WorkFlow

Last updated: 17 October 2026

WorkFlow ("the app") is a local-first time tracking app with workplace geofencing for Android. Its time tracking is free; "WorkFlow Pro" is an optional one-time purchase that adds further features (see section 2). This Privacy Policy explains what data the app handles, how it is used, your rights, and how to contact us.

1. Who we are

WorkFlow is published by:

• Name: Ivan Knezevic
• Country: Switzerland
• Contact e-mail: i.knezevic@gmx.ch

For the purposes of GDPR and the Swiss Federal Act on Data Protection (FADP/revDSG), Ivan Knezevic acts as data controller for any personal data this Privacy Policy covers.

Independent application notice

WorkFlow Zeiterfassung is an independent application developed by Ivan Knezevic in Switzerland. It is not affiliated with, endorsed by, or sponsored by Apple Inc., ServiceNow Inc., Microsoft Corporation, Workflow HR Systems GmbH, or any other company that uses the term "workflow" in their product names. The word "workflow" is a generic English term descriptive of process management and is used here in that descriptive sense.

2. Data the app handles on your device

WorkFlow is designed local-first. The following data categories are created and stored on your device only:

• Workplace location: the latitude/longitude coordinates and geofence radius you configure as your workplace.
• Location samples: background location reads used to evaluate whether you have entered or left a workplace geofence.
• Time entries and work sessions: check-in/check-out timestamps, durations, breaks, daily aggregates, and any manual corrections.
• Settings and preferences: schedule preferences, theme, language, notification settings, and the name and employer you enter for exports.
• Diagnostics: permission status, background-task status, last fallback check, device manufacturer hint, local error reports.
• Backups and support bundles: files the app generates when you explicitly use the backup or support bundle feature, and - with WorkFlow Pro, once you have set them up - the automatic backups and the month-end timesheets described below.
• Local snapshots: for every user, free or Pro, the app also saves a snapshot of your data by itself when it starts, at most once every 24 hours, and keeps the newest 30 of them in its private storage (older ones are deleted). Each snapshot is a complete, unencrypted copy in the same format as the manual backup. They stay inside the app, where "Lokalen Snapshot wiederherstellen" / "Restore Local Snapshot" in Settings can restore one, and they are removed with the app. They are kept out of Android's cloud backup (section 3), because they are copies of data that backup already carries in the database.
• Home-screen widget data: if you place a WorkFlow widget on your home screen, the app keeps the few values the widget displays in the widget's own storage on your device: whether you are checked in, today's net working time, the start time of the running session, and the widget colour. The WorkFlow Pro month widget additionally holds the running month's per-day status (target reached, worked, special day, nothing recorded), the month's net time, target and balance, and the colour used for special days. The widget is drawn by your home screen app on your device; whatever it shows can be seen by anyone who looks at your home screen.

This data is stored in the app's local database and is not transmitted to us or any third party by default.

With WorkFlow Pro

WorkFlow Pro is a one-time in-app purchase (product workflow_pro), with an optional free 14-day trial. It adds the following data handling, all of which runs on your device unless stated otherwise in section 3:

• Licence state: whether this installation has a confirmed WorkFlow Pro purchase (a yes/no value) and, if you started the trial, the date and time the trial ends. Both are kept in Android's encrypted secure storage on your device. They are not part of WorkFlow backups and not part of Android's own device backup, so a reinstall starts without them; a purchase is then recognised again through Google Play (section 3). There is no WorkFlow account.
• Trial: the 14-day trial starts only when you tap the trial button, once per installation. It is handled entirely on your device: no payment details are requested, nothing is sent to us or to Google, and it does not turn into a purchase or a subscription on its own.
• Holiday import: the public holiday data for Switzerland, Germany and Austria ships inside the app. The holidays for the region you choose are calculated on your device, and nothing is downloaded for this. Your chosen country, region, the holidays you ticked and the dates you excluded are stored on your device and are included in WorkFlow backups. Imported holidays become ordinary special days in your local database.
• Extended timesheets and exports: the additional timesheet header fields (company, personnel number, cost centre), the timesheet layout and the colour scheme are stored on your device and included in WorkFlow backups. A logo you pick is copied into the app's private storage, reduced in size, and is not included in backups.
• Month-end timesheet archive: if you turn on the automatic month-end export, the app creates the previous month's signable timesheet (PDF, and optionally Excel) when you first open it after a month has ended, and keeps it in an archive inside the app's private storage. If you have not opened the app by the 1st of the month, a local notification reminds you; after a file was created, a notification offers to share it. Files leave the archive only when you share them. The archive is excluded from Android's cloud backup of the app.
• Automatic backups: if you set them up, you choose a folder with Android's system folder picker, and the app keeps access to that folder only. From then on, the app writes a backup into that folder by itself, without a separate action from you for each file: at most once per day, when you open the app and your data has changed since the last backup. You can also start one with "Jetzt sichern" / "Back up now". Each backup is a complete, unencrypted copy of your WorkFlow data in the same format as the manual backup: time entries and work sessions, corrections and their history, special days, your workplaces with their coordinates and radius, and the settings and export identity listed above (logo and archived timesheets are not included). The app checks every file it wrote and deletes only its own older automatic backups (it keeps the newest backup of each of the last 7 days, 4 weeks and 12 months that have backups). If you choose a folder that belongs to a cloud storage app (for example Google Drive or Nextcloud), that app may upload the files under its own terms; WorkFlow itself does not upload anything and cannot tell whether an upload happened (see section 3). A background check runs once a day; it only reads the backup status on your device and, if there has been no confirmed backup for 5 days, shows a notification asking you to open the app.

When a trial ends or a purchase is withdrawn, nothing is deleted: imported holidays, generated files and backups stay where they are, and your recorded data stays fully accessible.

3. Data the app may send off your device

WorkFlow does not transmit your location data, work time entries, or any personal identifiers to our servers. There are no analytics SDKs and no advertising SDKs active in this release of the app.

The following limited categories of data may leave your device:

• Address search (OpenStreetMap Nominatim): when you manually search for a workplace address during setup, the search text you type is sent to OpenStreetMap's public Nominatim service at nominatim.openstreetmap.org. The request includes a User-Agent header identifying the app and a developer contact e-mail (required by the Nominatim usage policy), and an Accept-Language header reflecting your device language. OpenStreetMap may log the request under its own privacy terms (https://wiki.osmfoundation.org/wiki/Privacy_Policy). Address search runs only when you actively type a query during workplace setup; it is not used in the background.
• Workplace map (OpenStreetMap tiles): the map you use to place, check, or edit a workplace loads its map images from OpenStreetMap's public tile servers at tile.openstreetmap.org. Those requests tell the servers which map area is on screen (as tile coordinates) and your device's IP address - and while you are placing a workplace, that area is of course the area around it. The requests carry no exact workplace coordinates, no geofence radius, and no time data: the pin and the radius circle are drawn on your device, on top of the tiles. Tiles are requested only while a workplace map is open in the app, never in the background. The OpenStreetMap Foundation may log the request under its own privacy terms (https://wiki.osmfoundation.org/wiki/Privacy_Policy).
• Purchase and restore of WorkFlow Pro (Google Play Billing): the purchase is processed by Google Play. Google handles your Google account, your payment method and the transaction under its own terms (https://policies.google.com/privacy); WorkFlow never sees your payment details. To show the price, start a purchase and check whether this installation owns WorkFlow Pro, the app talks to Google Play through Android's billing service: it asks for the localized price of workflow_pro, and after every app start and each time you return to the app it asks Google Play which purchases your Google account holds for WorkFlow. The answer (the product, its purchase state and a purchase token) is used on your device only to unlock Pro and to confirm the purchase to Google Play; the app stores nothing of it except the yes/no licence value described in section 2. No time entries, locations, workplaces or other app data are sent with these requests, and the app attaches no identifier of its own. Google Play makes order records of purchases (for example an order number, the product, the price and the country) available to us as the developer in the Google Play Console; we use them only for accounting, tax obligations and handling refunds.
• Automatic backups into a cloud folder (WorkFlow Pro): if the folder you chose for automatic backups belongs to a cloud storage app, that app may transfer the backup files - which contain all your WorkFlow data, including workplace coordinates - to its servers under its own terms. This happens only if you choose such a folder; WorkFlow writes the files into the folder and does not contact the cloud service itself.
• Android's own device backup: if backup is turned on for your device (Google backup / Google One, or a transfer to a new phone), Android can include WorkFlow's local data: the database with your time entries, sessions, special days and workplaces, and the app's other local files such as its settings and the diagnostics log. Excluded are the values the app keeps in Android's encrypted secure storage (among them the WorkFlow Pro licence state and your work schedule), and, from the cloud backup, the local snapshots (section 2), the timesheet archive and the timesheet logo (on Android 12 and later these three still move with a direct transfer to a new phone). This backup is made and stored by Android and Google, not by WorkFlow, and we have no access to it. You control it in your device's Android settings.
• User-initiated exports and shares: when you explicitly choose to export a report (PDF/CSV/Excel), share a backup, share a timesheet from the archive, or share a support bundle, the destination app or service you choose handles that file under its own terms.
• App rating prompt (Google Play in-app review): once you have used the app for a while, WorkFlow asks Google Play on its own, without any action by you, whether a rating dialog can be shown, and requests that dialog if so. No app data is transmitted with this: no locations, no time entries, and no identifiers. Whether the dialog actually appears is decided by Google Play alone; the app is told neither that nor whether you left a rating. The conditions that lead up to the request are counted locally on your device only, and the automatic prompt is asked for at most once per installation. The "Rate this app" entry in Settings simply opens the WorkFlow page in the Play Store and is likewise free of app data.

This release of WorkFlow does not transmit crash reports, telemetry, or product analytics. Firebase Crashlytics code is present in the codebase but remains inactive in this build because no Firebase configuration is bundled. If a future build enables Crashlytics, this Privacy Policy will be updated before that build is published.

4. Permissions and why we ask for them

• Location (foreground and background): WorkFlow collects location data to enable automatic check-in and check-out, even when the app is closed or not in use. Location is used only to compare your device with the workplace geofence you configured. Without location permission, the app cannot perform automatic tracking.
• Notifications: used to confirm check-in and check-out events, to surface tracking-status issues, and to deliver the optional weekly recap. The recap is generated on your device from the time entries already stored there; it sends no data anywhere and can be turned off in Settings. With WorkFlow Pro, notifications also remind you of and offer to share the month-end timesheet, and ask you to open the app when automatic backups have not been confirmed for 5 days.
• Google Play billing (com.android.vending.BILLING): lets the app offer the WorkFlow Pro purchase and check an existing purchase through Google Play (see section 3).
• Battery-optimization exemption (optional): improves background reliability on Android devices that aggressively kill background tasks.
• Storage / Share intents: used only when you export or share files initiated by you. For automatic backups, the app asks for no storage permission: it receives access only to the one folder you pick in Android's folder picker, and you can revoke it by choosing another folder or by removing the app.

5. Legal basis for processing (GDPR / FADP)

Processing your location and time data on your device is necessary to provide the core functionality you requested (Art. 6(1)(b) GDPR / Art. 31(2)(a) revDSG: contractual necessity).

When you open a workplace map, the map area you are viewing is sent to OpenStreetMap's tile servers; when you trigger an address search, the search query and language header are sent to OpenStreetMap's Nominatim service. Both happen on the basis of your direct request to display that map or to perform that search (Art. 6(1)(b) GDPR).

When you buy WorkFlow Pro, the purchase and the ownership checks through Google Play are necessary to perform the purchase contract (Art. 6(1)(b) GDPR). We keep the order records Google Play provides because we are legally obliged to keep accounting and tax records (Art. 6(1)(c) GDPR).

6. Data retention

• Data stored on your device remains until you delete it within the app, clear app storage in Android Settings, or uninstall the app.
• Automatic backups (WorkFlow Pro) are written into a folder you chose outside the app's storage. They are not removed when you uninstall the app or end Pro; the app only ever deletes its own older automatic backups while they are switched on. You can delete them in that folder at any time. If the folder belongs to a cloud storage app, that app's retention applies to its copies.
• Timesheets you shared from the archive and other exported files are outside WorkFlow once shared.
• Address search queries are sent to OpenStreetMap each time you search, and map tiles are requested each time you open a workplace map; the app does not keep a search or map history. OpenStreetMap's retention policy applies to any logs the OpenStreetMap Foundation may keep.
• Google Play keeps your purchase history under Google's terms. We keep the order records Google Play provides to us for as long as accounting and tax law requires.

7. Your rights

Under GDPR and the Swiss FADP, you have the right to:

• request access, rectification, or deletion of any personal data we process,
• restrict or object to processing,
• data portability,
• lodge a complaint with the supervisory authority responsible for your location:
  • Switzerland: Federal Data Protection and Information Commissioner (FDPIC), https://www.edoeb.admin.ch
  • EU: your local data protection authority.

Because WorkFlow does not require user accounts, does not collect identifiers, and stores all time and location data locally on your device, we typically do not hold any personal data linked to you that we could access, correct, or erase. The exceptions are the order records Google Play provides if you bought WorkFlow Pro, and any messages you send to the support e-mail. If you believe we hold personal data about you, please contact us at the e-mail above.

8. Account deletion and data deletion

WorkFlow does not require an account. Buying WorkFlow Pro does not create one either; the purchase belongs to your Google account.

• Delete data on your device: use the in-app reset / clear-data option in Settings, or uninstall the app via Android Settings > Apps. Uninstalling removes the local database, the local snapshots, the licence state, the timesheet archive and the home-screen widget data.
• Automatic backups: delete them in the folder you chose; uninstalling the app does not remove them.
• Purchases: your purchase history is kept by Google Play; refunds and purchase records are managed in your Google account and Google Play.
• Address search and map logs: the app does not store an address search history or a record of the map areas you viewed. Logs that OpenStreetMap may keep on its servers are governed by OpenStreetMap's privacy policy.

9. Children's privacy

WorkFlow is not directed to children under the age of 13 (or 16 in jurisdictions where that is the applicable threshold). The app does not knowingly collect personal data from children.

10. International data transfers

Address search queries and workplace map tile requests sent to OpenStreetMap are processed by the OpenStreetMap Foundation's infrastructure, which may be located outside Switzerland or the EU/EEA. See https://wiki.osmfoundation.org/wiki/Privacy_Policy for details. Purchases through Google Play are processed by Google, which may process data outside Switzerland or the EU/EEA under its own privacy policy. A cloud storage app you choose for automatic backups may do the same under its own terms.

11. Third-party services

• Google Play Services: required on Android to provide the Google Geofencing API. Geofence event detection runs on-device; entry/exit events are delivered locally by the operating system. Google Play is also used for the store rating flow: the one-shot in-app review prompt the app requests by itself, and the manual "Rate this app" entry in Settings, which opens the store listing. Neither transmits app data (see section 3).
• Google Play Billing: processes the WorkFlow Pro purchase and answers the app's ownership checks (see section 3). It receives no app data from WorkFlow.
• OpenStreetMap: used in two places, both only while you are working on a workplace in the app: the Nominatim geocoding service for manual address lookup, and the public tile servers that supply the map images shown on the workplace map (see section 3). Map data and tiles are © OpenStreetMap contributors, licensed under the ODbL, which is why the map credits them on screen.
• Cloud storage apps you choose (optional, WorkFlow Pro): if you choose a folder of a cloud storage app for automatic backups, that app processes the backup files under its own terms. WorkFlow has no connection to such a service.

These providers process data under their own privacy policies. WorkFlow does not enable any analytics, advertising, or crash-reporting SDK in this release.

12. Security

The app uses Android's encrypted secure storage for sensitive configuration values, including the WorkFlow Pro licence state. We rely on the security mechanisms provided by the Android operating system for data at rest on your device. Backup files, including automatic backups, are not encrypted by the app: store them in a folder you trust.

13. Changes to this policy

We may update this Privacy Policy. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced in the app release notes.

14. Contact