Privacy Policy

Last updated: March 13, 2026

RF Time Tracker ("the App") is operated by Rootforce ("we", "us", "our"). This privacy policy explains how we collect, use, store, and protect your personal data when you use our mobile and web application in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

1. Data Controller

The App operates under a B2B model. Your employer or organization ("the Tenant") is the data controller for the time tracking data collected through the App. Rootforce acts as the data processor on behalf of the Tenant.

For questions about how your employer uses your data, please contact your organization's administrator.

2. Data We Collect

2.1 Account Information

Data	Purpose	Legal Basis
Email address	Authentication and account identification	Contract performance (Art. 6(1)(b) GDPR)
Name	Display within the app to identify users	Contract performance
Password	Authentication (stored as bcrypt hash, never in plain text)	Contract performance

2.2 Time Tracking Data

Data	Purpose	Legal Basis
Time entry descriptions	Record of work performed	Contract performance
Start and end times	Working hours tracking	Contract performance
Project names and tags	Work categorization	Contract performance
Break durations	Accurate working time calculation	Contract performance

2.3 Organization Data

Data	Purpose	Legal Basis
Tenant membership	Associate users with their organization	Contract performance
User role (user/admin)	Access control	Contract performance
Payroll information (hourly rate, salary)	Timesheet calculations (if configured by admin)	Contract performance

3. How We Use Your Data

We use your data exclusively to:

Provide the time tracking service
Authenticate your identity
Display your time entries and statistics
Enable export of time tracking reports
Allow administrators to manage their organization
Monitor and fix application errors (via Sentry)

We do not:

Sell your data to third parties
Use your data for advertising or profiling
Share your data with third parties beyond what is described in this policy
Track your location or device identifiers

4. Third-Party Services (Sub-Processors)

4.1 Google Cloud Platform (Data Storage)

All application data is stored on Google Cloud Platform (Firestore) in the Europe (europe-west1) region. Google provides encryption at rest and in transit. See Google Cloud Privacy.

4.2 Authentication Providers

The App offers sign-in via:

Google Sign-In — We receive your email address and name from Google. See Google's Privacy Policy.
Sign in with Apple — We receive your email address (or a private relay address if you choose to hide your email) and name from Apple. See Apple's Privacy Policy.

We only use the email and name provided by these services for authentication. We do not access your contacts, calendar, or other account data.

4.3 Sentry (Error Monitoring)

We use Sentry (sentry.io) to monitor application errors. When an error occurs, Sentry may receive:

Device type, operating system, and app version
Error messages and stack traces (technical debugging information)
Performance metrics (e.g., screen load times)

We have configured Sentry to strip personal data (emails, passwords, authentication tokens) from error reports before they are sent. Sentry data is used solely to identify and fix bugs. See Sentry's Privacy Policy.

4.4 Complete Sub-Processor List

Service	Purpose	Data Location
Google Cloud Platform (Firestore)	Data storage	Europe (europe-west1)
Google Cloud Run	Application hosting	Europe (europe-west1)
Sentry (Functional Software Inc.)	Error monitoring	EU

5. Data Storage and Security

All data is stored on Google Cloud Platform servers in Europe (europe-west1)
All communication between the app and our servers uses HTTPS/TLS encryption
Data at rest is encrypted by Google Cloud (Google-managed encryption keys)
Passwords are hashed using bcrypt (cost factor 12) before storage
Authentication uses short-lived JWT tokens (1-hour access tokens)
On mobile devices, tokens are stored in the operating system's secure storage (iOS Keychain / Android Keystore)
Access to data is restricted by tenant isolation — users can only access data within their organization
Administrative actions are recorded in an audit log (with personal data redacted)
Rate limiting protects against brute-force attacks on authentication endpoints

6. Data Retention

Data Type	Retention Period
Active user accounts	As long as the account is active
Time tracking entries	As long as the tenant account is active (minimum 10 years for business records per German tax law, AO §147)
Deleted user accounts	Account data is anonymized immediately upon deletion. Anonymized records are purged after 90 days.
Invite codes	Automatically expire after the configured period (default: 7 days)
Audit logs	Retained for 1 year, then automatically deleted
Error reports (Sentry)	90 days (Sentry default retention)

7. Your Rights (GDPR Articles 15-22)

As a data subject, you have the following rights:

Right of Access (Art. 15) — View your personal data within the app (profile, time entries)
Right to Data Portability (Art. 20) — Export your time tracking data in CSV, JSON, or Excel format
Right to Rectification (Art. 16) — Edit your time entries and profile information within the app
Right to Erasure (Art. 17) — Delete your account via the app (Profile > Delete Account). Your personal data will be anonymized and your account disabled.
Right to Restriction (Art. 18) — Contact us to restrict processing of your data
Right to Object (Art. 21) — Contact us to object to data processing

To exercise any of these rights beyond what is available in the app, contact us at the address below.

Note: As your employer is the data controller, some requests may need to be directed to your organization's administrator.

8. International Data Transfers

All data is stored and processed within the European Union (Google Cloud europe-west1 region). We do not transfer personal data outside the EU/EEA. Sentry processes error data within the EU.

9. Children's Privacy

The App is a workplace tool not intended for use by children under 16 years of age. We do not knowingly collect personal data from children.

10. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours (Art. 33 GDPR) and affected individuals without undue delay (Art. 34 GDPR).

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify users of significant changes through the app or via email. The "Last updated" date at the top of this page indicates when this policy was last revised.

12. Contact

If you have questions about this privacy policy, your data, or wish to exercise your rights, contact us at:

Rootforce
Email: privacy@rootforce.com

For our Data Processing Agreement, see: Data Processing Agreement (DPA)