1. Summary
HT Vahetus (the "Platform") does not use cookies. It does not use analytics, advertising or tracking technologies, and it does not embed social media plug-ins. To work, the Platform stores a small amount of strictly necessary information on your device, as described below. This policy is provided by Humanos Tech OÜ, Meistri tn 6, 13517 Tallinn, Estonia, privacy@humanostech.com.
2. The rules that apply
Storing information on your device, or reading it, is allowed without your consent only when it is strictly necessary to provide a service you have asked for (Article 5(3) of Directive 2002/58/EC, the ePrivacy Directive, as applied in Estonia, including through the Electronic Communications Act, elektroonilise side seadus). Everything listed in section 3 is strictly necessary to sign you in, keep your account and the integrity of your time records secure, keep the time records you make without an internet connection until they can be sent, and remember settings you choose. Items in section 4 are created only when you ask for them, through your browser's own permission prompt.
3. What the Platform stores on your device
In the web version, these items are kept in your browser's local storage in encrypted form. In the mobile app, they are kept in the secure storage of your device.
- Access token: keeps you signed in. Valid for a short time and replaced automatically. Deleted when you sign out.
- Refresh token: renews your session without asking for your password again. Valid for up to 30 days and replaced each time it is used. Deleted when you sign out.
- User identifier, role and selected workspace: show you the correct screens and workspace. Deleted when you sign out.
- Device identifier: a random code created by the Platform on your device after you sign in and sent with your requests to our server, which uses it only when you clock in. It protects the integrity of time records: your Account Manager is informed when you clock in from a new device, or when the same device is used by more than one person. It never blocks your time recording. Our server keeps only a one-way hash of the code. Kept on your device, also after you sign out, until you clear the site data or uninstall the app.
- Theme preference (light or dark): remembers your choice. Kept until you clear the site data or uninstall the app.
- Encryption key: a technical key used by the web version to encrypt the items above in your browser. Kept until you clear the site data.
- Records made without an internet connection (mobile app only): if you clock in, start or end a break or clock out while your device has no connection, the app keeps each event (its type, the time of your device, the project and, if you have allowed location, the position) together with the last open shift confirmed by our server, separately for each account used on the device. This lets the app show your current state and send the events in order when the connection returns. Each event is deleted from the device as soon as our server accepts or rejects it, and the open shift is deleted when it ends. Events not yet sent stay on the device, also after you sign out, until you sign in again with a connection, clear the app's data or uninstall the app. The web version does not keep these records: it needs a connection to clock in or out.
Your preferred language and notification settings are saved in your account on our servers, not on your device. The app sends the language of its interface with each request so that our server can answer in that language; it is not stored.
Your browser also keeps copies of the Platform's own program files (for example in its cache or through a service worker), so that the app loads correctly and quickly. These files do not contain personal data.
4. Items created only at your request
- Push notifications: if you turn them on, your browser asks for your permission, registers a small background script (service worker) that only displays notifications, and creates a push subscription. The subscription is also stored on our server so that we can send you notifications. You can turn notifications off in the Platform settings or in your browser at any time.
- Location: if you allow location, your browser or device remembers that permission. Location itself is used only as described in the Privacy Policy.
- Passkeys: if you create a passkey, it is stored by your device or password manager, not by us. We keep only its public key.
5. Content from third parties
The Platform does not load content from third parties. Its program files and fonts, including the fallback fonts for characters that our main fonts do not contain, are served from our own domain, so opening the Platform does not send any request to other providers. If you turn on push notifications, they pass through the push service of your browser, as described in section 4 and in the Privacy Policy.
6. How to remove this information
Signing out deletes your session data from the device. You can delete everything else by clearing the site data for clock.htvahetus.eu in your browser settings, or by uninstalling the app. If you do this, you will need to sign in again.
7. Changes and questions
If we ever want to use storage that is not strictly necessary, we will update this policy and ask for your consent first. For questions, write to privacy@humanostech.com.