Transparency & control — find out exactly how MyWorkLog protects your data.
Welcome to MyWorkLog. Protecting your personal data is important to us. This privacy policy informs you which data is processed when you visit this application, for what purpose and on what legal basis.
Controller pursuant to Art. 4 No. 7 GDPR and § 5 DDG:
For full details, see Legal notice. A data protection officer is not legally required (Art. 37 GDPR, § 38 BDSG).
MyWorkLog stores the following information primarily local in your browser’s local storage:
If you enable cloud synchronization and log in, your locally stored data is additionally stored on servers of Supabase (Supabase Inc., USA). Further details can be found in section 4.
On this website, aggregated, anonymized page views are collected via Cloudflare Web Analytics collected. This product is cookieless: It sets no cookies, does no fingerprinting, does not permanently store IP addresses and performs no cross-site tracking. Only aggregated metrics such as page views, referrer, browser type and country are processed. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in statistical reach measurement).
In addition, PostHog is used to understand how the application is used and to improve its features. Processing takes place exclusively on the PostHog EU servers (eu.i.posthog.com, hosted in Frankfurt). No transfer to the USA takes place.
What is collected:
PostHog is configured so that no person profiles are created (person_profiles: 'never') and no automatic click tracking
(autocapture: false) takes place. Only the explicitly defined events listed above are recorded.
No cookies are set. PostHog would create a first-party cookie by default; this is deliberately turned off here (persistence: 'localStorage'). To distinguish returning sessions, a randomly generated identifier is stored in the
LocalStorage of your browser instead. This identifier contains no personal data, is not used across websites, and disappears as soon as you clear this site's browser data.
The analysis produced from this data is publicly visible: Analytics dashboard. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in improving and statistically evaluating the application). Objection: Collection can be prevented with a browser ad blocker or a "Do Not Track" setting; the application works unchanged either way. Details: PostHog Privacy Policy.
This application is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When the page is accessed, Cloudflare technically necessarily processes the following data:
This data is processed in server logs and aggregated or deleted after a short time. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in stable, secure operation of the application). Third-country transfer: Cloudflare is certified under the EU-U.S. Data Privacy Framework; in addition, standard contractual clauses (SCC) are in place. Details: Cloudflare Privacy Policy and Cloudflare GDPR.
The domain myworklog.de is registered with INWX GmbH (Prinzessinnenstraße 30, 10969 Berlin, Germany). INWX only manages the registration of the domain with DENIC; name resolution (DNS) and content delivery run through Cloudflare (see above). When you visit this website, no data is transmitted to INWX. Details: INWX privacy policy.
If you write to us by e-mail (for example to info@myworklog.de or support@myworklog.de), your e-mail address, the content of your message and any data you provide are processed and stored by our e-mail provider: Zoho Corporation B.V. (Beneluxlaan 4B, 3527 HT Utrecht, Netherlands). The mailboxes are located in data centres within the EU (Amsterdam and Dublin); no data is transferred to third countries.
The same applies to feedback you send us through the app (see section 4): it reaches us as an e-mail and is then stored in this mailbox.
Details: Zoho Privacy Policy and Zoho GDPR.
Beyond the reach and product analytics described in this section, no further data is collected. In particular, this page contains no:
Note: For the Google Search Console the domain is verified as property. The Search Console does not process any visitor data of this website; it merely provides the operator with statistics about Google search results. No personal data about you is collected through this.
Sending feedback is voluntary, and you decide before sending how much goes with it. In the default “Minimal” mode this is exclusively your message, the star rating, the time it was sent and the name you entered in the app.
In “Full” mode considerably more data is added: aggregated usage statistics (number and type of your entries, hours, balance, streak, date of the first and last entry), your app settings (target hours, break threshold, vacation allowance, theme) and device data (screen size, viewport, platform, language, time zone, user agent). This data is not anonymous, because your name is sent in both modes.
Individual time entries, notes, project names and all contents of the shadow report book are transmitted in neither mode. Nothing is sent until you have given your explicit consent, and beforehand you can display every single field with its actual value. The full list of fields is in section 4 — Sharing of data.
Occasionally MyWorkLog shows a short survey or, on the developer's birthday, a wish field. Whatever you submit there is sent without a name and without an account to a Cloudflare Worker and stored there: for the survey only the answer categories you picked, for the wish the sentence you typed, plus in both cases a random identifier generated in your browser (so that one device counts only once), the language of the page and the year. Do not enter personal data in the wish field. The optional microphone for blowing out the candle is evaluated exclusively locally in your browser; nothing is recorded or transmitted, and the permission ends after 30 seconds at the latest.
By default, your data is stored in your browser's local storage . Optionally, you can enable cloud synchronization:
The shadow report book stores its entries in a separate area encrypted with AES-256-GCM. A randomly generated master key encrypts both entries and evidence; that master key is itself stored encrypted inside the vault, protected by your vault password (PBKDF2). The password does not leave your device — it is neither stored anywhere nor transmitted.
Evidence — photos, PDFs, letters and recordings — is stored in the same vault. It is kept unchanged and encrypted in your browser's database (IndexedDB). We never transmit it; it leaves your device only if you export a backup yourself.
By default this vault stays exclusively on your device. It is not transferred to the cloud even when cloud sync is active for the rest of your data. You can share it explicitly via the vault menu under “Cloud sharing”; doing so requires entering your vault password. While sharing is active, only the encrypted block containing your entries is transferred — the evidence files themselves stay on your device even then. The transferred contents are not readable by us or by the hosting provider. If you turn sharing off, the copy is removed from the cloud with the next upload.
MyWorkLog passes on no data to third parties as a matter of principle, unless you actively use one of the following optional features. There are no:
The following external services are only used if you actively use them:
When the cloud-sync function is activated, your entire app data (time entries, settings, preferences) is stored on servers of Supabase Inc. (USA).
Further information: Supabase Privacy Policy
If you make a payment via the donation function, you will be redirected to PayPal (PayPal (Europe) S.à r.l. et Cie, Luxembourg). MyWorkLog itself transmits no personal data — the processing takes place exclusively between you and PayPal.
Further information: PayPal privacy principles
MyWorkLog loads the following resources from external CDNs:
When loading these resources, the CDN operator may, for technical reasons, process your IP address . This is justified under Art. 6 (1) lit. f GDPR (legitimate interest in providing the app functionality).
When sending feedback or feature requests, data is with your explicit consent via the service EmailJS (EmailJS Inc., USA) transmitted by email to the developer.
Art. 6 (1) lit. a GDPR (consent). You give consent by ticking the checkbox before sending.
In standard mode, only the following data is transmitted:
If you switch the data mode to "Full", additionally the following data is transmitted. These are aggregated figures rather than your individual entries — they are still not anonymous, however, because your name is sent along from Minimal mode:
Not transmitted in either mode: individual time entries with date and time, your notes, project names, custom field contents and all contents of the shadow report book.
The data is used exclusively for Product improvement and Bug fixing. It is not passed on to any further third parties, not used for advertising purposes and deleted after the feedback has been processed.
Directly above the send button you will find the “Which data is sent?” button. It opens a table listing every field with its actual value in the currently selected mode — exactly what the email will contain. Next to it, “View email template” shows how the message arrives at the developer.
You can withdraw your consent at any time by unticking the checkbox. A withdrawal does not affect the lawfulness of processing carried out up to that point.
Under the General Data Protection Regulation (GDPR) you have the following rights:
You can request access to your stored data at any time. In MyWorkLog you can do this directly in the application by:
You can correct and update your data in the application at any time.
You can delete your data as follows:
You can export a backup of your data as a JSON file at any time and import it into another application.
You can restrict processing by disabling optional features (cloud sync, feedback) or by not using the application.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data.
Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data infringes the GDPR.
MyWorkLog sets no cookies itself. The application stores the data necessary for its function exclusively locally in your browser via the Web Storage APIs:
These mechanisms are, for the operation of the application, strictly necessary within the meaning of § 25 (2) No. 2 TDDDG and do not require consent. You can delete this data at any time via the browser settings or in the app itself.
Since this application is delivered via the infrastructure of Cloudflare, Inc. (see section 2 — hosting), Cloudflare may set cookies in your browser as part of its bot and DDoS protection. These cookies are not controlled by MyWorkLog and cannot technically be switched off without deactivating the platform's security functions. Depending on the risk assessment of the request, they do not always occur.
Cloudflare may set the following cookies:
__cf_bm (Cloudflare Bot Management) — Distinguishes human from automated requests, protects against bots and scraping. Duration: approx. 30 minutes from last activity. Provider: Cloudflare, Inc.cf_clearance — Only set when Cloudflare has successfully completed a security check (challenge). Duration: up to 30 days. Provider: Cloudflare, Inc._cfuvid — Complements __cf_bm in identifying legitimate requests. Duration: Session (deleted when the browser is closed).
Provider: Cloudflare, Inc.Legal basis: § 25 (2) No. 2 TDDDG (strictly necessary for the telemedia service expressly requested by the user) in conjunction with Art. 6 (1) lit. f GDPR (legitimate interest in the security and availability of the website). These cookies are classified as technically necessary for security and therefore do not require prior consent in the sense of a cookie banner.
Further information about these cookies and their processing can be found in the Cloudflare privacy policy as well as at Cloudflare Cookies (Developer Docs).
If you actively use optional functions such as cloud sync (Supabase), the feedback function (EmailJS) or donations (PayPal), these services may set their own cookies. The respective processing is described in section 4 and only takes place with your explicit consent.
You can manage or delete cookies and local-storage data at any time in your browser settings. Please note that disabling the Cloudflare security cookies may cause the application to classify you as suspicious traffic and block access.
MyWorkLog may contain links to external websites. We are not responsible for their data protection practices:
Retention period: Your data is stored for as long as you keep it in MyWorkLog.
You can at any time:
MyWorkLog is designed for pupils and students, including minors. Special features:
We may update this privacy policy at any time. Material changes will be:
Last updated: September 2026
For questions about data protection or about exercising your data-subject rights (Art. 15–22 GDPR), you can contact the controller:
We endeavor to answer your request within the statutory period of one month (Art. 12 (3) GDPR). For complex requests, this period may be extended by up to two further months.
This privacy policy is based on:
This application is designed to be privacy-friendly because: