Privacy Policy
Last updated: 31 October 2026
What AL Data Labs collects, why, where it is kept and how to have it removed. This covers the website aldatalabs.com and Time Tracker Pro, our time-tracking Power-Up for Trello.
In short
- No cookies, analytics or trackers, on the website or in the Power-Up.
- We store what time tracking needs: who logged how long, on which card, and when.
- One server in Nuremberg, Germany. Backups are also kept in Germany.
- We never sell your data, share it for advertising or use it to train AI models.
- For a copy or a deletion, write to [email protected]. We answer within 30 days.
1. Who we are
AL Data Labs is a sole proprietorship registered in Ukraine. We are the data controller for everything on this page. For any privacy matter, write to [email protected].
2. This website
- The site is static. It has no cookies, analytics, ads or third-party trackers, and loads nothing from other services.
- It is hosted on Cloudflare Pages. Cloudflare processes request data, such as your IP address and browser, to deliver and protect the site. We do not receive those logs. See Cloudflare's Privacy Policy.
- If you email us, we keep your message and address for as long as we need to answer you and keep a record.
3. Time Tracker Pro: what we store
| Data | Why |
|---|---|
| Your Trello member id, display name and avatar URL | To show whose time an entry is, and who is on the board |
| Workspace, board, list and card ids, names and labels | To group and filter reports. Names are cached so old reports still read correctly after a rename |
| Who is on which board | To decide whose time may be logged and which boards your reports cover. Kept after someone leaves the board, so their past hours still appear in reports |
| Time entries: start, end, duration, an optional note, and how each one was created | Recording time is what the product does |
| Estimates, and the Result text written on a card | You enter them, and they are shown back to your board |
| The card description | Stored only on plans that include this feature |
| AI fields derived from a card | Stored only on the Pro + AI plan |
| Your chats with us: your messages, our replies and an optional email address | To answer you. Our reply appears inside the Power-Up, so the email address is not needed |
| API keys | Only a short prefix is readable. The secret is stored as a SHA-256 hash and cannot be recovered |
| Web-server request logs: IP address, time, path, status | For security and fault diagnosis. Never used to build a profile |
Stored in Trello, not with us
- Your display preferences: language, date format, first day of the week and CSV separator.
Never received
- Your Trello password.
- Any token that can act on your Trello account. The Power-Up identifies you with a short-lived token that Trello signs. That token only says which board, card and member you are looking at.
- Payment card details. Donations are handled entirely by the payment provider.
How it reaches us
Your data reaches us in four ways: from Trello's signed context, from the board sync your browser sends, and from a CSV import or the API if you use them.
4. Legal basis (GDPR)
| Basis | For |
|---|---|
| Contract | Storing and reporting your team's time |
| Legitimate interests | Running the service, preventing abuse, diagnosing faults and answering email |
| Consent | The optional email address in a chat. To withdraw consent, ask us to delete the chat |
5. How long we keep it
| Data | Kept |
|---|---|
| Time entries, estimates, Result text | For as long as the account uses the service. Removing the Power-Up does not delete anything, because Trello does not tell us when that happens. To delete a board's data, email us its name |
| Card descriptions, AI fields | Deleted 90 days after the account leaves the plan that included them. Re-subscribing within that time cancels the deletion |
| Chats and the email address | For as long as the account uses the service. Archiving a chat only hides it. Ask us and we delete it, including the email address |
| Request logs | Until the log file fills up and is rotated out, so how long depends on traffic |
| Backups | Taken every hour and each kept for about two weeks. A deletion takes effect at once in the live database, and leaves the backups within those two weeks |
6. If you delete your Trello account
Trello tells us when you delete your account, and we act on it without being asked:
- your Trello identity is replaced with a random value that cannot be traced back to you;
- your name and avatar are cleared;
- your chats, our replies to them and your email address are deleted.
The hours you logged stay, no longer linked to anyone, so a board's history does not change after the fact. We do the same when Trello reports that a token was revoked or has expired. When it reports a profile change, we clear the cached name and avatar.
7. Where it is stored, and who else processes it
The database and the API run on one server in Nuremberg, Germany. The database accepts no connections from outside that server. Backups are written every hour to storage that is also in Germany.
| Processor | What for | Where |
|---|---|---|
| Atlassian (Trello) | The platform the Power-Up runs inside | Under Atlassian's own policy |
| Hetzner Online GmbH | Server and backups | Germany |
| Cloudflare | Domain and DNS, this website, the Power-Up's pages | Global edge network |
| Zoho | Email for @aldatalabs.com addresses | Under Zoho's own policy |
| PayPal | Voluntary donations only | Under PayPal's own policy |
Hetzner, Cloudflare and Zoho are international companies. Their support access can mean a transfer outside the EEA or the UK, and any such transfer is covered by their standard contractual clauses. Atlassian and PayPal handle your data under their own policies. We will update this list before adding a new processor. We share your data with no one else, unless the law requires it.
8. Your rights
- You can ask for a copy of your data, a correction, a deletion or a portable copy. You can also ask us to restrict how we use it, or object to that use. Write to [email protected]. We answer within 30 days.
- You can export your own time to CSV from the board view at any time, without asking us.
- You may complain to your national data protection authority.
9. Security
- All traffic goes over HTTPS.
- The database listens only on the server itself and cannot be reached from the internet.
- Administrators log in with SSH keys on a non-default port. Passwords are not accepted.
- API secrets are stored only as hashes.
If you find a security problem, please tell us at [email protected] before telling anyone else.
10. Children
Our products are business tools. We do not knowingly collect data from anyone under 16.
11. Changes
The date at the top is the date of the current version. If a change matters, we announce it in the Power-Up's release notes as well as changing the date.