Privacy

Your work stays yours.

Phased stores what it needs to run your workspace, lets you take all of it with you, and keeps analytics separate from your workspace content. The short version is below; the full notice follows it.

Database hosted in the EU

The application runs on Cloudflare and the database is hosted with Turso in the European Union. One workspace owner, ownership checks on every query, no ads and no advertising pixels. Hosting, PDF rendering and email processing can take place outside the EU.

Export and delete, anytime

Settings → Your data gives you a full JSON copy of your workspace. Settings → Account deletes your account and its work data immediately. A pseudonymous trial-abuse marker, short-lived backups, and error diagnostics expire on the schedules below.

Cookieless website analytics

We use Umami to understand visits to our public website and where they come from, and count a limited set of app actions such as completing onboarding or upgrading. You can turn off analytics in this browser below.

The full notice

Last updated 6 October 2026

What we store

  • Account: your name, email address, and a hashed password (never the password itself).
  • Your work data: what you enter to use the app: projects, phases, tasks, time entries, billing settings, clients, and the reports you generate (including your studio name and logo if you upload one).
  • On your device: a cookie keeps you signed in. A login cookie identifies your session by definition, and that is the whole of its job. Alongside it the app saves a few harmless interface preferences in your browser (theme, sidebar and calendar view, your quick-duration presets); those identify nothing and follow you nowhere. Website analytics sets no tracking cookie. If you turn it off below, we remember that choice in a preference cookie; the tracker also keeps a temporary token in memory while the page is open. The sign-in cookie is used to provide the service you request; interface preferences remember the choices you make.
  • Security: to slow down password guessing and bulk sign-ups, sign-in and sign-up attempts are counted per IP address; a counter expires 24 hours after its last use and the next sweep deletes it. Each session also records the IP address and browser it was created from; that record is deleted when you sign out and with account deletion, and expired sessions are swept automatically, at least weekly and usually within hours. The sign-up form is protected by Cloudflare Turnstile, which checks that a real browser is filling it in; Cloudflare receives your IP address and browser signals for that check and we receive only a pass/fail token. Turnstile is designed to work without tracking cookies. The public withdrawal form also limits submissions using an IP counter and a hash of the confirmation email, swept on the same short schedule. Password-reset and confirmation emails are also counted per recipient, using a hash of the email address, swept on the same short schedule.
  • Subscription: if you subscribe to Pro, we store the identifiers our payment provider gives us (the Creem customer and subscription id, the plan, its status, and the current period end) so the app knows what your account is entitled to. Your card details never reach us; they stay with the payment provider.
  • Terms acceptance: we record the first time you accepted each version of the terms: the version, whether you accepted it at sign-up or when starting a Pro checkout, and when. A checkout acceptance also records that you asked for the service to be supplied right away during the 14-day withdrawal period. It is the evidence of the agreement, and of that request, if either is ever questioned.
  • Trial-abuse prevention: after you verify your email, we store a keyed, one-way HMAC of your address and the date your original trial began. Before it is hashed, variants of the same address are folded into one form: spacing and capitalisation, a "+tag" added to the part before the @, and on Gmail addresses the dots and the googlemail.com spelling. One marker therefore stands for every variant that reaches the same mailbox, which is what stops a second free trial being claimed by adding a tag. The marker contains no plaintext email address or user id. It lets a re-created account resume the same trial instead of receiving another one.
  • Website and product analytics: we use cookieless Umami analytics on our public website to understand visits, traffic sources and actions such as clicking a signup link or requesting access. The tracker reads the page URL and title, referring page, screen size and browser language. Before sending an event, we remove page titles, all URL query parameters (including campaign tags) and fragments, and reduce the referring page to its source domain. Our server forwards these events, your IP address and browser user agent to Umami Cloud. Umami says it does not store raw IP addresses; it uses IP and browser information to derive site-scoped identifiers that distinguish visits and derive approximate location and device statistics. These identifiers are not account IDs. We do not send names, email addresses, account or workspace IDs, workspace content, or session recordings. In the app, our own sender counts a fixed list of actions, including signup, onboarding completion, project and time-entry creation, exports, reports, feedback and upgrades. Those events carry limited categories such as report type or billing interval, a general app section and device details, but no page titles or referring pages. We do not track page-by-page browsing inside the app.
  • Error diagnostics: unexpected app errors may send a sanitised error message, stack trace, page path, internal user id, and error correlation id. No session replay, request body, cookies, email address, or report contents are attached; page URLs are reduced to their path.
  • Access requests: if you use the access-request form, your name and email address are sent to our support mailbox so we can respond about access. They are not written to the product database.
  • Feedback you send us: when you use "Send feedback" in the app, the message you write is saved with the category you picked, the email address on your account, and when you sent it, so a mail that never arrives cannot lose it. A copy goes to our support mailbox as the notification, together with your account id, so we can reply and reproduce what you hit. The saved message is deleted with your account; the emailed copy stays in that mailbox until we clear it, and we remove it earlier if you ask.
  • Service emails: we email you to verify your address, to reset a password if you ask, and once to welcome you after your address is verified. A weekly digest of your own tracked week (your hours, projects, and what that time was worth) is on by default; every digest can be unsubscribed straight from the email, and Settings has the same control ("Weekly summary"). These go through our email provider and carry your name and email address. There is no newsletter and nothing from us about anything but Phased: every message is about your account or built from your own data. The digest contains no promotional upgrade messages. You can turn it off in Settings or with the unsubscribe link in each email.

Why, and on what basis

We process account and workspace data to run Phased for you: showing your timesheet, computing your profitability, and rendering your reports. We do not sell your data, share it for advertising or use it to train AI models. Workspace personal data is processed on your instructions under the data processing agreement below. For our own controller activities, your account data is processed to provide the service you signed up for, and your subscription data, together with the record of the terms you accepted, to take and administer your payment (performance of a contract); billing and tax records are kept because accounting law requires it (legal obligation); security counters, bot protection and error diagnostics rest on our legitimate interests in protecting accounts and keeping the service reliable. The trial-abuse marker serves our legitimate interest in preventing repeated free-trial claims. Service emails support the contract; the optional weekly summary supports our legitimate interest in helping you review your work. For website and product analytics, we rely on our legitimate interest in understanding how people find and use Phased so we can improve it. You can object to processing based on legitimate interests, including by switching off the summary or analytics.

Who processes it

  • Cloudflare hosts the application, renders PDF exports, and provides the Turnstile check on the sign-up form. It also holds the application's own diagnostic log lines. We reduce application URLs to paths and filter sensitive patterns from diagnostic messages; we do not deliberately log workspace content or authentication secrets.
  • Creem is our merchant of record: it takes the payment, handles VAT, issues your billing document, and runs the billing portal. It receives the email address and billing details you enter at checkout and is the seller named on your card statement. Creem is a separate controller for that sale, not merely our processor.
  • Turso hosts the database (EU region).
  • Resend delivers our email (password resets, email address confirmations, the welcome note, the weekly digest, and the notification we receive when you request access) when enabled.
  • Proton Mail (Proton AG, Switzerland) hosts the support@phased.studio mailbox. Anything you write to us, and the notification copy of an in-app feedback message, is stored in that mailbox. Withdrawal notices also include the name, confirmation email, purchase details, submission time and reference supplied through our form.
  • Sentry receives sanitised technical error reports when error monitoring is enabled.
  • Umami Cloud receives the website and product analytics described above. Its servers are located in the US and EU. See its privacy policy.
  • GitHub runs and stores a daily off-platform backup of the production database as a private artifact that expires after 30 days. The job runs on GitHub's own machines: it exports the database there, encrypts the copy with a key held only by us, and removes the readable export before anything is uploaded, so what GitHub keeps is ciphertext it cannot read. It exists so your data survives even the loss of our hosting accounts.

For a direct subprocessor we add or replace, this list changes together with the "last updated" date above, and before a new one starts handling your data we publish it here and email every account, at least 30 days ahead. If the change does not suit you, say so within those 30 days: we will look for another way to run that part of the service, and where there is none you can export everything and close the account before the change takes effect, with any prepaid time you have not used refunded.

How long we keep it

  • Account and work data: for as long as your account exists; deleted immediately when you delete the account (see below).
  • Billing and tax records: the record of a payment (never your card details, which we do not hold) is kept by the merchant of record for as long as accounting and tax law requires it to. Creem states seven years for accounting data under the Estonian Accounting Act, with its own periods for contract and due-diligence records; our accounting copies follow Slovak law. Account deletion does not override an applicable statutory retention duty.
  • Terms acceptance: while your account exists; deleted with the account. The merchant of record keeps its own record of the purchase and the consent given at its checkout.
  • Trial-abuse marker: while the verified account exists, then for up to two years after account deletion. Re-registering during that period resumes the original trial clock; an expired marker is purged and no longer affects a later registration.
  • Security counters: rate-limit counters, keyed by IP address or by a hash of an email address, expire 24 hours after their last use, and expired sign-in sessions and verification tokens expire on their own clocks. A sweep deletes all three; it runs off sign-in traffic and a scheduled job, at least weekly and usually within hours of expiry.
  • Backups: the daily off-platform database backup expires after 30 days; the database host's own short-lived recovery copies expire automatically. A deleted account can therefore linger inside the off-platform backup for up to 30 days before the copy holding it expires; backups are restricted to disaster recovery. We do not put restored customer data back into use until relevant erasures have been applied.
  • Billing event log: the signed subscription events our payment provider sends us (its identifiers and statuses, never card details) are kept as the audit trail that reconciles your plan with the merchant of record. Deleting your account clears the account link, but provider identifiers can still be linked to your purchase by Creem; they are not anonymous. We keep this operational log for three years from receipt for billing reconciliation and dispute handling (legitimate interests), then remove it on the next maintenance sweep. It is separate from statutory accounting records.
  • Diagnostic logs: Cloudflare Workers Logs retains application diagnostic entries for up to seven days. These may contain a request id, route path, internal user id and filtered error details. We do not deliberately attach request bodies or workspace content.
  • Mail, once sent: Resend retains sent message content and delivery logs for 30 days on its standard plans, with backups persisting for seven days. Copies in your inbox are under your control. We retain ordinary support correspondence for up to 12 months after the matter is closed, reviewing it monthly; records needed for a legal obligation or an active dispute are restricted and kept for that purpose until no longer needed. Account deletion does not automatically remove these copies. Contact us to request erasure where applicable. Deleted messages can remain in Proton Mail's encrypted backups for up to 30 days.
  • Error diagnostics: sanitised error reports expire in Sentry after at most 90 days.
  • Website and product analytics: retained while needed to compare traffic over time and assess changes to the website or service. We review retained analytics each January and delete records no longer needed for those purposes. There is no automatic age-based deletion configured by this application. Turning off analytics stops future collection from the website and app in this browser; it does not erase previous records. The opt-out preference expires after six months, or sooner if you change it or clear site data.
  • Access requests: the request email stays in our support mailbox until the invite round it belongs to is finished, and no longer than 12 months. Ask us and we delete it sooner.
  • Feedback you send us: the saved message stays while your account exists and is deleted with it. The copy in our support mailbox is kept for up to 12 months so we can come back to a bug report, then removed in our monthly mailbox review. Ask us and we delete it sooner.

Analytics choice

This choice covers the public website and app in this browser; set it separately on other browsers or devices. Your account and access to Phased are unaffected.

Your data, your control

  • Export: Settings → Your data gives you a full JSON copy of your workspace data, any time. The pseudonymous security marker is deliberately not part of workspace backup/import.
  • Deletion: Settings → Account permanently deletes your account, workspace, subscription link, sessions, and pending sign-in or password-reset tokens right away. The pseudonymous trial-abuse marker described above remains for up to two years; the statutory billing record above stays with the merchant of record; residual copies inside backups expire on the schedule above. A running Pro subscription is cancelled with the merchant of record first, immediately rather than at the end of the period, so deletion also ends the remainder of any period you have already paid for. What deletion does not reach is worth naming in one place rather than leaving you to assemble it: the statutory billing record at the merchant of record, the pseudonymous trial marker, copies inside backups until those expire, mail already sent or received, and the scrubbed diagnostic logs until they age out. Our retained billing-event identifiers and error reports also follow the periods above; removing a local account link does not necessarily anonymise provider identifiers. Prefer a human? Email support@phased.studio and we do it for you.
  • Your GDPR rights: you can ask for access, correction, deletion, portability, restriction, or object to processing by emailing support@phased.studio. You also have the right to complain to a data protection authority: your local one, or the one supervising us, the Slovak Office for Personal Data Protection (Úrad na ochranu osobných údajov Slovenskej republiky, dataprotection.gov.sk).

Where it is processed

The primary database containing your account and workspace is stored in the European Union. Other copies and processing can be outside the EU, including the services below:

  • The application runs on Cloudflare's network, which can execute requests outside the EU. PDF rendering also uses Cloudflare infrastructure and is not restricted to the EU.
  • Email is delivered by Resend, which stores message content and delivery logs in the United States. That includes the weekly digest, which is built from your own project names, hours, and amounts.
  • Our support mailbox is hosted by Proton Mail. Its mail servers are located in Switzerland, Germany or Norway, as described in its privacy policy.
  • Website and product analytics is processed by Umami Cloud, whose servers are located in the US and EU.
  • The daily backup is exported and encrypted on GitHub's machines.
  • Error diagnostics, the Turnstile check, and the payment itself are handled by the providers listed above, outside the EU where that is where they are established.

For transfers requiring safeguards, we use applicable adequacy decisions or the European Commission's standard contractual clauses. The EU-US Data Privacy Framework is relevant only where the receiving organisation and processing are covered by its certification. Contact us for details and copies of the applicable safeguards.

Data processing agreement

This agreement is part of the terms of service and binds us automatically on Free, trial and Pro accounts. It applies to personal data you put in the workspace that we process on your behalf ("workspace personal data"). For that processing you are the controller and we are the processor. If you act for another controller, you confirm you have authority to instruct us as a subprocessor. This agreement takes precedence over conflicting general terms for this processing.

  • Scope and duration. Processing consists of collecting, storing, organising, retrieving, calculating with, exporting and deleting workspace personal data to provide time tracking, project management and reports. It lasts while you use the service, followed by the limited return/deletion period below. Data may include names, business contact details, client and project references, time records, work descriptions, rates and report contents concerning you, your clients, their contacts and other people you identify in your workspace. Special-category and criminal-conviction data are excluded unless we separately agree in writing to appropriate safeguards.
  • Your responsibilities. You determine the purposes of the processing, the data entered and the people it concerns. You are responsible for having a lawful basis, providing required notices, and issuing lawful instructions. You may give further instructions or exercise your rights under this agreement by contacting us. If an instruction requires a change outside the service's capabilities, we will explain the available options; this does not limit our mandatory assistance obligations.
  • Documented instructions. We process workspace personal data only on your documented instructions, including for international transfers. These instructions comprise this agreement, your use of the service's controls, and lawful additional written instructions we accept. We do not sell it, use it for advertising or use it to train AI models. If EU or Member State law requires other processing, we will tell you beforehand unless that law prohibits us from doing so. We will immediately tell you if, in our opinion, an instruction infringes EU or Member State data protection law and suspend that instruction while it is resolved.
  • Confidentiality. We restrict access to people who need it to provide the service and ensure they are bound by contractual or statutory confidentiality obligations, including after their access ends.
  • Security. We implement and maintain the technical and organisational measures required by GDPR Article 32, taking account of the processing and its risks. Measures include encrypted transport, hashed passwords, account authentication and ownership checks, restricted production access, encrypted off-platform backups, security monitoring and recovery procedures. We review these measures as the service and risks change. The EU location of the main database does not mean all processing stays in the EU.
  • Subprocessors. You give general written authorisation to use Cloudflare for hosting and PDF rendering, Turso for database hosting, GitHub for encrypted backup production and storage, and Resend when workspace personal data is included in email. Proton Mail also acts as a subprocessor to the extent you ask us to handle workspace personal data through support. These are distinct from providers acting for our own controller purposes, including Creem for purchases and our account/security administration. We engage subprocessors under written agreements imposing the same applicable data protection obligations and remain responsible to you for their performance. Before adding or replacing a direct subprocessor we give the notice and opportunity to object described above.
  • International transfers. You authorise the locations and transfers described in this notice. Where GDPR Chapter V requires a transfer safeguard, we use an applicable adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses. You can request information about the applicable safeguards and a copy, with confidential information redacted where necessary.
  • Assistance. Taking account of the nature of processing and information available to us, we assist you with data-subject requests and compliance with GDPR Articles 32 to 36, including security, breach assessment and notifications, data protection impact assessments and prior consultation with a supervisory authority. Export and deletion controls provide part of this assistance. If a person contacts us about workspace personal data, we refer the request to you and do not respond substantively without your instructions unless law requires it.
  • Breaches. We notify you without undue delay after becoming aware of a personal data breach affecting workspace personal data. We provide the information available about its nature, affected data and people, likely consequences, contact point, and measures taken or proposed. We provide further information as it becomes available and cooperate with your response; we do not wait for a complete investigation before notifying you.
  • Evidence and audits. We make available the information needed to demonstrate compliance with GDPR Article 28 and allow and contribute to audits, including inspections, by you or an auditor you mandate. We ordinarily start with documents and written answers. Where further verification is needed, reasonable arrangements for notice, timing, confidentiality and protection of other customers' data apply; they do not exclude an inspection required to demonstrate compliance or restrict a competent authority's powers.
  • Return and deletion. At the end of the processing service, you choose return or deletion of workspace personal data. You can export it at any time and then delete the account, or instruct us to help. Cancelling Pro alone leaves your Free account open and does not end all processing. We delete live workspace personal data when the account is deleted and delete remaining backup copies through the retention cycle above, keeping them restricted to recovery and reapplying erasures before restored data is used. We retain data beyond that only where EU or Member State law requires it. Records we keep separately as a controller are governed by the purposes and retention periods in this notice, not permission to reuse your workspace content.

A separately signed copy of this agreement is available at no charge from support@phased.studio. Requesting one is optional and does not postpone these obligations.

Terms

This notice forms part of the terms of service. Keep your own backup of anything money-critical alongside it. Settings → Your data exports the lot.

Contact

Ing. arch. Marko Rimár, Haanova 2601/46, 851 04 Bratislava-Petržalka, Slovakia · support@phased.studio · +421 903 759 958 · contact page