Privacy policy for the app “Zeit Erfassen”
This English version is for information only. Only the German version is legally binding.
As of 2 November 2026.
The key points in one paragraph: “Zeit Erfassen” is a pure client app for working time recording. It connects exclusively to the Kimai server whose address you enter yourself when logging in. There is no server of the app provider, no user account with the app provider and no transmission of data to third parties. The app provider never receives any data from your use. Advertising, tracking and analytics services are not included.
The following information applies exclusively to our Android app Zeit Erfassen and supplements our general privacy policy for this website.
1. Controller for the app
The controller for the provision of the app within the meaning of the General Data Protection Regulation (GDPR) is:
Geier-IT – Anton Geier, Untere Bergstraße 2, 55487 Sohren, Deutschland. Email: info@geier-it.eu. Telephone: +49 152 04202892.
Further information can be found in the Impressum (legal notice).
We are not responsible for the working time data processed on the Kimai server you have chosen; the operator of that server is – as a rule, your employer.
2. How the app works
“Zeit Erfassen” is used for mobile working time recording and is a standalone client for servers with a Kimai API (self-hosted open-source time recording).
- When you first start the app, you enter the address of the Kimai server, together with your user name and your personal API token.
- After that, the app communicates exclusively with that one server. There is no fixed address and no connection to our systems.
- A user account on the relevant server is a prerequisite. Without access, the app cannot be put to productive use.
3. Data stored on your device
| Data | Where | How long |
|---|---|---|
| Server address | encrypted system storage | until uninstallation; when you log out, it is kept for logging in again and can be changed there |
| User name | encrypted system storage | until logout or uninstallation |
| API token | encrypted system storage | until logout or uninstallation |
| Logged-in account: display name, user name, user ID and email address | encrypted system storage | until logout or uninstallation |
| Kimai account password (only when using “My hours” → Overtime) | encrypted system storage | until “Forgot password” is tapped, until logout or until uninstallation |
Regarding the account password: The API token is sufficient for normal use. Only if you additionally use “My hours” → “Load overtime” does the app ask once for your normal Kimai account password, because Kimai's programming interface does not supply the target/actual working time – this information exists only on one page of the Kimai web interface, which requires a normal login instead of an API token. For this purpose, the app logs in like a web browser. If you do not use this function, your account password at no point leaves the login form of the device.
This data is stored in the operating system's encrypted storage (on Android, in the EncryptedSharedPreferences via the Android Keystore) so that you do not have to log in again each time you start the app. When you log out, the user name, API token, any stored account password and the account details are removed from the device completely.
The details of the logged-in account are additionally kept locally so that the app starts and stays logged in even without a network connection – for example on a building site or in a basement. You are logged out only if the server expressly rejects your token.
4. Data transfer to the server you have chosen
All application data is exchanged exclusively between your device and the server you have entered, always over a TLS-encrypted HTTPS connection. The app does not permit unencrypted connections (http://).
What is transferred is your API token for authentication and your time entries (start, end, break time, assigned project and activity, description, tags). From the server, the app receives the list of customers, projects and activities of your organisation and – if your account belongs to a Kimai team – the names and time entries of the other team members, so that a foreman or forewoman can keep an overview of the team or, as the case may be, create and correct entries for team members, provided that the server authorises this. As is technically necessary, every request also transmits your device's IP address to the server. How long the server logs this is determined by its operator.
5. What the app does not do
- No advertising. No advertising networks are integrated.
- No tracking, no analytics. No analytics, crash reporting or statistics services are integrated.
- No disclosure to third parties. Data goes exclusively to the server that you yourself have entered.
- No transmission to the app provider. Geier-IT does not operate a server for this app and receives no usage data whatsoever.
- No camera access, no location, no contacts, no microphone.
Overview of requested permissions
| Permission | Used for |
|---|---|
| INTERNET | Connection to the Kimai server you have entered |
The app requests no further permissions.
6. Responsibility for the working time data
The actual working time data is located on the server that you enter in the app. The controller within the meaning of the GDPR for this data is the operator of that server – in business use, therefore, your employer, not us. Requests for access and erasure concerning working time data are also to be addressed to that operator.
Note for companies using the app
This app is a time recording system within the meaning of works constitution law. The introduction and use of technical devices for recording working time are subject to mandatory co-determination by the works council under § 87(1) no. 6 BetrVG. Where a works council exists, a corresponding works agreement is required before use.
7. Legal bases and storage period
Insofar as we process data – this concerns exclusively the local storage on your device – this is based on Art. 6(1)(b) GDPR (provision of the function you have requested) and Art. 6(1)(f) GDPR (legitimate interest in a functional and secure application). For processing on the Kimai server, § 26(1) BDSG additionally applies as a rule, since the app is used in the employment relationship; the server operator is responsible for this.
On the device, the periods stated above apply; on the server, the requirements of the respective operator and the statutory retention periods for working time records apply.
8. Deleting data
- On the device: In the app under Settings → Log out, the user name and API token are removed. When the app is uninstalled, all local data, including the server address, is deleted.
- On the server: informal request to the operator of the server. Deletion takes place unless statutory retention obligations for working time records stand in the way.
- We hold no data that could be deleted.
Your rights under Arts. 15 to 21 GDPR and the right to lodge a complaint under Art. 77 GDPR apply unchanged, as described in our general privacy policy.
9. Note on trademarks
“Zeit Erfassen” is an independently developed client for servers with a Kimai API. The app has no connection to the Kimai project and is neither operated nor supported by it. Product names mentioned are trademarks of their respective owners.