Privacy policy

Version of 7 November 2026

This policy explains how personal data of TimeCharm users is processed: the timecharm.ru website, the web app at app.timecharm.ru, the macOS, iOS and Android apps, and the demo and survey at tt.plamit.ru.

1. Controller

The data controller is Dmitriy Mitrofanov, a self-employed individual in the Russian Federation. Contact for any data question: mdevilnsk@gmail.com.

2. What we process

• Account: e-mail address, password hash (the password itself is never stored), interface language, sign-up date.
• Profile: full name, a photo if you upload one, and the document details you enter yourself (legal status, tax IDs, address, bank details, phone).
• Work data: tasks, descriptions, time entries, employers, projects, rates, reports, acts and invoices. If you enter an employer’s details, you are responsible for being allowed to share them.
• Payments: plan, subscription period, payment IDs and amounts. Card details are entered at YooKassa, the App Store or Google Play and never reach us.
• Technical data: IP address, browser or device type and request times in server logs and for brute-force protection; the session cookie; a device ID for sync.
• Ads on the free plan in the iOS and Android apps: Yandex Advertising Network may process the device advertising ID under its own policy. The web and macOS versions use no third-party ad networks.
• Web analytics, only with your consent: Yandex Metrica collects visit statistics on timecharm.ru and app.timecharm.ru — pages, clicks, the steps to sign-up and payment; see section 8.
• Survey: your answers and, only if you provide it, a contact.

We do not process special categories of data or biometrics. The service is not intended for children under 14.

3. Why

To provide the service (time tracking, sync, reports, acts and invoices), to sign you in and recover access, to take payments and renew subscriptions, to answer your requests, to understand how visitors use the site and improve it (only with consent to analytics), to protect the service from abuse and to meet legal obligations such as tax accounting. We do not sell your data or use it to profile you for advertising.

4. Legal basis

Performance of our agreement with you (terms of use and subscription offer), your consent given at sign-up or in the survey, and legal obligations. You can withdraw consent by writing to mdevilnsk@gmail.com; the account cannot work without it, so withdrawal means deleting the account. Consent to web analytics is given separately with the “Accept” button in the cookie notice and can be withdrawn on the cookie policy page; it does not affect your account.

5. Where data is stored

The servers are currently located in the United States (a rented virtual server). For users from Russia this is a cross-border transfer to a country that is not on the list of countries with adequate protection; by signing up you consent to it. Connections are encrypted (HTTPS), passwords are stored only as hashes, only the operator has server access, and backups are kept on the same server and on the operator’s computer. We plan to move the data of Russian users to servers in Russia and will update this policy when that happens.

6. Who receives data

• the hosting provider of the US server — storage;
• Resend (USA) — your e-mail address and the text of service e-mails;
• YooMoney / YooKassa (Russia) — payment amount, description and ID for web and macOS payments;
• Apple and Google — when you subscribe in their stores, under their rules;
• Yandex — only with your consent: visit data from the site and the web app via Yandex Metrica (a browser ID in a cookie, IP address, pages, clicks, transitions, and on timecharm.ru Session Replay of on-page actions without what you type into fields) for statistics and site improvement;
• Yandex — the advertising ID when ads are shown in the mobile apps on the free plan;
• an employer you sent a report link to — tasks, time and amounts for the chosen period;
• public authorities — only upon a lawful request.

7. Retention

Account data is kept while the account exists. When you delete your account (Profile → Delete account) data is removed from the database at once and from backups within 14 days. Payment records are kept as long as tax law requires. Server logs are kept for a limited time and cleaned regularly. A survey contact is kept for up to two years or until you withdraw consent.

8. Cookies and local storage

Necessary cookies and browser storage are used: the sign-in session, interface settings and the local copy of your data for offline work. With your consent, Yandex Metrica runs on the site and in the web app; there are no advertising cookies. See the cookie policy.

9. Your rights

You may request access to and a copy of your data, correct it (mostly yourself in the profile), delete your account, withdraw consent and object to processing by writing to mdevilnsk@gmail.com; we reply within 10 business days. You may also complain to a data protection authority (in Russia — Roskomnadzor).

10. Demo

The demo at tt.plamit.ru is shared: everything you enter there is visible to other visitors. Do not enter personal data.

11. Changes

New versions are published on this page; we will notify you of material changes by e-mail or in the app.