Gleeo Time Tracker
Encrypted before your data leaves your device.
Project and task names, detail texts and locations are unreadable to us. What we do need for calculations, we state openly.
What is encrypted – and what is not
Encryption takes place in the app or the browser with AES-256, before anything is uploaded. The key is formed from your domain's password, which only your team knows.
- Project and task names including extra fields
- Detail texts of time entries
- Locations and location data
- Email address, first and last name
- Name of the domain
- Start and end of time entries
- Working time data: working hours, vacation, absences, employment percentage, approvals
The service needs this information to calculate balances, overtime and reports. We only look at it to the extent that operation and support require.
Because we do not know the domain password, we cannot recover it either. So keep it in a safe place.
Where the data is stored
Database, web application and website run in Hetzner's data centre in Germany. Data protection under the GDPR and the Swiss FADP.
The website sets no cookies; the web application sets only a session cookie for signing in. We use no analytics, tracking or advertising services anywhere.
The app stores its data on the device. The data only leaves it if you export, switch on the backup to Google Drive or use Sync&Team.
Signing in
Sign in with your existing account (OAuth2), without an additional password.
The classic sign-in without Google or Apple. We do not know your password.
The web application keeps you signed in until you sign out or have not used it for 30 days.
Backup, export and deletion
The database is backed up daily, in encrypted form. Deleted data disappears from the backups after 44 days at the latest.
All data as CSV, from the app and the web application.
If you remove a person from the subscription, their time entries and working time data stay with the business. The person loses access to your domains.
An account can be deleted by its owner at any time. If it is dormant, we delete it no later than 24 months after the last sign of life and announce this at least 14 days in advance by email. Data of an active subscription is not deleted.
What we promise is in the contract.
The business agreement governs use by businesses, including retention, deletion and the engagement of sub-processors. The data processing agreement forms part of it and describes the data, the security measures and the sub-processors.