1. Data Controller

Tidst is operated by Christian Hougaard, Denmark.

Tidst is the data controller for the personal data we process about you. If you have questions about our processing of your data, please contact us at tidst@proton.me.

2. What information do we collect?

We collect and process the following personal data:

Account information: Email address and Todoist display name when creating an account.
Todoist data: Projects, tasks and activity retrieved via the Todoist API to enable time tracking.
Asana data: Tasks, projects, tags and workspace names retrieved via the Asana API to enable time tracking. Collected only if you choose to connect Asana.
Google Calendar data: Event titles, start times, end times and attendee email addresses (used only to suggest which client a meeting belongs to) from the Google Calendar(s) you choose to connect. Collected only if you opt in, and only for calendars you explicitly select. We never read event descriptions or locations.
Google Tasks data: Task titles and completion times from the Google Tasks lists you choose to watch. Collected only if you opt in when connecting Google.
ClickUp data: Task titles, statuses, tags, time estimates and tracked time from the ClickUp workspaces you choose to connect, retrieved via the ClickUp API to enable time tracking.
monday.com data: Item titles, status labels, tags and tracked time from the monday.com boards you choose to watch, retrieved via the monday.com API to enable time tracking.
Trello data: Board names, list names, and card titles with completion activity from the boards you choose to watch, retrieved via the Trello API to enable time tracking.
Notion data: Database names, task titles, status and last-edited times from the shared Notion databases you choose to watch, retrieved via the Notion API to enable time tracking.
Outlook Calendar data: Event titles, start times, end times and attendee email addresses (used only to suggest which client a meeting belongs to) from the Outlook Calendar(s) you choose to connect. Collected only if you opt in, and only for calendars you explicitly select. We never read event bodies or locations.
Microsoft To Do data: Task titles, categories and completion times from the Microsoft To Do lists you choose to watch. Collected only if you connect Microsoft, and only for lists you explicitly select.
Time entries: The time data you create and edit in Tidst.
Settings: Your preferences such as currency, hourly rates, budget goals and visual preferences.
Newsletter: Email address, if you subscribe to our newsletter.
Forwarded email: If you forward an email to your Tidst address, or copy it in, we keep its subject, the address of the person it was with, and the day it was sent. The message itself is read once, to find a duration you wrote above it, and is not stored.
Billing information: Using Tidst on the free plan requires no payment information. If you subscribe to Premium, payment is handled by Stripe (see section 6), and Tidst keeps only the Stripe customer and subscription IDs and the date your subscription runs to.
Teams: If you create or join a team: the team's name, its clients and projects, who is in it and with which role, invitations (the invited email address and when the invite was used), the weeks you send for approval with their status and any note an admin wrote, and which of your time entries and costs belong to the team. If the team uses its own domain for reports: that domain, whether its DNS is set up, the team's brand colour and whether Tidst is hidden on its reports. The same applies to your own account if you use your own domain on Premium, plus the name and logo you show on your reports.

3. Purpose of processing

We process your personal data for the following purposes:

To provide and maintain the Tidst service.
To synchronize with your Todoist or Asana account.
To generate reports and billing documentation.
To send you onboarding emails and news (only with your consent).
To let teams see the time their members log on the team's work, and to remind members to send their week when the team asks for it.

Use of Google user data: Data obtained through our Google integrations (Calendar and Tasks) is used solely to display your selected calendar events and completed tasks for time tracking within Tidst. It is never used for advertising, marketing, or analytics, and is never shared with third parties for such purposes.

Use of Microsoft user data: Data obtained through our Microsoft integration (Outlook Calendar and Microsoft To Do) is used solely to display your selected calendar events and completed tasks for time tracking within Tidst. It is never used for advertising, marketing, or analytics, and is never shared with PostHog. It is shared only with Microsoft, as necessary to retrieve the data itself.

4. Legal basis

We process your data based on performance of contract (Art. 6(1)(b) GDPR) to deliver the service, and consent (Art. 6(1)(a)) for newsletters. You may withdraw your consent at any time.

5. Cookies

Tidst uses essential cookies for signing in and keeping your session, which need no consent. Only if you accept analytics in the cookie banner does Tidst also use PostHog and Google Analytics cookies, to understand how Tidst is used; you can change that choice at any time under Cookie settings at the bottom of every page. Visit counts come from Vercel Web Analytics, which sets no cookies. Tidst uses no marketing or advertising cookies. The videos on tidst.com play from YouTube, and nothing from YouTube loads until you choose to watch one; see YouTube in section 6. A shared report on a team's or a solo account's own domain sets no cookies at all and runs no analytics.

We do not use automated decision-making or profiling as defined in Article 22 of the GDPR.

6. Data sharing

We share your personal data with the following parties:

Todoist (Doist Inc.): To retrieve your project data via OAuth integration.
Asana (Asana, Inc.): To retrieve your task and project data via OAuth integration, only if you choose to connect Asana.
Google: To retrieve calendar event data via OAuth integration, only if you choose to connect Google Calendar.
Microsoft: To retrieve calendar event and task data via OAuth integration, only if you choose to connect Microsoft (Outlook Calendar and Microsoft To Do).
ClickUp (ClickUp, Inc.): To retrieve your task data via OAuth integration, only if you choose to connect ClickUp.
monday.com (monday.com Ltd.): To retrieve your board and item data via OAuth integration, only if you choose to connect monday.com.
Trello (Atlassian): To retrieve your board and card data via its authorization flow.
Notion (Notion Labs, Inc.): To retrieve your database and task data via OAuth integration, only if you choose to connect Notion.
PostHog: For product analytics, only with your consent to analytics cookies. Used to understand how Tidst is used so we can improve it.
Google Analytics (Google): To count visits and see which pages people find and use, only with your consent to analytics cookies. Google receives your IP address, browser details and the pages you open, but not your name, your email address or anything you track in Tidst. Advertising features and Google signals are turned off.
Supabase and Vercel: Supabase hosts our database and authentication service; Vercel hosts the frontend, including the shared reports a team or a solo account serves from their own domain. Both store and process your data on our behalf.
Resend: To deliver the emails we send you, and to receive the ones you forward to your Tidst address. Resend receives your email address, your name, and the contents of the message, which for the weekly summary includes your tracked hours and the titles of unlogged tasks and calendar events from that week, and for a forwarded email is the email as you sent it.
YouTube (Google): To play the videos on tidst.com, and only when you choose to watch one. Until you click, nothing is loaded from YouTube. When you do, the video plays from YouTube's privacy-enhanced mode (youtube-nocookie.com), YouTube receives your IP address and browser details, and it may store data in your browser under Google's own privacy policy. Tidst sends YouTube nothing about you or your account and gets nothing back.
Stripe: To take payment if you subscribe to Premium. Stripe receives your email address, your name, your billing address, your VAT number if you give one, and your card details, which go straight to Stripe and never reach Tidst. Tidst keeps only the Stripe customer and subscription IDs and the date your subscription runs to. Nothing is shared with Stripe unless you start a checkout.

We never sell your data to third parties.

Support access: Tidst is run by one person, who can open the data in your account (time entries, clients, projects and settings) in order to investigate a fault you have reported or answer a question you have asked. It is used for that and nothing else, and nothing is passed on as part of it. Where a screenshot answers the question, we ask you for one instead.

Tidst's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6a. Teams

When you log time or costs on a team's project or client, the team's owner and admins can see those entries: the date, the time, the project, the description and the amount. They cannot see anything else in your account: your calendar, your connected tools, your Queue, your own clients and the time you log for them all stay yours.

Members of a team see each other's names and email addresses, and the team's clients and projects. Whether members see rates and amounts is a setting the team's admins control.

If you leave a team, or are removed from it, the entries you logged on the team's work stay with the team, because they are part of its records. Your other data stays in your account. If you delete your account, your entries are deleted, including those on team work.

When you invite someone, we send one email to the address you give us, with your name and the team's name. We keep the address with the invitation until it is used, revoked, or the team is deleted.

When a team admin shares a report, the team's name and logo, and the names of team members if the admin chooses to list time per person, are shown to anyone with the link until it expires.

A team, or a solo account on Premium, can serve their shared reports from their own domain, with their own name, logo and colour and without mentioning Tidst. Tidst still processes the report on their behalf, and Vercel serves it on that domain. They decide who gets the link.

7. Data retention

We retain your data as long as you have an active account with Tidst. If you delete your account, we delete your personal data immediately, unless we are legally obligated to retain it longer. We also retain a record of email addresses that previously used the free trial Tidst offered in its first months, even after account deletion, to prevent abuse of that historical trial system. When you change or delete a time entry, an expense or a day off, we keep the version from before so it can be recovered: a deleted one for 30 days, a change for 12 months. Deleting your account removes these along with everything else. Team data is kept while the team exists. When a team is deleted, its clients, projects, invitations and weeks are deleted with it, and so are costs logged on its clients; time entries stay in the accounts of the people who logged them, without the team.

8. International data transfers

Some of our service providers are located outside the European Economic Area (EEA). We use the following providers in the United States: Supabase (database and authentication, hosted on AWS), Vercel (frontend hosting), and Todoist/Doist Inc. (OAuth integration). These transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring your data is protected to the same standard as within the EEA.

9. Your rights

As a data subject, you have the following rights:

Access: You can request to see the personal data we hold about you.
Rectification: You can ask to have incorrect information corrected.
Erasure: You can ask to have your data deleted.
Restriction: You can ask us to restrict the processing of your data.
Data portability: You can download all your time entries directly from Settings → Export Your Data. You may also contact us to receive your data in another machine-readable format.
Objection: You can object to our processing of your data.
California residents (CCPA): You have the right to know what personal information we collect, to request deletion, and to opt out of the sale of personal information. We do not sell your personal information.

tidst@proton.me to exercise your rights. You also have the right to file a complaint with the Danish Data Protection Agency.

If you are located in the United Kingdom, you may also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Security

We use industry standards to protect your data, including encrypted data transfer (TLS/SSL), secure authentication via Todoist OAuth, and access control to our systems.

11. Changes

We may update this privacy policy from time to time. For significant changes, we will notify you via email or a notice in the service.

Privacy Policy