1. Controller

The controller for this processing is Giner Aaron, reachable at contact@gineraaron.com.

2. What is stored

The application stores only what it needs in order to work:

• Account: your account is not held here. It belongs to Ginius Hub at hub.gineraaron.com, which is where you sign in and where your password is stored, under the same controller named above. Tracktivity keeps only the account number the Hub gave you and a copy of your name, so that the entries below can belong to somebody. Tracktivity never sees your password. The Hub's own privacy policy covers what it stores.
• Workspaces: their names and which account they belong to.
• Activities: the name, color and order of the activities you create.
• Time entries: the start and end of every recording, together with its activity and workspace. Taken together this is a detailed picture of how you spend your day — one that exists solely because you entered it.

Nothing is collected automatically: no location, no device sensors, no contacts, no analytics or tracking services, no advertising networks, no profiling and no automated decision-making.

3. Access logs and IP addresses

Every request is logged on the server. Those logs contain the IP address of the device making the request, along with the time, the address requested, the HTTP method and the response status. They exist for running the service, for finding faults and for fending off abuse. The legal basis is the legitimate interest in a secure and functioning service (Art. 6(1)(f) GDPR). The logs are not joined with your account and expire with the usual system rotation.

4. Cookies and local storage

Tracktivity sets exactly one cookie: the session cookie that keeps you signed in here. It is cryptographically signed, sent over HTTPS only, and expires after a year or when you log out. Signing in also sets cookies on hub.gineraaron.com, described in the Hub's own privacy policy; those are set by the Hub on its own address and are never sent to this one. Logging out — here or in any other Ginius Hub app — ends the session here as well: the Hub tells this app over the server's own internal network, passing nothing but your account number, and the cookie stops being accepted from that moment, on this device and on every other one. Your device additionally remembers, locally, the tab you last had open and your preferred list layout. Those local values never leave your device. So that the installed app works offline, the browser also keeps a local cache of the program files — not of your content.

5. No third-party content

The page loads nothing from outside servers. Even the typefaces are served from this server rather than fetched from Google or anyone else. Opening the page therefore creates no connection to a third party, and your IP address is passed to no one.

6. Purposes and legal bases

Workspace, activity and time data, and the account number they hang from, are processed for one purpose only: to provide you with the time tracking you signed up for, which is performance of that arrangement (Art. 6(1)(b) GDPR). For log data, the legitimate interest set out in section 3 applies.

7. Retention and deletion

Your data is kept for as long as your account exists. You can delete the account yourself at any time: the entry in the settings menu takes you to Ginius Hub, which is where the account lives. Deleting it there irreversibly removes the account and instructs Tracktivity to remove every workspace, activity and time entry it holds for you, along with everything any other Ginius Hub app holds; there is no recovery. If Tracktivity cannot be reached at that moment, nothing is deleted anywhere and you are asked to try again, so your entries can never be left behind with no account attached to them. Access logs are not covered by this, as they are not tied to an account.

8. Sharing with third parties

There is none. The data sits on a self-operated server. There are no processors, nothing is sold, and nothing is transferred to a third country.

9. Security

The connection is encrypted with HTTPS throughout. Your password is never sent to Tracktivity: you type it at Ginius Hub, which protects it with scrypt, a deliberately slow algorithm built for the purpose, and Tracktivity is handed only a single-use code that it redeems once over a connection that never leaves the server. Each account sees only its own workspaces, activities and time entries; that separation is enforced on every single query.

10. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can export your time entries as a CSV file yourself at any time. For anything else, a message to the contact address above is enough. You also have the right to lodge a complaint with your competent data protection supervisory authority.