Privacy Policy — Uurly

Effective date: 22 July 2026

Uurly ("the app") is a time tracking and invoicing app for freelancers, developed and published by Dombyte Studio, Utrecht, the Netherlands ("we", "us").

This policy explains what data the app handles, where it is stored, and what your rights are. The short version: your business data never leaves your device unless you choose to share it. Uurly does not require an account, and we do not run servers that store your data.

1. Data stored on your device only

Everything you enter into Uurly is stored locally on your device, in a database that only the app can access:

  • Clients and projects (names, contact details, hourly rates)
  • Time entries and expenses
  • Invoices and invoice numbers
  • Your business profile (name, address, tax identifiers such as VAT/BTW, KvK, or EIN numbers, and bank account details such as IBAN)
  • App settings and preferences (language, theme, invoice defaults)

We have no access to this data. It is not transmitted to us or to any third party by the app. If you delete the app, this data is deleted with it, per your operating system's standard behavior.

When you export an invoice as a PDF or share it, the document is generated on your device and shared only through the destination you choose (e.g. your email app or file storage). We are not involved in that transfer.

2. Subscriptions (RevenueCat, Apple, Google)

Uurly offers an optional auto-renewing subscription ("Uurly Pro"). Payments are processed entirely by Apple (App Store) or Google (Google Play) — we never receive your name, billing address, or payment card details.

To validate purchases and manage subscription status, the app uses RevenueCat (RevenueCat, Inc., USA) as a payment infrastructure provider. RevenueCat receives:

  • An anonymous, app-generated identifier for your installation (not your name or email)
  • Purchase receipt data from Apple or Google
  • Basic device information (device model, OS version, app version) needed to process transactions

RevenueCat processes this data on our behalf to determine whether your subscription is active. See RevenueCat's privacy policy for details.

3. Analytics (opt-in only)

The app can collect anonymous usage statistics through Amplitude (Amplitude, Inc.), but only if you explicitly opt in — either during onboarding or later in Settings → Preferences. If you never opt in, no analytics data is collected at all.

If you do opt in:

  • Events describe feature usage only — for example "an invoice was created" or "hours were logged". They never include the contents of your data: no client names, no amounts, no invoice details, no personal information.
  • Data is processed on Amplitude's EU servers.
  • IP address collection is disabled in our analytics configuration.
  • You can withdraw consent at any time in Settings → Preferences; collection stops immediately.

We use these statistics solely to understand which features are used and to improve the app.

4. Crash reporting (opt-out)

To keep the app stable, Uurly uses Firebase Crashlytics (Google LLC) to collect crash reports. When the app crashes or encounters an internal error, a report is sent containing the technical stack trace, device model, operating system version, and app version. Crash reports never include the contents of your business data — no client names, invoices, amounts, or profile information.

Crash reporting is enabled by default because it is essential for fixing bugs, but you can turn it off at any time in Settings → Preferences. See Google's privacy policy for how Google processes this data.

5. Feedback

The in-app feedback form composes a message in your own email app — nothing is sent through our servers. You see exactly what will be sent before you send it, and sending is entirely your choice. If you email us, we use your message and email address only to respond to you.

6. What we do not do

  • We do not sell or rent any data.
  • We do not show third-party advertising.
  • We do not use tracking across other apps or websites.
  • We do not require or store user accounts.

7. International data transfers

We are based in the Netherlands. Our subscription processor, RevenueCat, Inc., and our crash reporting provider, Google LLC, are based in the United States. Where personal data of EEA or UK users is transferred to the United States, the transfer is safeguarded by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, as applicable. Opt-in analytics data is processed on Amplitude's servers located in the European Union.

8. Legal bases (GDPR / UK GDPR)

For users in the European Economic Area and the United Kingdom, our legal bases under the GDPR (and UK GDPR) are:

  • Performance of a contract (Art. 6(1)(b)) — processing purchase data to provide your subscription.
  • Consent (Art. 6(1)(a)) — opt-in analytics. You may withdraw consent at any time.
  • Legitimate interest (Art. 6(1)(f)) — crash reporting to keep the app functional and secure (with an opt-out in Settings → Preferences), and responding to support and feedback emails you send us.

9. Your rights

European Economic Area and United Kingdom (GDPR / UK GDPR): you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. You also have the right to lodge a complaint with your supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens; in the UK, the Information Commissioner's Office (ICO).

United States: depending on your state (e.g. California under the CCPA/CPRA), you may have rights to know, access, correct, and delete personal information, and to opt out of its sale or sharing. We do not sell or share personal information as defined by those laws, and we do not use it for targeted advertising.

Canada (PIPEDA): you have the right to access and correct personal information we hold about you and to withdraw consent.

Because your business data is stored only on your device, you exercise most of these rights directly: you can view, edit, and delete everything inside the app, and deleting the app removes all local data.

For data held by our processors (subscription records at RevenueCat, crash reports at Google, opt-in analytics at Amplitude), contact us at the address below and we will handle the request, including deletion, regardless of where you live.

10. Data retention

  • Your business data: stored on your device until you delete it or uninstall the app. We hold no copy.
  • Subscription records: retained by RevenueCat for as long as needed to manage your subscription and meet financial record-keeping obligations.
  • Crash reports: retained by Google Crashlytics for 90 days.
  • Analytics events: retained by Amplitude in aggregate form; deleted on request.

11. Children

Uurly is a business tool intended for freelancers and contractors. It is not directed at children under 16, and we do not knowingly collect data from them.

12. Future features

If we introduce optional accounts or cloud synchronization in a future version, that functionality will be opt-in, and this policy will be updated before any such feature launches. Continued local-only use will remain possible.

13. Changes to this policy

We may update this policy as the app evolves. The current version is always available at uurly.com/privacy, with its effective date at the top. For material changes, we will notify you in the app.

14. Contact

Dombyte Studio
Utrecht, the Netherlands
KvK: 42083302
Email: legal@uurly.com
Website: www.dombyte.com