1. Data Controller

Tidst is operated by Christian Hougaard, Denmark.

Tidst is the data controller for the personal data we process about you. If you have questions about our processing of your data, please contact us at tidst@proton.me.

2. What information do we collect?

We collect and process the following personal data:

Account information: Email address and Todoist display name when creating an account.
Todoist data: Projects, tasks and activity retrieved via the Todoist API to enable time tracking.
Time entries: The time data you create and edit in Tidst.
Settings: Your preferences such as currency, hourly rates, budget goals and visual preferences.
Newsletter: Email address, if you subscribe to our newsletter.
Billing information: Subscription status and billing period managed via Stripe. We do not store full card details.

3. Purpose of processing

We process your personal data for the following purposes:

To provide and maintain the Tidst service.
To synchronize with your Todoist account.
To generate reports and invoicing documentation.
To send you onboarding emails and news (only with your consent).

4. Legal basis

We process your data based on performance of contract (Art. 6(1)(b) GDPR) to deliver the service, and consent (Art. 6(1)(a)) for newsletters. You may withdraw your consent at any time.

5. Cookies

Tidst exclusively uses essential cookies, which are necessary for the service to function correctly. These cookies are used for authentication and session management. We do not use any tracking, analytics or marketing cookies. Since we only use essential cookies, no separate consent is required.

We do not use automated decision-making or profiling as defined in Article 22 of the GDPR.

6. Data sharing

We share your personal data with the following parties:

Todoist (Doist Inc.): To retrieve your project data via OAuth integration.
Stripe: To process subscription payments. Stripe may process your name and email address as part of the payment flow.
Supabase and Vercel: Supabase hosts our database and authentication service; Vercel hosts the frontend. Both store and process your data on our behalf.
MailerLite: For newsletter purposes, only with your consent.

We never sell your data to third parties.

7. Data retention

We retain your data as long as you have an active account with Tidst. If you delete your account, we delete your personal data immediately, unless we are legally obligated to retain it longer. However, we retain a record of email addresses that have used a free trial, even after account deletion, to prevent trial abuse. This is based on our legitimate interest (Art. 6(1)(f) GDPR).

8. International data transfers

Some of our service providers are located outside the European Economic Area (EEA). We use the following providers in the United States: Supabase (database and authentication, hosted on AWS), Vercel (frontend hosting), Stripe (payment processing), and Todoist/Doist Inc. (OAuth integration). These transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring your data is protected to the same standard as within the EEA.

9. Your rights

As a data subject, you have the following rights:

Access: You can request to see the personal data we hold about you.
Rectification: You can ask to have incorrect information corrected.
Erasure: You can ask to have your data deleted.
Restriction: You can ask us to restrict the processing of your data.
Data portability: You can download all your time entries directly from Settings → Export Your Data. You may also contact us to receive your data in another machine-readable format.
Objection: You can object to our processing of your data.
California residents (CCPA): You have the right to know what personal information we collect, to request deletion, and to opt out of the sale of personal information. We do not sell your personal information.

tidst@proton.me to exercise your rights. You also have the right to file a complaint with the Danish Data Protection Agency.

If you are located in the United Kingdom, you may also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Security

We use industry standards to protect your data, including encrypted data transfer (TLS/SSL), secure authentication via Todoist OAuth, and access control to our systems.

11. Changes

We may update this privacy policy from time to time. For significant changes, we will notify you via email or a notice in the service.

Privacy Policy