Privacy Policy

Cronfy is a time tracking service available at cronfy-app.web.app. It is operated by Andrey Broker, who is the data controller for the personal data described here (“we”, “us”).

For anything about your privacy, write to andreybroker02@gmail.com.

• Account: your name, e-mail address and password. Passwords are handled by Firebase Authentication and are never stored or seen by us in readable form.
• Your work in Cronfy: workspaces, members and their roles, clients (and any contact details you add for them), projects, tasks, time entries and their descriptions, invitations and join links. Owners and admins may also add hourly rates.
• AI assistant connections: when you connect an assistant through MCP, we keep the name of the app, the permissions you granted and secure (hashed) tokens. Each change an assistant makes is recorded in an audit log: who, which app, which entries and when — never the descriptions.
• Usage analytics (only if you accept): pages visited (the path only, never the full link), a few events such as sign-up, sign-in and button clicks, and the device and approximate location information Google Analytics collects.
• Technical data: our servers keep short-lived logs of requests (such as IP address and errors) to keep the service secure and working.

We don’t collect payment details, and we never sell your data or use it for advertising.

• To provide Cronfy: your timesheet, teams, reports and exports — this is necessary to perform our agreement with you.
• To keep the service secure: authentication, preventing abuse, rate limits and logs — our legitimate interest.
• To understand how Cronfy is used and improve it, with Google Analytics — only with your consent.
• To contact you about your account or important changes to the service.

Connecting an AI assistant (such as Claude Code or Cursor) is optional and up to you. Once connected, the assistant can read your projects and your own time entries and create or change your entries, with exactly your permissions. It cannot delete entries, see other people’s hours, or see rates and amounts.

What the assistant reads from Cronfy is processed by the assistant’s provider under your own agreement with them — check their privacy policy. Cronfy does not send your data to any AI provider by itself. You can disconnect an assistant at any time from the assistant itself.

• Your workspace: owners and admins can see the team’s entries and reports; members see their own entries and the projects assigned to them. Rates and amounts are only visible to owners and admins.
• Our providers: Google (Firebase Authentication, Cloud Firestore, Hosting, Cloud Functions and, with your consent, Google Analytics) stores and processes data for us. Cronfy’s database is in the European Union (Netherlands).

Some providers may process data outside your country, protected by safeguards such as the European Commission’s Standard Contractual Clauses. We only share data with authorities when the law requires it.

Cronfy stores what it needs on your device to work: your session, an offline copy of your data so the app works without internet, your theme and your cookie choice. These are essential and don’t track you.

Google Analytics cookies (_ga) are only set if you click “Accept” in the cookie banner. You can change your choice at any time in Settings › Preferences › Usage analytics; turning it off stops collection and removes those cookies.

• Account and workspace data: while your account or workspace exists.
• Deleted time entries are removed right away; workspace data stays while the workspace exists.
• Server logs: up to 30 days. Analytics data: up to 14 months.
• When you ask us to delete your account, we delete your personal data within 30 days, except what we must keep by law.

Depending on where you live (for example under the GDPR in Europe or the LGPD in Brazil), you have the right to access, correct, export or delete your personal data, to object to or restrict some uses, and to withdraw your consent at any time.

You can edit your profile and entries in the app and export your hours as CSV or PDF. For anything else — including deleting your account — write to andreybroker02@gmail.com; we answer within 30 days. You can also complain to your local data protection authority.

If you are a member of someone else’s workspace, the workspace owner decides about the team’s data; we’ll help them handle your request.

Data travels encrypted (HTTPS) and is encrypted at rest by Google. Access is enforced by security rules on every read and write, AI assistants sign in with short-lived, revocable tokens, and secrets are kept in a managed secret store. No system is perfect: if something happens that affects your data, we will tell you and the authorities as the law requires.

Cronfy is a work tool and is not meant for people under 16. We don’t knowingly collect their data.

If we change this policy, we’ll update the date above and, for important changes, let you know in the app or by e-mail. Read it together with our Terms of Service.

Questions? Write to andreybroker02@gmail.com.