Last updated: 11 October 2026
Ontime: Appointments & Clients ("Ontime") is an app for independent practices and small businesses to manage appointments, client records and invoices, and to accept booking requests online. This policy explains what information Ontime handles, why, and what choices you have.
Who is responsible
Ontime is provided by Asil Erguner, an individual developer ("we", "us"). Contact: contact@asilerguner.com · asilerguner.com.
There are two groups of people whose information Ontime handles:
- Business users (the people who use the app). For their account information we are the data controller.
- The business's clients and people who book online. The business that uses Ontime decides what to record about its clients and is the data controller for that information. We process it on the business's behalf, only to provide the app.
What we handle
| Information | Why |
|---|---|
| Account: name, email address, and the sign-in method you choose (Apple, Google, or email and password). We receive an account identifier from your sign-in provider. | To sign you in and sync your business between your devices and team. |
| Business data you enter: business name, services, working hours, appointments, clients (name, phone, email, notes), invoices and payment records, message templates. | To provide the app's features. This data is stored on your device. If you sign in, it is also stored in the cloud so your devices and team can share it. |
| Clinical or session notes: if you use them. | Stay on your device by default. They are uploaded only if you switch on note sync for your business. |
| Online booking requests: when someone uses a business's booking page, the name, email address (required), phone (optional), optional note, the time they choose and the page language. | To deliver the request to the business and to email the customer about it. The booking page is public, so anyone with the link can send a request. The person gets a private link to see the status of their own request. |
| Automatic emails to customers: the customer's email address, name and appointment details are passed to our mail relay (on Cloudflare), which hands the message to the email service Resend. The relay keeps a one-way hash of the address and a marker that the email was sent, for up to 40 days. If the business entered a reply-to address, it is published with the booking data and used as the reply address. | To send the receipt, the confirmation or the decline for a booking request, in the language of the booking page. The relay reads the details from the request itself, not from whoever asks. Each message says who it is sent on behalf of and why you receive it. |
| Automatic booking: if the business turns on automatic confirmation, a short-lived lock on the chosen time, tagged with the request number. | To make sure two customers cannot get the same time. A lock is ignored after 12 hours and is deleted with the business. |
| Technical data: notification permission and an app badge count, stored on your device. | To tell you about new booking requests and reminders. Notifications are created on your device and contain no client details. |
| Push notification token: if you turn on booking alerts, your device's push token and your business identifier. | To send you a notification when someone asks to book. They are kept on Cloudflare (our push relay) and passed to Apple's push service. The notification contains no customer details. You can turn this off in More › Online booking, which removes the token from the relay. |
Ontime does not use advertising, does not track you across other companies' apps or websites, and does not sell personal information. Ontime does not store payment card numbers and does not process card payments. We do not use third-party analytics or advertising tools.
Where information is stored
Cloud data is stored with Google Firebase (Cloud Firestore and Firebase Authentication) in the European Union. Google acts as our processor. Customer emails are delivered through Resend, an email delivery service that acts as our processor; the message may pass through servers outside the EU. The mail relay runs on Cloudflare. Sign in with Apple and Google Sign-In are provided by Apple and Google under their own privacy policies. The website, including the booking page, is hosted on Firebase Hosting.
Messages and reminders
When you send a reminder or confirmation, Ontime prepares the text and opens Messages or Mail on your device. You review and send it yourself, from your own number or address. We do not send those messages on your behalf, and we do not receive them. The only messages Ontime sends itself are the booking emails described above, which come from an Ontime address on behalf of the business.
Sharing
We share information only with the service providers above, as needed to run the app, and where the law requires it. Members of a business team can see the business data their role allows.
How long we keep it
We keep cloud data for as long as the business account exists. When a business owner erases a business in the app, that business's data is deleted from the cloud. When an account is deleted, its sign-in information is removed. Backups made by Google may persist for a short period before they are overwritten. Booking requests remain until the business deletes them or erases the business. The mail relay keeps its counters and sent-markers for at most 40 days.
Your choices and rights
- Export: a business owner can export all of the business's data in the app (Settings, Export all data).
- Delete: erase a business and delete your account inside the app. You can also write to us.
- Your rights: if you are in the EU or UK you can ask for access, correction, deletion, restriction or portability of your personal information, and you can object to its processing. If you are a client of a business that uses Ontime, please contact that business first; we will help them respond. You also have the right to complain to your data protection authority, for example the Swedish Authority for Privacy Protection (IMY).
Security
Data is encrypted in transit and stored with Google Firebase, with access rules that limit each business's data to its own members. The app can require Face ID or a passcode. No system is perfectly secure, so please use a strong password and keep your device updated.
Children
Ontime is a business tool and is not directed at children. We do not knowingly collect personal information from children for our own purposes.
Changes
If we change this policy, we will update the date above and, for significant changes, tell you in the app.
Contact
Questions or requests: contact@asilerguner.com
If you use the contact form on our support page, your name, email address and message are sent by email to us through Cloudflare. We use them only to reply to you. The form does not store them on the website.