Privacy Policy

Tical is built so that there is very little about you to hold. The app keeps your time entries on your own disk and never sends them anywhere. This site and the licence server behind it hold your email address and a fingerprint of the machine your licence is bound to — and that is close to the whole story.

Last updated 7 August 2026. Effective from the same date.

1. Who is responsible

The controller of the personal data described here, within the meaning of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), is:

• Dawid Woźnica, trading as Tical Software
• Email: contact@tical.io

We are a one-person operation and have not appointed a Data Protection Officer, which the GDPR does not require of us. Write to the address above and you reach the person who wrote the software.

2. The short version

There is no analytics, no advertising, no tracking pixel, no session recording and no newsletter. We do not profile you and we make no automated decisions about you. We have never sold personal data and will not.

3. The desktop app sends nothing

This is the part most people care about, so it comes first. The Tical application that runs on your computer:

• stores everything — projects, entries, tags, settings — in a single SQLite file on your own disk;
• contains no telemetry, no usage analytics and no crash reporting;
• verifies your licence key offline, against a signature it checks locally. It does not contact this server to confirm that you are allowed to run it, and it will keep working if this server disappears entirely;
• reads window titles and idle time locally in order to draft your day. That information is processed on your machine and is never transmitted to us.

If you turn on cloud sync, Tical writes an encrypted copy of your database to your own Google Drive, using credentials you grant to your own account. That data goes from your computer to your Drive. It does not pass through us and we cannot read it. Your use of Google Drive is governed by Google's privacy policy, not this one.

Plugins and exporters you install — including the Jira, ClickUp, Toggl and Clockify integrations — talk directly to whichever service you configure them for, under your own credentials. Those transfers are between you and that provider.

4. What the licence server stores

This website and the licence server behind it are the only places where we hold data about you. Concretely:

4.1 When you buy Tical

Checkout happens on Stripe's own pages. Card numbers never reach our server and we could not store them if we wanted to — this server holds no Stripe secret key at all. After a successful payment Stripe notifies us, and we record:

• your email address, exactly as you gave it to Stripe;
• the Stripe checkout session and payment intent identifiers (strings such as cs_live_… and pi_…);
• the edition you bought, the highest major version your licence covers, and the time of purchase;
• a random redemption token, which is what the link in your receipt points at.

We do not receive your card details, your billing address or your name from Stripe, and we do not ask for them.

4.2 When you activate your licence

On the activation page you paste a hardware code that the app generates on your computer. When we issue your key we record, in an append-only log:

• your email address;
• the hardware fingerprint contained in that code (see section 5);
• the licence identifier, edition, issue date and version ceiling;
• the signed licence key itself, so we can send it to you again if you lose it.

4.3 When you simply visit

Our server sees your IP address on every request, as any web server does. We use it for one purpose: to count requests per address so that a single visitor cannot exhaust the service for everybody else. Those counters live in memory and are discarded when the window closes.

IP addresses also appear in ordinary server logs, along with the request path, timestamp and browser user-agent string. One administrative action — an operator revealing a full licence key — is deliberately recorded together with the operator's IP address, so that access to customer keys leaves a trail.

Log entries that mention an email address show it masked (for example cu•••@example.com). The administration screens show masked addresses too; the full value is revealed only by an explicit, logged and rate-limited action.

4.4 When you send feedback

The feedback form stores exactly what you type into it: whether it is a feature request or a bug report, your summary, your description, and the date. There is no account behind it and nothing is collected in the background.

The email field on that form is optional and exists for one reason — so that we can reply to you about what you sent. Leave it blank and your submission carries no identifier at all. If you do fill it in, it is shown masked in our administration screens like every other address, and it is never added to a mailing list, because we do not have one.

Please do not paste licence keys, passwords or anything else confidential into the form. If you do, tell us and we will delete the entry.

5. About the hardware fingerprint

A Tical licence is tied to one computer, which means we need something stable to tie it to. The app reads four identifiers from your machine — the Windows machine GUID, and the serial numbers of the motherboard, the BIOS and the system drive — and, for each one separately, computes a SHA-256 hash and keeps only the first sixteen hexadecimal characters.

What that means in practice:

• We never see your actual serial numbers. We see four short hashes.
• The hashes cannot be reversed into the serials, though they are stable, so they work as a persistent identifier for that specific machine. Under the GDPR that makes them personal data, and we treat them as such.
• Values that cannot be read, or that are known manufacturer placeholders, are simply omitted.
• We index this fingerprint in order to enforce one licence per machine. We do not use it to recognise you anywhere else, and it tells us nothing about what is on your computer.

6. Why we are allowed to hold it

• Performance of a contract (Art. 6(1)(b) GDPR) — issuing your licence, binding it to your machine, re-issuing it when you get a new computer and handling refunds are all steps in the contract you entered when you bought Tical. Without your email address and hardware code there is no licence to issue.
• Legal obligation (Art. 6(1)(c) GDPR) — Polish tax and accounting law requires us to keep records of completed sales.
• Legitimate interests (Art. 6(1)(f) GDPR) — keeping the service available and preventing abuse of the activation and download endpoints, which is why we count requests per IP address and log administrative access to keys. We consider this a mild intrusion, plainly expected of any online service, and it is balanced against the very real harm of the service being knocked over or licences being harvested.

None of this relies on your consent, so there is no consent for you to withdraw — but you can object to the processing based on legitimate interests, as described in section 10.

7. Who else sees it

We use as few outside services as we can. The complete list:

The GitHub case is worth spelling out. The application binaries live in a private repository, so when you click a download link our server asks GitHub for a short-lived signed URL and then redirects your browser to it. Your browser fetches the file directly from GitHub's content delivery network, which means GitHub — not us — sees your IP address and user-agent for that request. The bytes never pass through our server, and no account or identifier of yours is attached to the URL.

Beyond that: TLS certificates come from Let's Encrypt, and nothing else on this site is loaded from a third party. There are no fonts, scripts, frames or images fetched from anyone else's servers, so no other company learns that you visited.

We may also disclose data where the law requires it — for instance to a tax authority or in response to a valid court order.

8. Transfers outside the EEA

Stripe and GitHub are able to process data in the United States. Those transfers rest on the European Commission's Standard Contractual Clauses and, where applicable, on the providers' certification under the EU–US Data Privacy Framework. You can ask us for details of the safeguards in place.

Our own server and its backups are located in [SERVER LOCATION / COUNTRY].

9. How long we keep it

• Licence and purchase records — for as long as your licence is valid, which for a perpetual licence means indefinitely, because we need to be able to prove it is yours and re-issue it when your hardware changes. Once a licence is no longer in use, the records attached to a completed sale are still kept until the end of the statutory Polish accounting retention period, which is five years counted from the end of the tax year of the transaction.
• Feedback submissions — until the request or bug is dealt with and we no longer need the context, after which the entry is deleted. Unlike the issuance log, this one does have a delete button, and asking us to remove yours is enough.
• Server logs — rotated automatically. We keep roughly the last 50 MB of output, which in normal traffic is a matter of days, and we do not archive it.
• Database backups — taken nightly and kept off the server. Old backups age out on a rolling schedule, so a record you ask us to delete may persist in a backup for a short time after we remove it from the live database. We do not restore backups in order to recover deleted data.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you, and receive a copy;
• rectify it if it is wrong — a mistyped email address, for example;
• erase it, where we have no overriding reason to keep it;
• restrict processing while a dispute about accuracy is resolved;
• port it to another provider in a structured, machine-readable form;
• object to processing we base on legitimate interests.

To exercise any of these, email contact@tical.io. We reply within one month, and normally much sooner. We may ask you to confirm control of the email address on the purchase, because that address is essentially the only thing linking the record to a person — we will not ask you for identity documents.

On erasure specifically. If you ask us to delete your data we will do it, with two honest caveats. First, records of a completed sale must be retained for the tax period described above; the GDPR permits us to refuse erasure on that ground (Art. 17(3)(b)), so what we can do in the meantime is restrict the record from any other use. Second, deleting a licence record means we can no longer prove the licence is yours or re-issue it if your computer changes — your existing installation will keep working, because it verifies offline, but you would be buying again rather than asking for a replacement. We will say so before acting.

If you think we have handled your data badly, please tell us first — but you are entitled to go straight to a supervisory authority. Ours is the Polish Urząd Ochrony Danych Osobowych (President of the Personal Data Protection Office), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. You may also complain to the authority where you live or work.

11. Cookies and tracking

This site sets no cookies for visitors. Not one. There is no consent banner because there is nothing to consent to.

A single cookie, tical_admin, exists on the administration pages, which only the operator can reach. It holds a sealed session token, is marked HttpOnly, Secure and SameSite=Strict, expires after twelve hours, and is strictly necessary for the operator to stay logged in.

Nor is there any substitute for cookies. We do not use local storage, session storage or browser fingerprinting to recognise visitors. The activation page carries your redemption token in the address bar of the link from your receipt, and keeps no copy of it.

12. Security

Proportionate to a small service holding a small amount of data:

• everything is served over HTTPS;
• the application runs in a hardened, read-only container with dropped privileges, reachable only through a reverse proxy on the host;
• signing keys and secrets are mounted as files, never committed to source control and never exposed by the application;
• administration is protected by a long random key and a sealed session cookie, and its endpoints are rate-limited;
• email addresses are masked by default in logs and in the administration screens;
• backups are stored off the server.

No system is perfect. If a breach is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and tell you directly where the risk is high. If you have found a vulnerability, please write to contact@tical.io — we would much rather hear it from you.

13. Children

Tical is a tool for working adults and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has purchased a licence, contact us and we will unwind it.

14. Changes to this policy

If we change what we collect or who receives it, we will update this page and move the date at the top. Where the change is significant and we hold your email address because you bought a licence, we will email you about it. Previous versions are available on request.

Questions about any of this: contact@tical.io. See also our Terms of Service.