stoppmichnicht

Deutsch

Privacy Policy

Last updated: October 2026

This English version is provided for convenience only. The German version is the legally binding one.

1. Controller

Carsten Fregin
spielgestalt
Pracherdamm 106
25436 Tornesch
Germany
Email: stoppmichnicht@spielgestalt.de
Phone: +49 151 55382224

We have not appointed a data protection officer because we are not required to do so. For any privacy question, please contact us at the address above.

2. Overview

stoppmichnicht is time tracking for teams: track time with a timer or by hand, organise it by clients, projects and tasks, work together in a team with roles and create invoices. This policy covers

The website, the web app and the apps use no advertising, no tracking and no analytics or statistics software (e.g. Google Analytics). We only process the data needed to run them.

3. Who is responsible for what?

For the website, for your user account (registration, sign-in) and for communication with us, we are the controller within the meaning of Art. 4(7) GDPR.

The content of a team – members and invitations, clients and their contact persons, projects, tasks, time entries, approvals, expenses with receipts, hourly rates, billing details and invoices – we process on behalf of the organisation or person that created and manages the team (e.g. your employer, your client or your own business). They are the controller for this data and we are their processor under Art. 28 GDPR. This is governed by the data processing agreement (German only) that is concluded when a team is created. The team determines the purposes and legal bases for this data (e.g. recording working and project time in an employment relationship); please contact your team first with questions or requests about it. If such a request reaches us directly, we forward it to the team and help them answer it.

Sections 7 to 9 describe how we process this data technically.

4. Visiting the website stoppmichnicht.de (part A)

The website is delivered via Firebase Hosting (Google), a worldwide network of servers that serves pages from a location close to you. When you visit, Google processes technically necessary information: IP address, time, requested address, amount of data transferred, browser and operating system (user agent) and possibly the previously visited page (referrer). This information is needed to deliver the site and protect it against attacks and is not combined with other data. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure, working website).

The website sets no cookies and loads no content from third-party servers; fonts and images are hosted with the site itself. Only if you switch between light and dark mode at the top right does your browser store this choice in local storage (localStorage, key "smn-theme"); it is not sent to us and you can delete it at any time in your browser settings. This is strictly necessary for the function you requested (§ 25(2) no. 2 TDDDG).

5. Contact by email

If you email us, we process your email address, your name (if given) and the content of your message in order to answer your request. The legal basis is Art. 6(1)(b) GDPR where your request concerns the use of stoppmichnicht, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering requests). We delete messages once they have been dealt with, unless statutory retention obligations apply.

6. Registration and sign-in (part B)

You need a user account to use stoppmichnicht. You can sign in

Sign-in is handled by Firebase Authentication (Google), which stores a random user ID, email address, name, sign-in method, whether the email address is verified and the time of registration and last sign-in. In addition, we create a user profile in our database (Cloud Firestore) with name, email address, time of registration and the team you last selected. The legal basis is Art. 6(1)(b) GDPR (performance of the user agreement).

7. Teams, roles and invitations

Whoever creates a team becomes its owner. For each team we store its name, the owner, the time it was created and, as a record of the conclusion of the data processing agreement, its version, the time and the user ID of the person who created the team. For each member we store their role (owner, admin, manager or member), name, email address and the time they joined; the other members of the team can see this information.

Owners and admins can invite other people by their email address. For this we store the invitee's email address, the intended role, who invited them and when. We send an email to this address containing the name of the team, the name of the person inviting and the intended role; replies go to the person inviting. We use Google Workspace (Gmail, section 13) to send it. The email contains no tracking images and no redirected links; we do not record whether it is opened. The invitee sees the invitation once they sign in with this address and have verified it. When the invitation is accepted or revoked, it is deleted.

Owners and admins can change roles and remove members from the team; members can also leave a team themselves. The tracked time stays with the team. So that it can still be attributed to a person in reports and invoices, we keep the name, email address, last role and the times of joining and leaving of the former member with the team; owners, admins and managers can see this information.

This processing is carried out on behalf of the team (section 3). For the data you contribute yourself as a member and for linking your account to your teams, the legal basis is also Art. 6(1)(b) GDPR.

8. Clients, projects, tasks and time entries

A team stores:

The database checks who may see what based on the role: members only see projects they are assigned to and only their own time entries, expenses and approvals; managers, admins and the owner see all projects as well as the time entries, expenses and approvals of all members of the team. Time entries can therefore be used to evaluate working and project time; whether and how this happens is decided by the team as controller.

9. Hourly rates, billing details and invoices

Owners and admins can manage hourly rates, the team's billing details (company name, address, contact details, VAT ID or tax number, IBAN, BIC, bank, tax mode, tax rate, payment terms, footer) and invoices; other members cannot see them. An invoice contains a copy of the team's billing details and the client's details at the time of creation, the invoice lines, amounts, the time entries billed, its status (open, paid, cancelled) and who created it and when. Our server (Cloud Functions, Frankfurt) generates a PDF file with an embedded e-invoice (ZUGFeRD) and stores it in Cloud Storage (Frankfurt); the apps and the web app can only retrieve it via the server. If owners or admins send an invoice by email within the service, our server sends it to the given addresses with the team's company name as sender name (section 13); replies go to the email address in the billing details. We store on the invoice when and to whom it was sent.

Invoices are usually subject to statutory retention obligations on the part of the team (§ 147 AO, § 14b UStG). The team is responsible for complying with them (see section 14).

Subscription and payment

For the paid Team plan (see terms of use, section 3) we store with the team its plan, the status of the subscription (e.g. trial, active, cancelled), the billing interval, the number of members billed, the end of the trial or billing period and the identifiers of the customer and the subscription at our payment service provider. We also count a team's active projects to apply the limits of the Solo plan.

Payment is handled by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). For the free trial we only create a customer at Stripe with the team's name and the booking person's email address, without payment details. When you book the Team plan, you enter your billing address, VAT ID where applicable and your payment details (credit card, also via Apple Pay or Google Pay, SEPA direct debit or PayPal) on our order page in input fields loaded directly from Stripe (Stripe.js); payment details never reach our servers. If you choose Apple Pay, Google Pay or PayPal, you confirm the payment with that provider (Apple Distribution International Ltd., Google Ireland Limited or PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg); they receive the amount, the payee and the details needed for the payment and process them under their own privacy policies. For fraud prevention, Stripe.js collects technical information about the browser and device (e.g. IP address, browser details) and is only loaded on the order page. We transmit the team's name, the booking person's email address and the number of members to Stripe and receive from Stripe the status of the subscription, the billing data of each payment and whether a payment succeeded. Stripe processes the data for payment processing, fraud prevention and its own legal obligations partly as an independent controller; see Stripe's privacy policy. The legal basis is Art. 6(1)(b) GDPR (performance of the contract) and, as far as fraud prevention is concerned, Art. 6(1)(f) GDPR.

We issue the invoices for the Team plan ourselves. From the billing data of a payment (name or company, billing address, email address, VAT ID where applicable, number of members, amounts, period and payment date), our server (Cloud Functions, Frankfurt) creates a PDF file with an embedded e-invoice (ZUGFeRD), stores it in Cloud Storage (Frankfurt) and sends it by email to the address stored with Stripe (section 13). The team's owner and admins can retrieve the invoices in the web app. The invoices are kept even if the team is deleted (for retention see section 14). For our bookkeeping, we pass the invoices on to our tax advisor once a month together with an overview (number, date, name or company, country, VAT ID where applicable, amounts, payment date); the tax advisor is bound by professional secrecy and acts as an independent controller. The legal basis is Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (tax obligations).

For every order we store as evidence who ordered which interval for which team with how many members and when, which version of the terms applied and that you agreed to the notes on the right of withdrawal, and we send the contract confirmation by email (section 13). If you cancel via "Cancel contracts here" (without signing in), we process the data you enter (name, email address, team if given, type of and reason for the cancellation, time of receipt) to identify and end the subscription, and confirm receipt by email to the address given and to the billing recipient's address; a copy goes to our mailbox. We keep order records and cancellations for the statutory limitation and retention periods (usually three or ten years, section 14). The legal basis is Art. 6(1)(b) and (c) GDPR (contract, legal obligations under §§ 312f, 312k German Civil Code) and Art. 6(1)(f) GDPR (evidence against claims).

10. Storage in the browser and on the device

The web app stores your sign-in in your browser's storage (IndexedDB or localStorage) so that you stay signed in, as well as a short-lived token of the abuse protection (section 11). The apps store the sign-in in the device's protected storage (e.g. keychain) and your language setting; the Mac app also stores the idle detection settings (whether and after how many minutes without input it asks; this is evaluated only on the device). If you turn on reminders ("timer running for a long time", "nothing tracked today"), the apps store this setting on the device and schedule the reminders as notifications of the device itself; nothing is sent to us or to third parties for this. Neither the web app nor the apps set cookies for advertising or statistics. This storage is strictly necessary to provide the service you requested (§ 25(2) no. 2 TDDDG); the legal basis for the associated processing is Art. 6(1)(b) GDPR. Signing out deletes the sign-in.

When you sign in with Google or Apple in the web app, a Google or Apple window opens; the sign-in runs via the address app.stoppmichnicht.de/__/auth, which is forwarded to Firebase Authentication.

11. Abuse protection (App Check)

To make sure that only genuine apps and the genuine web app can access the database and server, we use Firebase App Check (Google). For this,

The content of your entries is not transmitted. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protecting the service and the data of all teams against automated abuse); we consider access to your device strictly necessary to provide the service securely (§ 25(2) no. 2 TDDDG).

12. Server logs and crash reports

Operating the service produces technical logs (Google Cloud Logging): time, function or address called, user ID, IP address, browser or app information and error messages, for errors also the identifiers of the team and record concerned. We do not log the content of your time entries, clients or invoices. Logs are deleted automatically after 30 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in operation, troubleshooting and abuse prevention).

If the apps (iPhone, iPad, Android, Mac) crash or run into an unexpected error, they send a crash report to Firebase Crashlytics (Google): time, error message and code location (stack trace), app version, device model, operating system and its version, language, free memory and device orientation, and a random identifier of the app installation that groups reports from the same device. We do not add your user ID, your name, your email address or the content of your time entries, clients or invoices to these reports. The web app does not send crash reports. Crashlytics deletes the reports after 90 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in finding and fixing errors in the apps); we consider storing the installation identifier on the device strictly necessary to provide stable apps (§ 25(2) no. 2 TDDDG). You can object to this processing as described in section 15.

13. Service providers, storage locations and transfers to third countries

We run stoppmichnicht on Firebase and Google Cloud. Our contractual partner is Google Ireland Limited or Google Cloud EMEA Limited (both Gordon House, Barrow Street, Dublin 4, Ireland), acting as our processors. Storage locations:

We send invitation emails (section 7), invoices that a team sends to its clients within the service and notices about returned weeks (sections 8 and 9), invoices, contract confirmations and cancellation confirmations for the Team plan (section 9) and the notice to members when a team is deleted (section 14) via Google Workspace (Gmail), also provided by Google Ireland Limited as our processor. For this, Google receives the invitee's email address, the name and email address of the person inviting, the name of the team and the role, or the recipients' addresses, the invoice, the team's company name and email address and the message text, or the email address, week, name of the deciding person and comment, or the invoice recipient's email address, the name of the team and the invoice, or the members' email addresses, the name of the team and the owner's name; the email sent is kept in our mailbox. Gmail is a global Google service.

Payment processing is carried out by Stripe Payments Europe, Ltd. (Dublin, Ireland; section 9). Stripe may transfer data to affiliated companies in the USA (including Stripe, LLC), relying on the EU-US Data Privacy Framework and the EU standard contractual clauses.

Where data is transferred to the USA (in particular to Google LLC), this is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework, under which Google LLC is certified, and additionally on the EU Standard Contractual Clauses in Google's data processing terms. For "Sign in with Apple", App Attest and DeviceCheck, Apple processes data under its own terms, possibly also in the USA (Apple Inc. is also certified under the Data Privacy Framework).

Billing data for the Team plan is also received by our tax advisor (section 9). Beyond this, we only disclose data where we are legally required to do so. Within a team, members can see other members' data as described in sections 7 and 8.

14. Retention and deletion

We store your data for as long as your account or the team exists.

Deleting your account: You can delete your account yourself at any time in the settings ("Delete account", in the apps and in the web app). Your sign-in account, your user profile and your team memberships are deleted immediately. A team in which you are the only member is deleted along with all its content (clients, projects, time entries, expenses with receipts, invoices). If you are the owner of a team with other members, you must first transfer the team to another member, remove the members or delete the team. Alternatively, send an email to stoppmichnicht@spielgestalt.de from your account's address and we will delete your account within one month. Time entries you recorded in a team are part of that team's records; the team decides on their deletion as controller. So that the team can still attribute these entries, your name and email address remain stored there as a former member. Your name may also appear in invoices a team has already created, where it is listed there.

Team content (clients, projects, tasks, time entries, expenses, invoices) can be edited, archived or deleted by managers, admins and the owner within their permissions. When a team stops using the service, we delete its content in accordance with the data processing agreement. If the owner deletes the team in the team settings, all members lose access immediately; the content is deleted permanently 30 days later (kept until then for restoring or handing over) or immediately if the owner chooses so. When an expense is deleted, we also delete its receipt. Exports (section 15) are available for download for about one hour at most and are then deleted. Until then, invoices and invoice PDFs are kept unchanged; the team itself must ensure statutory retention (§ 147 AO, § 14b UStG), e.g. by downloading and archiving the PDF files.

We retain the invoices we issue to you for the Team plan and the related payment records for ten years under § 147 AO and § 14b UStG. Server logs are deleted after 30 days, crash reports after 90 days (section 12). We back up the database daily; deleted data disappears from these backups after 7 days at the latest. Statutory retention obligations that apply to us remain unaffected; in that case we restrict processing until the period expires.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to withdraw any consent given at any time with effect for the future (Art. 7(3)).

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can create a copy of your data (account, teams and the time you tracked) as a ZIP file with JSON and CSV yourself at any time in the settings ("Export my data"); owners and admins export the data of the whole team in the team settings. For data we process on behalf of a team (section 3), please address your request to the team; we will support them. For everything else, an email to stoppmichnicht@spielgestalt.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority responsible for us, the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Kiel, Germany.

16. Obligation to provide data, no automated decisions

Without an email address or sign-in via Google or Apple we cannot create an account; all other information is voluntary, to the extent you want to use the respective feature. There is no automated decision-making including profiling (Art. 22 GDPR).

17. Minimum age

stoppmichnicht is intended for businesses, freelancers and their teams and may only be used from the age of 18.

18. Changes

We update this policy when the service or the data processing changes. The current version is always available at stoppmichnicht.de/privacy.

Back to home