Last updated 5 November 2026
What MinuAeg holds about you, why, and what you can do about it. It describes how the product actually behaves, including the less flattering parts: what closing your account does not reach, and what leaves our servers.
MinuAeg is operated by count23 OÜ (registry code 16892779), Pähkli, Salu küla, Saaremaa vald, Saare maakond, 94635, Estonia. We are the controller of the personal data described here.
Write to info@minuaeg.ee about anything in this document. There is one monitored mailbox and one person behind it, not a department.
We have not appointed a data protection officer. The law requires one only for large-scale monitoring of people or large-scale processing of sensitive data, and we do neither. Questions that would go to one come to the address above.
We decide what happens to the data that runs the service: your account, how you sign in, what you pay, and how we keep the service working. For that we are the controller, and this policy explains it.
We do not decide what happens to the work you put inside a workspace: your projects, clients, tracked hours, invoices and captured pages. That is yours. We hold it on your instructions and, for it, we are a processor. If you use MinuAeg to handle other people's information, our data processing agreement covers it, and you answer questions about those people rather than us.
Your account: name, email address, password (stored only as a hash, never readable), the language you chose, whether your address is confirmed, and when you were last active. Members of a workspace you belong to can see whether you are online right now. Without these there is no account to give you.
Your work: projects, tasks, tags, tracked time, clients, invoices, and, if the annotator is enabled for your workspace, captured pages and notes. Tracked time is recorded against a task in a workspace, not against a person, which is why we cannot pick one person's hours out of a shared workspace.
If you sign in with Google: that your Google identity is linked to this account, and the address Google reports.
If you create an API token or connect an AI assistant through our MCP server: the token's name, what it may do, and when it was last used. We store only a hash of the token. Whatever you connect reads or changes your data on your instruction, with the same rights you have.
If you pay us: a Stripe customer and subscription reference, your plan, and whether a payment has failed. Your card number never reaches us.
Email we send you: confirming your address, resetting your password, invitations, a monthly summary for workspace administrators, and a reminder when a timer has run unusually long. These are part of the service. We send no marketing email.
Technical records: the cookies listed below; server logs that may contain your IP address and the page that was requested; error reports, which can contain your user number and the request that failed and which reach our own mailbox over the same Estonian mail provider; and the reports your browser sends when our security policy blocks something.
Measurement, but only if you allow it. See the next section.
The legal grounds, as the GDPR names them. Running the service you signed up for is a contract with you (Article 6(1)(b)). Keeping our own accounts is a legal obligation (Article 6(1)(c)). Keeping the service secure and working, logging and error reports included, is our legitimate interest (Article 6(1)(f)), weighed against your privacy rather than assumed. Measurement is consent (Article 6(1)(a)), and nothing else.
You have to give us an email address and a password, or sign in with Google, because without them there is no account. Everything else is up to you. Measurement is entirely optional and declining it changes nothing about the service.
We make no automated decisions about you that have legal or similarly significant effects, and we do not profile you.
MinuAeg is for people aged 18 and over. We do not knowingly hold data about anyone younger.
We would like to know which pages bring people to MinuAeg and whether they get started. That is all measurement is for.
Until you choose to allow it, nothing is loaded, nothing is requested, and no identifier is created: not a script, not a cookie.
If you do allow it, Google Analytics receives the name of the screen you are on, together with its own identifiers, which include a cookie and your IP address. It never receives query strings, record identifiers, invitation, reset or sign-in tokens, email addresses, or anything from inside your workspace. The page title is fixed to the product's name for that reason, because the browser tab otherwise shows the name of whatever you are timing.
We also keep in your own browser, for 30 days, which of our pages you first arrived from, in which language, when, and a campaign label if the link carried one. If you then create an account, that becomes a record on our side for 90 days, so we can tell whether a page actually helps anyone. It is deleted when it expires, when you ask, or when you close your account, and it appears in your data export.
This is not anonymous and we will not call it that. It is information about a person with the obvious identifiers removed.
You can change your mind at any time: measurement settings are in the footer of every public page, on the sign-in screen, and in your profile. Declining stops it, clears the identifiers we can reach, and is remembered across your open tabs and your next visit. Withdrawing consent does not affect what was lawfully done before.
These are all of them. The necessary ones are needed for the service to work or to remember a choice you made, and need no consent. The others are set only after you allow measurement, and are removed when you withdraw it.
| Name | Type | Set by | Purpose | How long | Basis |
|---|---|---|---|---|---|
minute_session | Cookie | minuaeg.ee | Keeps you signed in. | 120 minutes of inactivity | Necessary |
XSRF-TOKEN | Cookie | minuaeg.ee | Protects forms against cross-site request forgery. | 120 minutes | Necessary |
remember_web_* | Cookie | minuaeg.ee | Keeps you signed in between visits, only if you tick “Remember me”. | 400 days, or until you sign out | Necessary |
minute_app | Cookie | minuaeg.ee | Lets the front page open the app straight away if you have signed in here before. It holds no personal data. | 30 days, until you sign out | Necessary |
minute.measure | Browser storage | minuaeg.ee | Remembers whether you allowed or declined measurement. | Until you change it or clear your browser | Necessary |
minute.locale | Browser storage | minuaeg.ee | Remembers the language you chose. | Until you clear your browser | Necessary |
minute.workspace | Browser storage | minuaeg.ee | Remembers which workspace you had open. | Until you sign out | Necessary |
minute.sidebar.collapsed, minute.starterMode, minute.installPromptDismissed, minute.annotator.lastProject.* | Browser storage | minuaeg.ee | Remember display choices you made: sidebar, timer mode, install prompt, last project used. | Until you clear your browser | Necessary |
minute.updateReloadedAt | Tab storage | minuaeg.ee | Reloads the app once after an update instead of showing an error. | Until the tab is closed | Necessary |
minute.oauthNext | Tab storage | minuaeg.ee | Remembers where to return after you sign in to connect an AI assistant. | Until the tab is closed, at most 15 minutes | Necessary |
minute.acq | Browser storage | minuaeg.ee | Which of our pages you first arrived from, so we can tell which pages help people start. | 30 days | Only with your consent |
_ga, _ga_P0FDQN560J | Cookie | Google Analytics | Google Analytics: tells visits apart and counts page views. | Up to 2 years | Only with your consent |
Zone Media OÜ, in Estonia, who run the server this service lives on and carry its email.
Cloudflare, who store two things for us: the nightly database backups, encrypted before they leave our server so that Cloudflare holds bytes it cannot read; and, if the annotator is used, the pictures it takes, in private storage reached only through links that expire.
Stripe, if you pay us. They take the payment and hold your billing details as a controller in their own right, not on our instructions.
Google, if you choose to sign in with Google, and for measurement if you allowed it.
ScreenshotOne, if the annotator is used. We send them the address of a page; they render it and send back a picture. The picture shows whatever that page showed.
An AI provider, only if your workspace connected its own key: the text you ask it to draft from goes to that provider, on your instruction and under your own account with them.
Nobody else. We do not sell anything about you, we do not use your work to train anything, and the typefaces on this site are served from our own server, so loading a page tells no font provider anything.
The service, its database and its email are in Estonia, and the company is Estonian.
Google, Stripe, Cloudflare and ScreenshotOne may process data outside the European Economic Area. Those transfers rely on the EU–US Data Privacy Framework where the supplier is certified under it, and otherwise on the European Commission's standard contractual clauses.
If you want to know the arrangement for a particular supplier, or where a specific copy of the data sits, ask at info@minuaeg.ee and we will tell you what is actually in place.
Your account and your work: until you close your account, which you can do yourself at any time from your profile.
Invoices you created in your workspace are deleted when you close your account, along with everything else in a workspace only you belong to. If your own accounting rules require you to keep them (in Estonia, generally seven years), download your data before you close. That copy is yours to keep and ours to delete.
Our own invoices to you, for your subscription, are different: they are our accounting records, we must keep them for 7 years, and Stripe issues and holds them.
Time you import from another tool (Toggl Track, Clockify, Harvest): the CSV file you upload is deleted as soon as the import finishes or is undone, and after 24 hours if you never finish it. The name of the file, and the names and email addresses of the people in it, kept only so you can match them to your colleagues, are cleared after 30 days. The imported time entries are your work and stay in your workspace like any other.
Server logs: 14 days. Backups: 14 nightly copies, each replaced in turn, so something deleted today can survive in a backup for up to two weeks before it is gone for good.
Measurement: 30 days in your browser, 90 days on our side, or until you ask, whichever comes first. Google keeps analytics data for two months, the retention period set in our Google Analytics account.
Access and portability. Your profile has a download that gives you your account, workspaces, projects, tasks, tracked time, clients, tags and invoices in full, as a JSON file. If you are a collaborator in someone else's workspace, you get your own contributions, not theirs.
Correction. Your name, email, language and password are editable in the app.
Erasure. Your profile closes your account immediately and permanently. It removes you, and removes any workspace you were the only member of. If you own a workspace other people still work in, the button refuses, because deleting their work on your way out would not be right. That is not our final answer: write to us and we will erase you without destroying their records.
You can also ask us to restrict processing, object to processing based on our legitimate interest, or withdraw a consent you gave. Some rights have conditions; where one applies we will tell you which and why.
We answer within one month. If a request is genuinely complicated we may take up to two more months, and we will tell you within the first month if so. It costs nothing.
Write to info@minuaeg.ee. We answer to the address on the account, and we will not ask for a copy of your passport by reflex.
If you think we have handled your data badly, you can complain to Andmekaitse Inspektsioon (the Estonian Data Protection Inspectorate), www.aki.ee, or go to court. You do not have to come to us first, although we would rather you did.
Traffic is encrypted in transit. Passwords and API tokens are stored only as hashes. Backups are encrypted before they leave the server. Uploaded files and captured pages are served only through links that expire. The service sends strict security headers and limits what any page may load.
No system is perfect. If something happens that is likely to put your rights at risk, we will notify the Estonian Data Protection Inspectorate within 72 hours of finding out, and tell you directly where the risk to you is high.
If this policy changes in a way that matters, we will say so in the app rather than quietly editing the page, and the date at the top will change. If we ever want to use your data for a new purpose that needs consent, we will ask first.