Privacy Policy

Effective Date: 11th October 2026

1. Introduction

WorkedToday is operated by Konstantinos Theodosiou, an individual based in Greece ("we", "our", or "us"), who is the controller of the personal data described in this policy. We respect your privacy and are committed to protecting the personal data you share with us. This Privacy Policy explains how we collect, use, and protect your information when you use the WorkedToday mobile applications and website.

2. Information We Collect

We collect the following types of information to provide and improve our services:

Account Information

  • Name (required)
  • Email address (required for login and identification)
  • User ID (automatically assigned by Firebase)
  • Your language and your privacy choices (analytics and crash reporting)
  • Legal Basis: Performance of our contract with you, so that you can use the app (GDPR Article 6(1)(b))

Analytics Data (Requires Explicit Consent)

  • App activity (e.g., screens viewed, session duration)
  • Device or other IDs (e.g., the Firebase installation ID). We do not use the advertising identifier.
  • Approximate location (such as country and city) that Google Analytics derives from your IP address; the IP address itself is not stored
  • Default State: Disabled (opt-in required)
  • Legal Basis: Consent (GDPR Article 6(1)(a))
  • You can enable or disable analytics at any time in Account > Privacy & Security > Share Analytics

Crash Reporting & Diagnostics (Legitimate Interest)

  • Crash logs and error reports (e.g., stack traces, error messages). The error reports the app records have names, email addresses and IDs removed.
  • Device information (e.g., device model, OS version, memory state)
  • A device identifier (the Crashlytics installation ID) and a shortened form of your user ID, so we can see how many people a problem affects
  • App state at time of crash (e.g., active screen, user actions leading to crash)
  • Default State: Enabled (opt-out available)
  • Legal Basis: Legitimate Interest (GDPR Article 6(1)(f))
  • Justification: Network and information security is recognized under GDPR Recital 49 as a legitimate interest
  • You can disable crash reporting at any time in Account > Privacy & Security > Crash Reporting

App Integrity Checks (Legitimate Interest)

  • Firebase App Check confirms that requests to our servers come from the genuine WorkedToday app on a real device: on iPhone it uses Apple's App Attest, and on Android Google's Play Integrity
  • This uses a key or token that your device creates for the app; it does not include your name, email address or work records
  • Legal Basis: Legitimate Interest (GDPR Article 6(1)(f)) in keeping the service and your data secure and preventing abuse

Work Records and Content You Enter

  • Jobs and shifts: dates and times, time zone, status, and the client they are for
  • Earnings: rates, amounts, tips, totals and payment status
  • Clients: name, and address and description if you add them
  • Notes you write on jobs
  • Feedback you send from the app: your message, with your email address and user ID so we can reply, and the app and system versions
  • Legal Basis: Performance of our contract with you (GDPR Article 6(1)(b)). For feedback: our legitimate interest in answering you and improving the app (GDPR Article 6(1)(f))

Website Visits (Legitimate Interest)

  • This applies to the workedtoday.com website only, not the mobile app.
  • We do not use analytics or tracking tools on the website, and we do not keep a record of your visits.
  • Our hosting provider, Cloudflare, processes your IP address to deliver the website's pages and to protect it from attacks and abuse.
  • Legal Basis: Legitimate Interest (GDPR Article 6(1)(f)) in delivering the website securely

3. How We Use Your Data

We use your data to:

  • Provide core app functionality (e.g., logging jobs/shifts, tracking hours and earnings)
  • Authenticate and manage your account (login, password recovery, profile display)
  • Improve app stability and fix errors (via Firebase Crashlytics - enabled by default under legitimate interest)
  • Analyze app usage and improve features (via Firebase Analytics - only with your explicit consent)
  • Ensure app security and prevent abuse or fraud
  • Comply with legal obligations
  • Reply to feedback you send from the app, and improve the app with it

We do not sell or rent your personal data to third parties.

Crash Reporting: Why It's Essential

Crash reporting is enabled by default based on our legitimate interest in maintaining a stable, secure application. This is essential for:

  • Service Quality: Identifying and fixing critical bugs that prevent the app from functioning
  • Security: Detecting and resolving security vulnerabilities before they can be exploited
  • User Experience: Ensuring the app works reliably across different devices and OS versions
  • Data Protection: the error reports the app records have names, email addresses and IDs removed, and crash reports are linked only to a shortened form of your user ID

Your Right to Object: You can disable crash reporting at any time in Account > Privacy & Security > Crash Reporting. However, this may limit our ability to diagnose and fix issues you experience.

4. Data Storage and Security

Data is stored securely in Google Firebase (Cloud Firestore, in the European Union). All data transmitted between your device and our servers is encrypted in transit using HTTPS/TLS. We regularly monitor our systems to prevent unauthorized access or misuse.

Data Retention

  • Account Data: Retained for the lifetime of your account or until you request deletion
  • Analytics Data: Event-level data is kept for 2 months, then automatically deleted by Google Analytics. Aggregated reports that do not identify you may be kept longer
  • Crash Reports: Retained for 90 days, then automatically deleted by Firebase Crashlytics
  • Deleted Accounts: your profile, jobs, the clients you own and their links are permanently deleted. We keep a deletion record (your user ID, a one-way hash of your email address and timestamps) for as long as we need it to show that we honoured your request, as GDPR's accountability principle requires.

5. Sharing of Data

We share data only with the following service providers, who process it on our behalf, and with authorities where the law requires it:

  • Google (Firebase): sign-in (Authentication), data storage (Cloud Firestore, in the European Union), server functions (Cloud Functions), app integrity checks (App Check and, on Android, Play Integrity), crash reporting (Crashlytics) and, only with your consent, analytics (Google Analytics). Google is certified under the EU-U.S. Data Privacy Framework.
  • Apple: on iPhone, App Attest receives your device's integrity check for App Check. It does not receive your name, email address or work records.
  • Cloudflare: hosts this website and forwards emails sent to support@workedtoday.com to our email provider.
  • Authorities or Regulators: only if required by law or a court order.

We do not share data with advertisers or unrelated third parties.

6. Your Rights and Choices (EU, EEA and UK)

Under GDPR and applicable data protection laws, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Update or correct your account details directly in the app
  • Deletion: Delete your account directly in the app (Account > Delete Account). Your personal information and work records are permanently removed. You can also request deletion by emailing support@workedtoday.com.
  • Data Portability: Receive your data in a structured, machine-readable format
  • Withdraw Consent: Disable analytics at any time (Account > Privacy & Security > Share Analytics)
  • Object to Processing: Disable crash reporting at any time (Account > Privacy & Security > Crash Reporting), exercising your right to object to processing based on legitimate interest
  • Lodge a Complaint: with the data protection authority of the country where you live, or with our lead authority, the Hellenic Data Protection Authority (www.dpa.gr)

To exercise any of these rights, contact us at support@workedtoday.com or use the in-app settings for analytics and crash reporting controls.

WorkedToday is currently offered only in Greece. Before we offer it in other countries, we will add to this policy any information that their laws require.

7. Account & Data Deletion

How to delete your account

  • Open the app → Account → Delete Account
  • Enter your password to confirm
  • Your account and data are deleted immediately

What is deleted

  • Your name, email address and profile
  • All your jobs and shifts
  • The clients you created and your links to clients
  • Your login (your Firebase Authentication account)

What is retained

  • A deletion record: your user ID, a one-way hash of your email address and timestamps, kept for as long as we need it to show that we honoured your request
  • Feedback you sent, without your email address or user ID. To have it deleted too, email support@workedtoday.com

Alternative deletion method

  • Email support@workedtoday.com with your account email
  • We will process the request within 30 days

Timeline: Deletion is processed immediately upon confirmation. The deletion record is kept as described above.

8. Children's Privacy

WorkedToday is not intended for children under 16 years old. We do not knowingly collect personal data from children under 16. If you believe your child has provided data, please contact us immediately for deletion.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted here with a revised effective date. Continued use of the app after updates means you accept the revised policy.

10. Contact Us

If you have any questions or concerns about this Privacy Policy or your personal data, please contact Konstantinos Theodosiou, who operates WorkedToday:

Email: support@workedtoday.com

Website: https://workedtoday.com

Also see our Terms of Service.