in our server's backups and database logs are overwritten within 7 days. We never restore deleted data from them.

Deleting your account

You can delete your account in the app (Settings, then Account & cloud sync, then Delete account) or on the web at https://hourcrumb.com/en/tracker/settings/. You can also email us. Deletion is immediate: your account, everything synced to our server and your sign-in tokens are erased from our database, and Hourcrumb's access at Apple is revoked if you used Sign in with Apple. We also ask RevenueCat to delete your purchase record. Copies in backups disappear as described above. Data on your devices stays there until you remove it, for example with Delete all data in Settings.

If you signed in with Facebook, you can also remove Hourcrumb in your Facebook settings. https://hourcrumb.com/en/data-deletion/ explains how, and what it deletes.

Deleting your account doesn't cancel a Plus subscription. Cancel it in your App Store or Google Play subscriptions.

Your rights

You have the right to access your personal data, correct it, delete it, restrict or object to how we use it, receive it in a portable format and withdraw consent. The backup export in Settings gives you a copy of the time data on your device at any time; for a copy of everything we hold about you, email us. To use these rights, email privacy@hourcrumb.com. We reply within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office in the UK (https://ico.org.uk) or to the data protection authority in your EU country.

Children

Hourcrumb is for people aged 18 and over; it is not made for children or teenagers. You must be at least 18 to create an account, and you confirm this when you create one. We don't knowingly collect personal data from anyone under 18. If we learn that an account belongs to someone under 18, we delete it.

Changes to this policy

If we change this policy, we update this page and the date above. For significant changes we tell you in the app or by email before they take effect.

Contact

TENDANTO LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Email: privacy@hourcrumb.com.