Legal
Security and Data Retention
Security and Data Retention
Plain-language summary
The app includes several technical security measures, but no digital service is risk-free. Data is kept only as long as needed for its purposes or for periods decided and implemented by the owner.
Security measures found in code/documentation
- password hashing with Argon2 as the primary hasher;
- CSRF protection;
- secure production cookies, HttpOnly sessions and SameSite protection;
- rate limits for login, registration, password reset, MFA, export and more;
- session rotation and session revocation;
- optional TOTP MFA;
- encrypted MFA secret based on the app secret;
- no-store headers for export downloads and protected responses;
- CSP and other security headers;
- trusted-proxy client IP handling;
- audit log and hash chain;
- Docker/non-root and private PostgreSQL in the documented deployment;
- encrypted backups in the documented operator process.
These measures reduce risk but cannot guarantee that data will never be lost, changed, leaked or unavailable.
Retention
| Data | Retention | Status/action |
|---|---|---|
| Account and profile | Until account deletion | Deleted during account deletion after 7-day grace period |
| Time records and notes | Until account deletion or user-controlled deletion | User data; export before deletion if it must be kept |
| Breaks and manual corrections | Until account deletion or user-controlled deletion | Same principle as time records |
| GPS coordinates | Until account deletion or separate GPS deletion | Exact coordinates are deleted; a minimal non-identifying event may be kept |
| GPS outcome/status | Until account deletion or user-controlled deletion | May show that GPS was denied, unavailable or deleted |
| IP/client metadata | Until account deletion or separate IP deletion | Exact IP is deleted completely on request/deletion unless a minimal anonymised audit reference is necessary |
| Pay, tax, job and agreement settings | Until account deletion or user-controlled deletion | Deleted with the account |
| Calculation snapshots | Until account deletion or user-controlled deletion | Deleted with the account |
| Export metadata | Until account deletion | Export file bytes are not retained after download unless the app is later changed |
| Audit log | Until account deletion; then personal details are deleted or anonymised | Admin/security events may require minimal anonymised logging |
| Email verification metadata | 30 days | Expired/used data is cleaned |
| Password reset metadata | 90 days | Expired/used data is cleaned |
| Inactive accounts | Warn after 12 months; delete/anonymise after 24 months | Requires cleanup/notice flow |
| Deleted accounts | 7-day grace period, then hard delete/anonymisation | Deletion normally cannot be undone after grace period |
| Backups | 12 months, encrypted | Deletion actions must be replayed after restore |
Backups
Backups are kept encrypted for up to 12 months on another self-hosted server, preferably in Denmark/EU/EEA.
Backups may temporarily contain data that has been deleted or anonymised in the active database. If a backup is restored, deletion and anonymisation actions must be replayed so deleted data does not return to active operation.
Backup access must be limited to necessary administrators, and backup keys should be kept separate from backup files where practical.
Security incidents
If a personal data breach occurs, the owner must assess the risk, document the incident and, where required, notify Datatilsynet and/or affected users. An internal incident procedure should be created before public launch.
Contact
Security contact: support@fejlgoblin.ovh Replies may come from: admin@fejlgoblin.ovh