Please note: this page is a translation provided for your convenience. Only the German version is legally binding. You will find it at geier-it.eu/datenschutz-zeit-erfassen.html.
The essentials in one paragraph: „Zeit Erfassen“ is purely a client app for recording working time. It connects exclusively to the Kimai server whose address you enter yourself when logging in. There is no server operated by the app provider, no user account with the app provider and no transfer of data to third parties. The provider of the app receives no data from your use at any time. Advertising, tracking and analytics services are not included.
The following information applies exclusively to our Android app Zeit Erfassen and supplements our general privacy policy for this website.
1. Controller for the app
Responsible for providing the app within the meaning of the General Data Protection Regulation (GDPR):
Anton Geier – Geier-IT
Untere Bergstraße 2, 55487 Sohren, Germany
E-mail: info@geier-it.eu · Phone: +49 (0) 152 042 02 892
Further information can be found in the legal notice.
We are not responsible for the working-time data processed on the Kimai server you choose; the operator of that server is – as a rule, your employer.
2. How the app works
„Zeit Erfassen“ is used for mobile recording of working time and is an independent client for servers with a Kimai API (self-hosted open-source time recording).
- On first start you enter the address of the Kimai server together with your user name and your personal API token.
- After that the app communicates exclusively with this one server. There is no fixed address and no connection to our systems.
- A user account on the respective server is required. Without access, the app cannot be used productively.
3. Data stored on your device
| Data | Where | How long |
|---|---|---|
| Server address | encrypted system storage | until uninstallation; when you log out it is kept for the next login and can be changed there |
| User name | encrypted system storage | until logout or uninstallation |
| API token | encrypted system storage | until logout or uninstallation |
| Logged-in account: display name, user name, user ID and e-mail address | encrypted system storage | until logout or uninstallation |
| Kimai account password (only when using „My hours“ → overtime) | encrypted system storage | until „Forgot password“ is tapped, until logout or until uninstallation |
About the account password: the API token is sufficient for normal use. Only if you additionally use „My hours“ → „Load overtime“ does the app ask once for your normal Kimai account password, because Kimai's programming interface does not supply target/actual working time – this information only exists on a page of the Kimai web interface that requires a normal login instead of an API token. For this the app logs in like a web browser. If you do not use this function, your account password never leaves the device's login form.
This data is stored in the encrypted storage of the operating system (on Android in the EncryptedSharedPreferences via the Android Keystore) so that you do not have to log in again every time you start the app. On logout, the user name, API token, any stored account password and the account details are completely removed from the device.
The details of the logged-in account are also kept locally so that the app starts and stays logged in even without a network connection – for example on the building site or in a cellar. You are logged out only if the server explicitly rejects your token.
4. Data transfer to the server you choose
All business data is exchanged exclusively between your device and the server you entered,
always over a TLS-encrypted HTTPS connection. The app does not permit unencrypted connections
(http://).
What is transferred is your API token for authentication as well as your time entries (start, end, break time, assigned project and activity, description, tags). From the server the app receives the list of customers, projects and activities of your organisation as well as – if your account belongs to a Kimai team – the names and time entries of the other team members, so that a foreman keeps an overview of the team and can create and correct entries for team members, provided the server authorises this. For technical reasons every request also transmits the IP address of your device to the server. How long the server logs this is determined by its operator.
5. What the app does not do
- No advertising. No advertising networks are integrated.
- No tracking, no analytics. No analytics, crash-reporting or statistics services are integrated.
- No disclosure to third parties. Data goes exclusively to the server that you entered yourself.
- No transmission to the app provider. Geier-IT does not operate a server for this app and receives no usage data whatsoever.
- No camera access, no location, no contacts, no microphone.
Requested permissions at a glance
| Permission | What for |
|---|---|
INTERNET | Connection to the Kimai server entered |
The app does not request any further permissions.
6. Responsibility for the working-time data
The actual working-time data is stored on the server you enter in the app. The controller within the meaning of the GDPR for that data is the operator of this server – in a business context therefore your employer, not us. Requests for information and deletion regarding working-time data should also be addressed to them.
Note for companies deploying the app
This app is a time-recording system within the meaning of German works council law. The introduction and use of technical equipment for recording working time is subject to mandatory co-determination by the works council pursuant to § 87 (1) no. 6 BetrVG. Where a works council exists, a corresponding works agreement is required before use.
7. Legal bases and storage period
Insofar as we process data – which concerns exclusively the local storage on your device – this is based on Art. 6 (1) (b) GDPR (provision of the function you requested) and Art. 6 (1) (f) GDPR (legitimate interest in a functional and secure application). For the processing on the Kimai server, § 26 (1) BDSG regularly applies in addition, since the app is used within an employment relationship; the server operator is responsible for this.
On the device the periods stated above apply; on the server the requirements of the respective operator and the statutory retention periods for working-time records apply.
8. Deleting data
- On the device: in the app under Settings → Log out, the user name and API token are removed. When the app is uninstalled, all local data including the server address is deleted.
- On the server: an informal request to the operator of the server. Deletion takes place unless statutory retention obligations for working-time records prevent it.
- With us there is no data that could be deleted.
Your rights under Art. 15 to 21 GDPR and the right to lodge a complaint under Art. 77 GDPR apply unchanged as described in our general privacy policy.
9. Note on trademarks
„Zeit Erfassen“ is an independently developed client for servers with a Kimai API. The app has no connection to the Kimai project and is neither operated nor supported by it. The product names mentioned are trademarks of their respective owners.
Geier-IT · Last updated: 20 August 2026