Your plans never touch our servers.

The short version

• Your projects, people and settings are files on your computer.
• Humpback sends data out only when you press Sync, share or export something yourself.
• Sync goes from your computer to your own Google account. Nothing passes through us.
• We have no server and no database. We don’t collect usage data, analytics or crash reports.
• We never sell data, use it for advertising, or use it to train AI models.

Who is responsible

Humpback is made by Nicolò Zorzetto, an individual based in Italy. Contact: privacy@humpbacksystems.com.

When a company uses Humpback to plan its people’s work, that company decides what goes in and is responsible for it (under the GDPR, it is the controller). Humpback never receives that data, so we can’t see, correct or delete it. If you are scheduled through Humpback and have a question about your data, ask the organization that schedules you.

We are responsible only for what reaches us directly: emails you send us, and the technical data needed to serve this website (see below).

Where your data lives

Everything Humpback works with stays in the app’s data folder and the project files on your computer:

• Projects: tasks, dependencies, schedules, notes, and the people assigned.
• People: name, email (optional), color, working hours, and their calendar’s sharing status.
• Your Google connection: the sign-in token and your Google account’s email address, in a file in the app’s data folder. It is not encrypted separately, so it is protected the way the rest of your user account is. Anyone who can use your computer as you can use it.
• Your identity as a manager: a display name and a random ID, used to label your events and journal entries.

There is no Humpback cloud copy of any of it. Back up, move or delete these files as you would any others.

What leaves your computer, and when

Editing a plan never sends anything. Without a Google connection, nothing leaves your computer except the files you choose to share.

What Humpback can do with your Google account

When you connect, Google asks you to allow these permissions.

When the email permission is requested, Google also adds a standard sign-in identifier (openid) by itself. Humpback doesn’t use it.

Humpback’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice:

• Google data is used only to show you your schedule and keep your team’s calendars up to date.
• It never leaves your computer except back to Google, as part of a feature you used.
• Nobody at Humpback can read it, because it never reaches us.
• It is never sold, used for advertising, or used to train AI models.

What the people you schedule see

• A calendar in their Google Calendar called Humpback — [their name], shared read-only. It holds only their own work: one event per working day, with the task notes, the project name and your name.
• An invitation email, if you use the optional calendar test. Google sends them a short test invitation from your account and asks them to accept it. Once it’s accepted, the test event is deleted.
• Sharing by link (only if you choose it). If someone has no email address, you can share their calendar by link instead. Anyone who has that link can see that calendar, so send it only to that person. Reset link replaces the calendar with a new one, and the old link stops working. The app marks every calendar shared this way as Shared by link.
• WhatsApp. If you use the WhatsApp button, the message with the link is sent by your phone’s WhatsApp, not by Humpback.

Shared journals

A journal lets managers of different projects see when someone is already booked. It is a single file in a folder you choose, such as a shared Drive, Dropbox or OneDrive folder. Anyone who can open that folder can read the journal.

Whoever creates a journal decides, once and permanently:

• whether project and manager names are written into it;
• whether it is password-protected. Protected journals are encrypted with AES-256-GCM.

A journal created without names never contains them. Humpback never sees journals. They are copied between computers by your own cloud-folder service.

Files you export

• Project hand-off file: the whole project, including people’s names and emails and the IDs of their Google calendars. Your Google sign-in is never included.
• Organization file: the people you tick, their working hours and groups. If you include calendars, which is on by default, it also contains your Google account’s email address.
• Manager identity file: your display name and ID.

Each file can be protected with a password. It is then encrypted with AES-256-GCM, using a key derived from the password. Once you send a file, it is in the hands of whoever receives it.

Leaving cleanly

• Disconnect (Settings → Account) asks Google to revoke Humpback’s access and deletes the sign-in from your computer. If Google can’t be reached, the app tells you, and you can remove Humpback from your Google Account’s connections yourself. You can also choose to delete every event Humpback ever published, in the same step. The calendars and their sharing stay in your Google account, where you can delete them. Until you do, the people they’re shared with keep seeing them.
• Hand off a project: releases its bookings in your journals, removes the events it published, and gives you a file for the next manager. Without a Google connection, the app asks you before handing off with the events left in place.
• Uninstall: delete the app and its data folder, and your project files. Nothing of yours remains with us, because nothing was ever with us.

This website

humpbacksystems.com is hosted by Cloudflare. To deliver the pages and protect the site, Cloudflare processes your IP address and basic request data. We don’t keep logs ourselves. The site uses no cookies, no analytics and no trackers, and loads nothing from other websites.

Emails to us

If you write to us, we use your email address and message to reply and follow up.

• Where they are stored: Our email is hosted by Fastmail (Fastmail Pty Ltd, Australia). Messages are stored in the EU (Amsterdam), with replicas, backups and logs in the United States.
• How long we keep them: We delete them within 24 months of our last exchange, unless the law requires us to keep them longer (for example, emails about invoices).
• Legal basis: answering your request (GDPR art. 6(1)(b)) and our legitimate interest in keeping a record of our correspondence (art. 6(1)(f)).

Cloudflare and Fastmail may process this data outside the EU, including in the United States and Australia. Cloudflare takes part in the EU–US Data Privacy Framework; Fastmail uses the European Commission’s Standard Contractual Clauses.

Your rights

For the data we hold about you (your emails to us), you can ask us to:

• give you access to it;
• correct it;
• delete it;
• restrict how we use it;
• export it;
• stop using it (you can object).

Write to privacy@humpbacksystems.com. We answer within one month.

If you think we’ve handled your data wrongly, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority where you live.

For data inside Humpback (projects, people, calendars), contact the organization that uses the app. We don’t have that data.

Children

Humpback is a tool for businesses and isn’t directed at children.

When this changes

Humpback has no server today. We plan to add one for licensing and billing. Before it goes live, this page will say exactly what it stores, and your plans, people, calendars and journals will still never reach it. When this page changes, the date at the top changes too. Significant changes will also be announced in the app.