Combinado
Privacy policy
Combinado · version 2.0 · effective 2026-10-02
The essentials
You can use Combinado without an account. Without an account, the jobs, people, addresses, amounts, notes and payments you record stay only on your phone: Starthrop Dynamics does not receive or keep them.
If you create an account (it’s optional), we keep a copy of that data on Combinado’s servers in the European Union (Frankfurt, Germany), so you can sync it between phones and get it back if you change or lose your phone.
With or without an account, and only if you agree, the app sends anonymous usage statistics (for example, “job created”), with no identifier at all and nothing you type. You can change your mind in Settings › “Anonymous usage statistics”.
Combinado shows no ads, does no tracking, does not use your location, and does not sell or share your data for commercial purposes.
Who is responsible
Starthrop Dynamics, Unipessoal Lda., tax number (NIPC) 519488261, registered office Rua da Sociedade, n.º 4, 2695-567 São João da Talha, Portugal. Contact: support@starthrop.com.
Anonymous usage statistics
To understand which parts of the app are used and what to improve, the app records a few actions from a closed list: account created, activity created, job created, job started, job finished, payment recorded, reminder opened, subscription screen shown, purchase completed, purchase restored and export used.
Each record carries only the name of the action, the day (without the time), the app version and the platform (iOS or Android). Some also carry one of a few fixed options: whether the job was scheduled or started on the spot; the pricing type (hourly, fixed, daily, weekly, monthly or no price); whether you were paid in full, in part or not at all; the payment type (full or partial); why the subscription screen was shown; and the export format (CSV or JSON).
They never carry names, contact details, addresses, notes, anything you type, money amounts, your location, the advertising identifier or any identifier of you, your account, your phone or your installation. That is why two records cannot be linked to each other or to you.
Records wait in a queue in the app’s memory (they are not saved on your phone) and are sent in batches to Combinado’s server, which rejects anything not on the list and stores the arrival time rounded to the hour. To prevent abuse, the server uses the IP address the batch comes from at that moment, as an irreversible hash (HMAC) that is not kept with the records and is deleted within 24 hours; the IP address itself is not stored.
The app asks you, the first time you use it on each phone, whether to turn them on; until you say yes, it sends nothing. If you turn them off, the app stops recording and discards anything still in the queue. The legal basis is your consent (Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive), which you can withdraw at any time in Settings without affecting what was already sent.
Records are deleted after 180 days. Because they identify no one, we cannot find, show or delete the records of any particular person.
Your account (optional)
You sign in with your email and a 6-digit code we send you; there is no password. The code expires after 10 minutes and is stored only in hashed form.
We ask for your full name and phone number. Address, postal code, city and country are optional.
For security, we keep the email address and IP address of each code request for no more than 24 hours, to limit attempts.
The legal basis is the performance of a contract (Article 6(1)(b) GDPR): it is the service you ask for when you create the account.
What we keep when you have an account
Your profile: email, name, phone number and, if you fill it in, your address.
What you record in the app: activities, jobs, dates, hours, prices and currency, agreements and charges, payments, the people you work for and their contact details (name, phone, email and address), notes and your preferences (language, currency and reminders).
Technical data: a random identifier for each phone linked to the account, the platform, the date it was last used, and your sessions (stored only in hashed form).
Everything is encrypted in transit (TLS) and can only be accessed with a session of your account.
Other people’s data (your clients)
The contact details of the people you work for are yours. They leave your phone only if you have an account, and only so you can have them on another phone. We don’t use them for anything else and never contact them.
Record only what you need for your work. Combinado does not ask for tax numbers, documents, nationality or health data; please don’t put health information or other sensitive data in your notes.
Purchases and subscription
These are handled by Apple (App Store) or Google (Google Play) under each store’s policies. To link the purchase, the app gives the store a random technical identifier (your account’s, if you have an account; otherwise, this installation’s) that contains neither your email nor any other personal data.
With an account, the app sends our server the proof of purchase the store gives it; the server confirms it with Apple or Google and links the subscription to your account. We keep the product, its status, its end date and the store’s transaction reference. The stores also notify our server when a subscription changes; we keep those notices for 180 days, without any email or name.
Starthrop receives aggregated sales reports from the stores.
Reminders, Directions and copies
Reminders (upcoming job, agreed payment, overdue payment) are scheduled on the phone itself. Starthrop sends no notifications.
If you tap “Directions”, the app opens Google Maps or Apple Maps with the addresses you chose. From then on, that service’s policy applies. Combinado does not use your location.
Your system backup (iCloud or Google) may include the app’s data, under your account’s control. Exports (CSV and JSON) go wherever you choose.
Who helps us
Render (Render Services, Inc.): hosting for the server and database, in the Frankfurt (Germany) region.
Google (Google Workspace): sending the email with your sign-in code.
Apple and Google: verifying purchases and subscription status. Google Play’s subscription notices reach our server through Google Cloud (Pub/Sub).
They process data on our behalf, on our instructions and under contract. Where a provider is based outside the European Union, the transfer is covered by the safeguards set out in the GDPR, such as the European Commission’s standard contractual clauses.
How long we keep it
Anonymous usage statistics: 180 days.
Sign-in codes and request-limit records (email and IP address): up to 24 hours.
Account data and what you sync: for as long as the account exists. Sessions end when you sign out, when you delete the account, or after 180 days without use.
Store notices about your subscription: 180 days, without contact details.
When you delete your account, we immediately delete the account and all cloud data; our provider’s backups are gone within 3 days. All that remains is a record, with no personal data, that the deletion happened.
Your rights
Without an account, your data is only on your phone and you control it: you delete everything in Settings › “Delete data on this phone”, or by uninstalling the app.
With an account, Settings › “Delete account and cloud data” deletes the account and everything in the cloud and ends your sessions; your phone keeps its data until you delete it. Settings › “Export everything” gives you a full copy, and you can correct your profile and records in the app itself.
You can also request account deletion at starthrop.com/en/combinado/delete-account/, and exercise your rights of access, rectification, erasure, restriction, portability and objection, by writing to support@starthrop.com from your account’s email address.
You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD).
Who it is for
Adults recording their own work.
Changes
If this policy changes, we will publish the new version here with the date it takes effect. Version 2.0 replaces version 1.0 of October 1, 2026, which described the app without an account or statistics; email us if you need a copy.