Your data, plainly.

The data controller

Klokly is a time-tracking service for teams, operated by Klokly (Lars Sohl), based in Denmark. For anything related to your personal data, write to hello@klokly.app.

Only what the product needs

• Account data — your name, email address, company name, and password (stored as a secure hash). Legal basis: performing our contract with you (GDPR art. 6(1)(b)).
• Time-tracking data — the tasks, notes, timers, and hours you and your team record in the app. Legal basis: performing our contract (art. 6(1)(b)).
• Billing data — subscription status, seat count, and invoicing details, processed by Stripe. We never see or store your card number. Legal basis: contract (art. 6(1)(b)) and legal obligations such as bookkeeping rules (art. 6(1)(c)).
• Support email — whatever you send us when you write for help. Legal basis: our legitimate interest in answering you (art. 6(1)(f)).
• Technical logs — standard, short-lived server logs and rate-limit counters (IP address, browser type) that keep the service secure and abuse-free. Legal basis: our legitimate interest in running a safe service (art. 6(1)(f)).

We collect no GPS locations, no screenshots, no behavioural profiles. Track time, not people.

Your admin runs the workspace

Klokly is built for teams: your company's admin creates the accounts in your workspace and manages the names, emails, and hours in it. For that data, your company is the data controller and Klokly is its processor under GDPR art. 28 — so if you're a team member wondering how your hours are used, your admin is the right first stop. Business customers who need a signed data processing agreement can write to hello@klokly.app.

No banner, because nothing to consent to

EU rules (the ePrivacy Directive) require consent for cookies — except those strictly necessary to deliver a service you asked for. Klokly only uses that exempt kind, so we don't show a consent banner. If we ever add cookies that require consent, we will ask first. Here is everything Klokly keeps in your browser — cookies and localStorage alike:

It only sees what you send it

The optional browser extension keeps its API key and your Klokly address in your browser's local extension storage — nowhere else. When you start a timer from it, the only thing sent to klokly.app is the task text you selected or typed. It reads no browsing history, no page contents, and talks to no other servers. You can revoke or rotate its API key anytime under Settings in the app.

Hosted in the EU

Your account and time-tracking data — every hour you record, your name, and your email — is stored and processed in the EU. The database is in Ireland, and the servers that read and write it run in Ireland too, so a request never leaves the region to be answered.

There is one exception, and we'd rather name it than hide behind “EU-hosted”: billing. Stripe is our payment processor, and while it contracts through its Irish entity, some processing happens in the United States under the EU–US Data Privacy Framework and standard contractual clauses. That covers your billing contact details and subscription — never your tracked hours, which Stripe has no access to.

Each processor is bound by a data processing agreement under GDPR art. 28.

Retention

We keep your data for as long as your account exists. Delete your account and your data goes with it. Invoicing records are the one exception: bookkeeping law requires us to keep those for 5 years.

You're in control

Under the GDPR you can ask us for access to, correction of, deletion of, or a portable copy of your personal data — and you can object to or restrict our processing. Two of those are built into the app: you can download your complete record — every time entry with its start and end times, your tasks, notes, time off and settings — as a machine-readable file from Export, and delete your own account from Settings → Danger zone — whatever your role, and without asking an administrator. For anything else, email hello@klokly.app and we'll respond within a month.

What deletion leaves behind, and why. Deleting your account erases your profile, your tasks, your notes, your recorded time off, and every individual time entry with its start and end times. Your employer keeps one thing: how many hours went to each job, per day, with your name and every reference to you stripped out. It is the same figure your company could already see while you worked there, it can no longer be linked back to you, and it exists because a company has to be able to invoice its customers and keep its books (in Denmark, for five years under bogføringsloven § 12). If you had switched off sharing in your settings, not even that is kept.

One exception to self-service: if an administrator has deactivated your account you can no longer sign in, so you can't reach the delete button. Ask your administrator — they can erase it from the team page — or email us and we'll do it.

If you're unhappy with how we handle your data, you can complain to the Danish Data Protection Agency (Datatilsynet) or the supervisory authority in your own EU country.

If this policy changes

We'll update this page and the date at the top. For meaningful changes we'll notify account owners by email before they take effect.