Privacy Policy

Last updated: 1 October 2026

Data controller

The controller of your data is HDF Advisory, a SASU with share capital of €200, 12 rue Louis Revon, 74000 Annecy, France, SIREN 107 032 104. Contact: contact@hdf-advisory.com.

Data collected

When an account is created, the app collects an email address and a password (through Firebase Authentication). If you choose "Continue with Google" or "Continue with Apple", we receive the email address tied to that account, and the name you agree to share. Apple lets you hide your address: in that case we only receive a relay address.

Once signed in, you enter your own project names, categories, dates, work durations and free-text notes. The app also records the minimal technical information it needs to run: your account identifier, its creation date, your subscription status, and — if you turn them on — a device identifier used to send you notifications.

We collect no location data, no contacts, and the app contains no advertising network and no third-party analytics tool.

Use and legal bases

This data is used only to run the app: showing your projects and time, syncing them across your devices, and enabling the summaries you send yourself. The legal basis is the performance of the contract between us, that is, providing the service you signed up for.

Managing your subscription and issuing invoices also rest on the performance of that contract, and on our accounting and tax obligations for keeping billing records.

No data is sold, rented or shared for commercial or advertising purposes. No ad tracking. The app contains no third-party analytics: we only count, in our own data, the number of active accounts. The marketing website may use cookie-free, identifier-free analytics (Cloudflare Web Analytics), which does not follow visitors from one site to another.

Subscription and payment

We never see your card number and store it nowhere. Depending on where you subscribe, payment is handled by Stripe Payments Europe Ltd. (subscription taken out from the website), by Apple (App Store) or by Google (Google Play). Those companies act as controllers for the payment data they collect, under their own privacy policies.

On our side, we keep only what tells us whether your subscription is active: a customer identifier, the subscription status, its renewal date and the channel used.

Business accounts (Company mode)

If you join a company's workspace, the time you log on that company's projects is visible to the people who administer it and to the managers of the projects concerned. That is the very purpose of the feature, and you are told about it when you accept the invitation.

On your side, you only see the projects you have been attached to. In that setting, the company that invites you is the controller of the data collected.

Projects you create for yourself stay separate and are never visible to the company.

Hosting, processors and transfers

Data is stored on Google Firebase, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Storage of your projects and hours (Cloud Firestore) and the processing that handles them (Cloud Functions) are located in the European Union.

One exception, which we would rather state plainly: Firebase Authentication, the service that handles sign-in and holds your account email address, is operated by Google exclusively from the United States. The service offers no region option, and that transfer is covered by the European Commission’s standard contractual clauses.

Our other processors are the payment providers mentioned above, and our transactional email provider, established in the United States, whose sending is operated from the European Union: it delivers project invitation emails and end-of-trial reminders. It receives the recipient’s email address, the name or address of the person inviting them, and the name of the project concerned. Where a transfer outside the European Union may occur at one of those providers, it is covered by the European Commission’s standard contractual clauses.

API access

If you are a subscriber, you can create from the web app (Account → API) a personal key that lets a tool of your choice — an assistant such as Claude, an automation tool, a spreadsheet, a script — READ your projects, their budgets, your hours and the notes on your entries. The API cannot change anything. It only gives access to what the app already shows you: a project manager gets the project total, never the other members’ detailed entries or notes.

That transfer happens on your initiative and to the tool you choose: that tool then processes the data under its own terms, and you are responsible for it. We only keep a fingerprint of your key (never the key itself), its name, its creation date, its last use date and a daily call counter used to enforce usage limits. You can revoke a key at any time; it stops working immediately, and all your keys are erased with your account.

Retention and deleting your account

Your data stays available for as long as your account exists. You can delete your account at any time from the app, Account screen, "Delete my account" button: deletion is immediate and permanent, subject to the one reservation set out below. Your profile, your billing, your devices, your API keys and the projects where you are the only admin are erased along with their time, categories and notes, with no way to restore them. You can also request that deletion by writing to contact@hdf-advisory.com from your account email address; it then happens within 30 days.

One reservation, and it concerns company administrators only: deletion is refused for as long as seats are assigned to other people, or for as long as the company subscription is live. We do not cut off your colleagues’ access on your behalf, and we do not leave a subscription running with no holder. Release the seats and cancel the subscription from the "Company" screen in the web app, then try again; the app tells you which of the two conditions is blocking.

On a project administered by someone else, you are removed from the members, but the time you logged stays with the project: it is part of its history.

Only billing records are kept beyond that, for as long as French accounting and tax law requires, namely ten years.

If you belong to a company's workspace, the time logged on that company's projects belongs to it and is kept by it, even after your personal account is deleted.

Security

Access to an account is protected by your password, or by your Google or Apple account. Exchanges between the app and our servers are encrypted in transit (TLS), and data is encrypted at rest by the host. Server-side access rules ensure that an account can only read its own data and that of the projects it has explicitly been attached to.

Your rights

Under the General Data Protection Regulation, you have the right to access, rectify, erase, restrict and object, as well as the right to data portability. You can exercise them at any time by writing to contact@hdf-advisory.com; we reply within one month.

If you believe your rights are not being respected, you may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

This website sets no analytics cookie; only your light or dark theme choice is kept in your browser, and it is never transmitted.

Minors

The app is a professional tool: it is not aimed at children and is not intended for people under 16. We do not knowingly collect data about them.

Changes

This policy may change along with the app. Any substantial change is flagged in the app, and the last-updated date shown at the top of this page is refreshed.

Language

This policy is a courtesy translation. The French version, available at advisory-temps.com/confidentialite/, is the legally binding one and prevails in case of any discrepancy.