Privacy policy

In short:

• Spindle Cloud keeps what you track and what it needs to run your account. We don't sell it, share it for advertising, or show ads.
• Spindle never keeps or uploads the text of your prompts, your agents' answers or your code.
• This website sets no cookies and loads nothing from other companies. It counts visits with Umami, on our own server, without storing your IP address.
• Everything runs on Hetzner's servers in Germany, in the EU.

Who we are

Spindle is made by Threennovate d.o.o. za usluge, Ulica Matije Gupca 39, 10362 Adamovec (Grad Zagreb), Croatia, registered at the Commercial Court in Zagreb under MBS 081566379, OIB 52107753723. We are the controller of the personal data described here. For anything about your data, write to hello@threennovate.com.

If you use Spindle on a server someone else runs, such as your company's, that server's owner decides what happens to your data there, and we receive none of it.

This website

spindletrack.com sets no cookies and uses no advertising trackers. Fonts, images and everything else come from our own server, so your browser contacts no one else while you read it.

To see how the site is used, we count visits with Umami, which runs on our own server. It records the page you open, the page that sent you here, your browser, operating system, device type, screen size, language, and the country, region and city your IP address points to. Your IP address is not stored: it is combined with your browser details and a value that changes every month into a one-way code, so visits can be counted without recognising you on other sites or months later. If your browser sends a Do Not Track signal, nothing is recorded. The legal basis is our legitimate interest in understanding which pages are useful (Article 6(1)(f) of the GDPR). These statistics are not shared with anyone.

Like any web server, ours may record technical data about each request (IP address, time, the page and your browser) to keep the site secure and working. These logs are deleted within 14 days. The legal basis is our legitimate interest in running a secure website (Article 6(1)(f) of the GDPR).

Spindle Cloud

To provide the service you signed up for, Spindle Cloud keeps the following. The legal basis is the contract between us (Article 6(1)(b) of the GDPR).

Your account

• Your name, email address and password. The password is kept only as a one-way hash.
• Your time zone and how you like dates, times and durations shown.
• Passkeys you add: their public key and the name you give them.
• Your signed-in devices: each device's name, when it signed in and when it was last active.
• When you agreed to the terms, and which version.

What you track

Your time entries (when they started and ended, the description, project, task, tags and whether they're billable), and what your workspace is organised with: projects, clients, tasks, tags, groups, saved reports, and the email address of people invited to it.

Admins of a workspace also enter rates, each person's labor cost, agreements with clients and billed time. Admins see everyone's time in their workspace; members see their own time, and no money.

Activity from Claude Code and Codex

If you turn on suggestions in the desktop app, it reads from the session records of Claude Code and Codex on your computer when you sent each prompt and in which project folder. It keeps on your computer the time of each prompt, the folder, its branches and a short title of up to 80 characters. The text of your prompts, the answers and your code are never kept. Turning suggestions off deletes all of it from your computer.

Spindle Cloud receives only the project you chose for each folder (the folder is named by its git remote address, or a one-way code of its path) and the suggestions you turned down, so your other devices agree.

With activity sync, which is off unless you turn it on, your computer also sends the times you sent prompts, when your agents were busy, and each project's name, git remote address and branch names. Session titles are sent only with a second switch. The text of prompts, answers and folder paths are never sent. Only you can see this: not admins, not reports. Turning activity sync off deletes it from the server.

If you connect an agent such as Claude Code, Codex, Claude or ChatGPT to Spindle, it signs in as you and reads from the server your time, entries and reports in the workspace you choose, and the agent activity you synced, if you did. What it reads goes to that agent's provider, under your agreement with them. Spindle itself sends nothing to any AI provider. You can sign an agent out under Account at any time.

Emails

We send the emails the service needs: confirming your address, invitations, password resets and reminders before your trial ends. They are sent through Brevo (Sendinblue SAS, France), which receives the recipient's address and the message only to deliver it. We send no newsletters or marketing.

Payments

When you subscribe, Paddle (Paddle.com Market Ltd, United Kingdom) sells you the subscription as our reseller and merchant of record. Paddle receives your payment details, billing address and VAT number directly and handles them under its own privacy policy, as a controller. We never see your card details. We keep your subscription's state, the number of seats, when it renews and Paddle's reference to it.

What we see

To run the service and help when you ask, we, the people at Threennovate who run it, can see each organization's name, its owner's name and email, the number of seats, its subscription, when it was created and when time in it last changed. We never look at your time, projects, clients or money. The legal basis is our legitimate interest in running the service (Article 6(1)(f) of the GDPR).

When a team uses Spindle

When an organization uses Spindle Cloud for its team, it decides what its people track and who sees it. For that workspace data, the organization is the controller and we process it on its behalf, as its processor. A data processing agreement is available on request at hello@threennovate.com.

Where it's kept

Spindle Cloud runs on servers of Hetzner Online GmbH in Germany, in the EU. A copy of the database is made every day and kept for 30 days, also on Hetzner's servers in Germany. Brevo sends emails from the EU. Paddle is in the United Kingdom, which the European Commission recognises as protecting personal data to the EU's standard.

How long it's kept

As long as your account exists. When your trial ends without a subscription, your organization becomes read-only; nothing is deleted.

An organization that stays read-only for 12 months is deleted, with its workspaces and the time tracked in them. Its owners and admins are warned by email 30 days and 7 days before, and can download their data or subscribe until the last day. People's accounts stay.

You can delete your account in the web app, under Account, or in the phone and desktop apps' Settings; Delete your account says how, also without the app. Workspaces only you used are deleted with all their data. In workspaces you share with others, your time stays for the team's reports under the name "Deleted user", and your name, email, password, devices and agent activity are removed. A workspace whose only admin you are needs another admin first. Deleted data leaves the backups within 30 days.

In the apps

• The web app uses one cookie to keep you signed in, readable only by our server, and a short-lived one while you sign in with a passkey. It remembers a few choices in your browser, such as the theme. There are no tracking or advertising cookies, so there is nothing to agree to.
• The desktop and phone apps keep your sign-in in the system's secure storage: the keychain on Apple devices, the Android Keystore on Android. The Android app turns off Android's backups, so your account isn't copied to other devices. The desktop app checks our server for updates.
• The apps and the web app record no analytics and send no crash reports.

Your rights

You can download a copy of everything you tracked, in every workspace, with Download your data under Account. You can also ask us for access to the data we hold about you, and ask us to correct or delete it, to restrict its use, or to send it to you in a portable form. You can object to processing based on our legitimate interest. Write to hello@threennovate.com; we reply within one month.

If you think we handle your data unlawfully, you can complain to the Croatian data protection authority, Agencija za zaštitu osobnih podataka (azop.hr).

Changes

When this policy changes, we update this page and its date. If a change affects what we do with data you've already given us, we tell you by email first.