Privacy Policy

Oopahroot Technology Limited (“we”, “us”, or “our”) operates the Kronk time-tracking and project management web application. We are the data controller responsible for your personal data processed through this service.

For privacy-related enquiries or to exercise your data rights, contact us at: teamgull@oopahroot.co.uk

We collect and process the following personal data:

• Account information: your email address, used solely for authentication via one-time password (OTP).
• Timesheet entries: date, hours logged, project assignment, description (optional), and billable status — entered by you when using the app.
• Project data: project names and colours you create within Kronk.
• Account role: whether your account is a standard user or administrator, assigned by the account administrator.
• Consent record: the timestamp at which you accepted this Privacy Policy and our Terms of Use.

We do not collect payment information, location data, or any special category personal data. We do not use analytics, advertising trackers, or third-party behavioural tracking tools.

Kronk uses strictly necessary session cookies only. These are set by our authentication provider (Supabase) to maintain your login session and are required for the application to function. No consent is required for strictly necessary cookies under UK PECR.

We do not use advertising, analytics, or preference cookies. No third-party cookies are set on this site.

We process your personal data on the basis of contract performance (Article 6(1)(b) UK GDPR): the processing is necessary to provide you with the Kronk timesheet service you use. Without your email address we cannot authenticate you; without timesheet data there is no service to provide.

Your consent record (acceptance of this policy and the Terms of Use) is processed under legitimate interests (Article 6(1)(f) UK GDPR): maintaining a record that you have been informed of and agreed to our terms.

We use the following third-party data processors:

• Supabase Inc. — database storage and authentication. Your data is stored in Supabase-managed PostgreSQL instances. Supabase processes data under a Data Processing Agreement compliant with UK GDPR. Data may be transferred to and stored in the United States; Supabase relies on Standard Contractual Clauses for such transfers.
• Cloudflare Inc. — edge hosting and request routing. Cloudflare processes request metadata (such as IP addresses) globally as part of its network infrastructure. Cloudflare operates under a DPA aligned with UK GDPR. No Kronk application data is stored by Cloudflare.

We retain your personal data for as long as your account is active.

Using the self-service “Delete my account” option in your profile page permanently and immediately deletes all of your application data: timesheet entries, projects, and account settings.

The email address used to authenticate you is held separately in our authentication system. It is not removed by the self-service deletion and must be deleted by an administrator. To request this, email teamgull@oopahroot.co.uk after deleting your account; we will action it within 30 days.

As a UK data subject you have the following rights:

• Right of access (Article 15): you can export a copy of your timesheet data at any time from your profile page. For a complete data export including account metadata, contact us.
• Right to rectification (Article 16): most data (timesheet entries, project names) can be corrected directly within the app.
• Right to erasure (Article 17): you can permanently delete all your application data (timesheet entries, projects, account settings) immediately from your profile page. To also remove your email address from our authentication system, contact us after deleting your account (see Section 6).
• Right to restriction of processing (Article 18): contact us to request that we limit how we use your data.
• Right to data portability (Article 20): export your timesheet data as CSV from your profile page at any time.
• Right to object (Article 21): object to processing based on legitimate interests by contacting us.

For rights not addressable in-app, email teamgull@oopahroot.co.uk. We will respond within one calendar month.

If you have concerns about how we handle your personal data and are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

ICO helpline: 0303 123 1113
Website: ico.org.uk

We may update this Privacy Policy from time to time. When we make material changes we will increment the policy version number and you will be asked to review and re-accept the updated policy the next time you sign in. The “last updated” date at the top of this page reflects the most recent revision.