wrks

Privacy policy

Last updated: 12 October 2026

Wrks is a time-tracking application. This page explains which personal data the service needs, why it needs it, where it lives, and how you can ask for it to be corrected or deleted.

If you connect Google, the disclosures that Google OAuth verification requires are in section 3 (Google user data): what is accessed, how it is used, with whom it is shared, how it is protected, and retention and deletion.

1. Controller

The controller of personal data processed through Wrks is:

Antonio Molinari
Via Caselle 6
26032 Ostiano (CR), Italy

Email: [email protected]
Site: https://m6i.it
Service: https://wrks.it

In this document “Wrks”, “I”, and “the service” refer to that person acting as a natural person, not as a company.

2. What Wrks does

Wrks lets you record time against projects and tasks, in a workspace, from the web application. You can sign in with email or with Google. If you turn a Google calendar on, Wrks reads that calendar so you can see its events next to your time entries and, when you ask, copy an event into a time entry or start tracking from it.

A free plan is available. A paid plan with extra features is planned. When billing starts, this policy and the terms will say which payment provider is used. Card numbers will not be stored on Wrks’s servers.

3. Google user data

This section describes Google user data accessed through Google Sign-In and the Google Calendar API. Wrks’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Wrks requests read-only Calendar access. It does not request permission to create, update, share, or delete events or calendars in your Google account, and it does not write back to Google Calendar.

3.1 What Google user data is accessed

When you choose to connect Google, Wrks requests only these OAuth scopes:

  • https://www.googleapis.com/auth/userinfo.email (also requested as email) — the email address of the Google account you sign in with.
  • https://www.googleapis.com/auth/userinfo.profile (also requested as profile) — basic profile such as display name and profile picture URL.
  • https://www.googleapis.com/auth/calendar.readonly — see and download calendars you can access, including event details (read-only).

From those APIs Wrks may receive, and in some cases store:

  • Identity: Google account email, display name, and profile picture URL used to create or match your Wrks account.
  • Provider identifier: the Google account id used to link sign-in to your Wrks user record.
  • OAuth credentials: access token, refresh token, and expiry, so Wrks can call the Calendar API for you until you disconnect.
  • Calendar list: identifiers and names of calendars Google returns, and which of them you mark active in Wrks.
  • Event fields returned for the calendars you mark active and for the period on screen: identifiers, titles, start and end times, descriptions, locations, and links, when Google includes them. Wrks uses them to draw those events on the time-entry calendar. A lasting copy is stored only when you copy an event into a time entry or start tracking from it.

Wrks does not request Gmail, Drive, Contacts, or other Google products. It does not access Google user data until you complete Google’s consent screen.

3.2 How Google user data is used

Google user data is used only to operate Wrks for you:

  • sign you in (or link an existing Wrks account) with Google;
  • show your name and avatar in the interface when you are logged in;
  • list the calendars you can turn on, and remember which ones are active;
  • read events from those calendars and show them on the time-entry calendar;
  • create a time entry from a Google event when you choose Copy or Start;
  • refresh an expired access token so the calendar view can keep working;
  • diagnose faults that affect sign-in or calendar reading.

Wrks does not use Google user data to:

  • serve advertising or build advertising profiles;
  • sell or rent the data;
  • determine creditworthiness or lend it to others for that purpose;
  • train, develop, or improve generalized or non-personalized artificial intelligence or machine-learning models;
  • create, update, or delete events in your Google Calendar.

Human access by the operator is limited to providing the service, support you request, and security or abuse investigation.

3.3 With whom Google user data is shared, transferred, or disclosed

I do not sell Google user data. I do not share it with advertisers or data brokers. It is disclosed only as follows:

  • You — in the Wrks web app when you are signed in, and to an HTTP API client if you create an API key and call the API yourself.
  • The operator (Antonio Molinari) — as controller, with access limited to running the service, support, and security.
  • Hetzner Online GmbH — hosting in Germany. The application database (including account data, OAuth tokens, and calendar names) and operational logs live on that server.
  • Google — Wrks sends the OAuth tokens back to Google to read calendar data. Google remains the independent controller of your Google account.
  • API clients you authorise — if you create an API key, that client receives the responses you ask for. After data leaves Wrks, that client’s own terms apply.
  • Legal obligation — if a competent authority lawfully requires disclosure, or if it is strictly necessary to protect the service or users against abuse or crime.

Google Fonts and jsDelivr may receive your IP address when the web interface loads typefaces or the calendar script. That is ordinary page delivery, not a transfer of Calendar event contents.

3.4 Data protection for Google user data

Calendar events can contain sensitive personal information (for example meeting titles or descriptions). Wrks treats Google Calendar data as confidential account data and applies these measures:

  • Encryption in transit: HTTPS/TLS between your browser and Wrks, and between Wrks and Google’s APIs.
  • Access control: production server and database access is limited to the operator. Calendar data is tied to your Wrks account; other users do not read your Google events through the product, except time entries you record inside a shared workspace.
  • Credential hygiene: account passwords and API keys are stored hashed. Google OAuth tokens stay on the EU host and are not published.
  • Minimisation: only the scopes listed above are requested. Event payloads are used to draw the calendar and, when you ask, to create a time entry. Wrks does not keep a long-term archive of every historical Google event.
  • Environment: the app runs on a dedicated Hetzner server in Germany, with PostgreSQL and TLS at the reverse proxy.
  • Revocation: you can turn calendars off in your profile and revoke Wrks in your Google Account permissions.

No method of storage or transmission is perfectly safe. If a breach affecting Google user data is confirmed, I will notify you and the authorities when the law requires it.

3.5 Retention and deletion of Google user data

While the connection is active: the Google provider link, OAuth tokens, and the list of calendars (including which ones you marked active) are kept so you can sign in again and so the calendar view can keep reading. Event data fetched from Google is used to display the period on screen. A durable copy exists only for time entries you create, including those you copy or start from a Google event.

How to delete Google user data from Wrks without closing the Google account itself:

  1. Turn off the calendars you no longer want Wrks to read, on your profile.
  2. Optionally revoke Wrks in Google Account → Third-party access.
  3. To erase the Wrks account and remaining copies (profile, tokens, time entries, API keys), email [email protected] from the address on the account. After identity checks, deletion from live systems starts without undue delay.

Residual backups of the server disk may hold copies for a short technical window; they are not put back into ordinary use and expire with the backup cycle. Disconnecting Wrks does not delete events from your Google Calendar.

4. Other categories of data

Account

Email address, name, password hash (if you register with email), profile picture URL if Google Sign-In provides one, language preference, and role metadata (for example whether the account is an administrator).

Google Calendar connection

See section 3. In short: OAuth tokens, calendar names, the calendars you mark active, and event fields needed to draw them, with read-only Calendar scope.

Time entries and workspace data

Time entries you or other members of the workspace record: start and end, duration, description, notes, project, task, tags, and whether the time is billable. Also the workspace, projects, and tasks those entries belong to.

API keys

Hashed API keys if you create them, so a client you choose can call the HTTP API.

Technical and security data

IP address, browser and device information, requested URLs, timestamps, and diagnostic logs needed to run and protect the service. Invitation codes may be stored in a technical cookie while you sign up.

Wrks is not meant for health data, judicial data, biometric data, or data about children as an ordinary use of the product. Do not put that kind of material in descriptions or notes.

5. Purposes and legal bases

  • Running the account and the product (sign-in, time entries, projects, calendar view): performance of a contract, Art. 6(1)(b) GDPR.
  • Google Sign-In and Calendar: you start that connection yourself; processing follows from the contract and from the permission you grant in Google’s consent screen.
  • Security, abuse prevention, error diagnosis: legitimate interest in keeping the service usable and safe, Art. 6(1)(f) GDPR.
  • Answering support requests: contract and, where needed, legitimate interest.
  • Legal duties (for example tax records once paid plans exist): Art. 6(1)(c) GDPR.
  • Optional tracking: none is active today. If non-essential cookies are added later, they will run only with consent, Art. 6(1)(a) GDPR. See the cookie policy.

Google user data is used to authenticate you and to show the calendars you turn on. It is not used for advertising, resale, or training general-purpose models. Details are in section 3.2.

6. Where data is processed

The application runs on a dedicated server in Germany, operated by Hetzner. The stack is a containerised Ruby on Rails app with PostgreSQL, TLS at the reverse proxy, and background jobs on the same host. There is no separate analytics warehouse.

Some processing happens at other providers because the product cannot work without them, as listed below. I prefer to keep the primary copy of account data in the EU.

7. Recipients and processors

I do not sell personal data. Access is limited to me, to you (for your own account and workspace), and to the providers needed to deliver Wrks. Those providers act as processors or as independent controllers, depending on the service. Recipients of Google user data are listed in section 3.3.

Hetzner Online GmbH

Role: hosting and infrastructure in Germany.
Data: the application database, files, and operational logs.
Location: Germany (EU).

Google

Role: Sign-In and the Calendar API. Google is an independent controller of your Google account. Wrks uses Google as a source of identity and of events after you authorise it.
Data: profile and email on sign-in; OAuth tokens; calendar lists and events returned by the API. See section 3.1.
Location: processing may occur in the EEA and in other countries, under Google’s terms and the transfer tools Google publishes (including adequacy decisions or standard contractual clauses where they apply).

Google Fonts and jsDelivr

The web interface loads the Roboto typeface from Google’s font servers and, on calendar screens, the FullCalendar library from the jsDelivr content network. Those requests can expose your IP address and user agent to the respective operator. They are used only to render the interface, not to profile you for Wrks.

API clients you connect

If you create an API key and point a client at Wrks, that client receives the API responses you ask for. After the data leaves Wrks, that provider’s own terms apply. Revoke the key if you no longer want that client to have access.

Future payment provider

When a paid plan is offered, checkout will be handled by a specialised billing provider. Wrks will receive status of the subscription, not the full card number. This section will name the provider before paid checkout goes live.

8. International transfers

Hosting is in Germany. Google Sign-In, Google Calendar, font delivery, and the JavaScript CDN may involve processing outside the EEA. Where that happens, the transfer rests on an adequacy decision, standard contractual clauses, or another mechanism allowed by Chapter V GDPR, as published by the relevant provider.

9. Retention

  • Account, Google connection, and time entries: kept while the account exists. Google-specific retention and deletion are in section 3.5.
  • API keys: kept until you revoke them or the account is closed.
  • Technical logs: kept only as long as useful for security and debugging, then overwritten or deleted.
  • Invitation cookie: until it is used or you clear site data.
  • Backups of the server disk may retain copies for a short technical window after deletion from the live database.

To delete the account, write to [email protected] from the address on the account. After identity checks, erasure from live systems starts without undue delay. Residual backup copies are not put back into ordinary use and disappear when the backup cycle ends. Legal retention (for example invoices, once billing exists) is limited to that purpose.

10. Your rights

If GDPR applies to you, you may request access, rectification, erasure, restriction, objection, and portability, and you may withdraw consent where processing is based on consent, without affecting earlier lawful use. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the authority of your EU/EEA country of residence.

Use [email protected]. I will answer within one month, with the extensions GDPR allows for complex cases.

11. Children

Wrks is not directed at people under 16. I do not knowingly collect their data. If you think a child created an account, contact me and I will delete it.

12. Security

Traffic to the app is encrypted in transit (HTTPS). Passwords are stored as hashes. API keys are stored hashed. Production access is limited to the operator. Measures specific to Google user data are in section 3.4. No method of storage or transmission is perfectly safe.

13. Related documents

Use of the product is also governed by the terms and conditions. Cookies and similar storage are described in the cookie policy.

14. Changes

This page will change when the product, the hosting, or the law requires it. The date at the top is the current version. Continued use after an update means you have seen the new text; if a change is material, I will try to flag it in the app or by email when I have an address for you.