Privacy policy

Who is responsible

Klokka is run by Prasannjeet Singh (sole trader, enskild firma), organisation number 891010-6973, Väderkvarnsbacken 163, 352 56 Växjö, Sweden. Klokka has two roles. For your account, meaning your name, email address and settings, the controller is Prasannjeet Singh (sole trader).

For the hours an employer logs about their employees, the employer is the controller and Klokka is the processor. We process that data only to provide the service to the employer, under the data processing clause in the terms.

Send questions about your data to hej@klokka.se. Who we are is on the about page.

What we store

This is everything Klokka keeps:

• Account: name, email address, language, light or dark mode and notification settings. Sign-in is handled by Klokka's own sign-in service (Logto), which stores your password hashed. Klokka's database holds no passwords.
• Business: name, currency, time zone and settings.
• Hours: hours per day per employee, notes, flags with their messages, locked months and the history of every change (who, what and when).
• Hourly rate, if the employer has turned pay on and set a rate for the employee.
• Jobs: a day's jobs with hours, start time, note and a place the employer chooses (name, address and coordinates). The place is visible to the employer and to the employee the job belongs to.
• Notifications: a push notification token for each phone where you are signed in to the Android app.
• The phone's position, only when the employer taps "Use where I am now" on a job, in the Android app or the web app. It is read once while the app is open, never in the background, and is not stored as your position: only the place that becomes the job's is saved. Employees' positions are never collected.
• Email: addresses for invitations and for the weekly digest, which you can turn off in Settings.
• Use of the apps: which pages and screens of the web app and the Android app are opened and three events (a business is created, an invitation is sent, hours are saved), with the browser or phone, operating system, language and roughly which country and city the visit comes from. It is counted with Umami, without cookies or any id on your device, and is not linked to your account. The IP address is not stored, and ids, dates and link parameters are removed from the addresses before they are sent.
• Visits to the klokka.se website, only if you have said yes: Google Analytics sets cookies and collects which pages you visit, where you came from, approximate location, device and browser, and clicks on buttons such as "Create your business".

Why the data is processed

Account data is processed to provide the service you signed up for (contract). Security and operations, such as logs and backups, rest on legitimate interest.

Employees' hours are processed on the employer's behalf. The legal basis for them is the employer's, for example the employment contract or the duty under the Working Hours Act to record on-call time, overtime and additional hours.

The website statistics in Google Analytics rest on your consent, which you can withdraw at any time under Cookie settings at the bottom of the page. The app statistics in Umami rest on legitimate interest: seeing which parts are used and making them better, without identifying anyone.

Where the data is stored

Everything is stored on servers at NetCup in Germany, inside the EU, and backups on our own server in Sweden. Sign-in runs on the same servers, in our own installation of Logto, not with an outside sign-in provider.

Some of the services sit outside the EU and EEA. Email is sent through Migadu, a company in Switzerland, which the European Commission recognises as giving adequate protection to personal data. Push notifications are delivered through Expo and Google Firebase Cloud Messaging in the US, relying on the EU-US Data Privacy Framework, under which both companies are certified, and on the European Commission's standard contractual clauses. A push notification contains only the notification text and the phone's token.

Place search, "Use where I am now" and the small job maps go through Klokka's server to Google Maps Platform (Google LLC, US), on the same basis. Google receives the search text, the chosen place's id or the coordinates, never your name, email address or account. Directions open Google Maps on your own phone or computer, outside Klokka.

The app statistics are stored in our own installation of Umami, on our server in Sweden. The website statistics are stored by Google Analytics (Google Ireland Limited and Google LLC, US) under the EU-US Data Privacy Framework, and only if you have said yes.

Who else processes data

Klokka uses a few sub-processors, only for what is listed here. If the list changes, we say so on this page before the change applies.

• NetCup (Germany): servers and database.
• Migadu (Switzerland): sending email, such as invitations and weekly digests.
• Expo (US) and Google Firebase Cloud Messaging (US): delivering push notifications to the Android app. They receive only the notification text and the phone's token.
• Google Maps Platform (US): place search, addresses to coordinates and map images for jobs. Google receives only the search text, the place id or the coordinates.
• Google Analytics (Ireland and US): visit statistics for the klokka.se website, only if you have said yes.

Klokka in Claude

You can choose to connect Klokka to your account with Claude, Anthropic's AI assistant. What Claude fetches for you is then sent to Anthropic: for example names, hours, notes, jobs and hourly rates when you may see them yourself. Claude gets only what your account may see in the app.

Anthropic is then a recipient you choose yourself, under your own agreement with Anthropic, and not a Klokka sub-processor. Klokka stores no chats. You turn the connection off by choosing Off under Klokka in Claude in Klokka, or disconnect it in Claude. With Read only Claude can still read, but cannot change anything. More is on the Klokka in Claude page.

Cookies and browser storage

The klokka.se website stores your choice of light or dark mode and your answer to the cookie question in your browser. Only if you say yes does Google Analytics set its cookies (_ga and _ga_ followed by an id), kept for up to two years. You can change your answer at any time under Cookie settings at the bottom of the page, and if you say no later, we remove the cookies.

The web app uses one cookie for sign-in and a few for your choices: language, light or dark mode and the business you last opened. They are needed for the app to work. The statistics in the web app and the Android app use no cookies and store nothing on your device.

How long data is kept

Data is kept for as long as the account or the business exists. Nothing is deleted automatically.

The database is backed up every day to our own server in Sweden, over an encrypted connection. Backups are kept for a limited period and then replaced by newer ones, so deleted data also disappears from them after a while.

You can delete your account yourself in the app or on the web, see Delete your account. If you cannot get into the account, email hej@klokka.se and we will delete it for you. We answer without undue delay and at the latest within one month.

Your rights

You have the right to know what data we hold about you, to have it corrected or deleted, to restrict or object to its processing, and to get it in a readable format. An employer can export the hours of any month as a CSV file.

Are you an employee asking about hours your employer logged? Ask your employer first, as they are responsible for that data. The employer can then ask us for help.

If you think we handle your data wrongly, you can complain to the Swedish data protection authority, IMY.

Changes

If this policy changes, we update this page and the date below. Larger changes are announced on the website before they apply.

Last changed 12 November 2026.