In short

Your time entries, tasks, clients, notes and settings stay in this browser, on your device. stint has no account and no server database: they are never sent to us. Only if you agree, stint uses PostHog (EU servers) to measure usage with pseudonymous page views and sessions. You can withdraw that any time in Settings → Privacy.

Controller

Responsible for the processing described here:

Your data stays on your device

Everything you enter is stored in your browser’s own storage (IndexedDB and localStorage) on this device. That includes your privacy choice itself (stint.consent), which the app needs to work and to respect your choice. Backups and exports are files you save yourself. If you connect an AI agent to stint, the agent works inside your browser on your behalf; what it sends to its own provider is between you and that provider.

Hosting

The app is delivered by Vercel Inc. (USA). When you load it, Vercel processes your IP address and request data (time, page, browser) to deliver the files and keep the service secure. Legal basis: our legitimate interest in delivering the app safely (GDPR Art. 6(1)(f)).

Vercel Web Analytics and Speed Insights

In the hosted app we count page views and measure loading speed with Vercel Web Analytics and Speed Insights. They work without cookies and store nothing on your device; they report the page’s path only (never search text, ids or dates from the address). Vercel counts visitors with a hash of the request that changes daily. Legal basis: our legitimate interest in knowing how much the app is used and how fast it is (GDPR Art. 6(1)(f)).

Product analytics with PostHog (only with your consent)

Only if you choose “Accept all” or turn Analytics on, stint loads PostHog (PostHog Inc., data stored on its EU servers in Frankfurt, Germany) to learn which parts of the app are used.

• What is sent: page views (the page’s path only), which features are used, browser, operating system, device type and screen size. Never your entries, notes, task, client or tag names, amounts or anything you type; no session recording.
• Identifiers: PostHog creates random ids (a device id, a pseudonymous user id and a session id) and keeps them in your browser’s localStorage. That makes the data pseudonymous, not anonymous: your visits can be linked to each other, but not to your name.
• Your IP address reaches PostHog with every request (that is how the internet works); PostHog may derive an approximate location (country, city) from it.
• Legal basis: your consent (§ 25(1) TDDDG, formerly TTDSG, for storing and reading the ids on your device; GDPR Art. 6(1)(a) for the processing).
• Withdrawal: turn Analytics off in Settings → Privacy. stint stops at once, sends nothing more, and removes PostHog’s ids from your browser. Withdrawal does not affect what was processed before.
• Retention: 12 months, then deleted.

Recipients and processors

• Vercel Inc. (hosting, Web Analytics, Speed Insights)
• PostHog Inc. (product analytics, EU servers; with consent)

Both process data on our behalf under data processing agreements. Where data reaches the USA, the transfer relies on the EU–U.S. Data Privacy Framework or the EU standard contractual clauses.

Retention

Data on your device stays until you delete it (in the app, or by clearing this site’s data in your browser). Hosting logs are kept by Vercel for a short time for delivery and security. PostHog events: 12 months.

Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). You can withdraw your consent at any time with effect for the future (Art. 7(3)). Write to contact@spindel.app.

You may also complain to a data protection supervisory authority (Art. 77), for example the one where you live or the one responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI) (https://datenschutz-hamburg.de).