Hours Booster 2

Privacy policy

Deutsche Fassung

This policy describes which personal data is processed when you visit hoursbooster.com, buy a licence and use the Hours Booster 2 app, for what purpose, on what legal basis and for how long. Last updated: 11 September 2026.

1. Controller

The operator of hoursbooster.com (Hours Booster 2), a sole trader, Germany
Email: support@hoursbooster.com
Name and postal address: on request, see the Legal notice

No data protection officer has been appointed; the requirements of Section 38 of the German Federal Data Protection Act (BDSG) are not met.

2. The principle of this website

No analytics services, no advertising networks and no tracking pixels are used. No fonts and no scripts are loaded from third-party servers; all fonts, images and scripts are hosted on this server. No cookies are set on the public pages. For payment you are redirected to a page run by Stripe – no Stripe script is embedded in this website (see section 5). Visitor numbers are counted by us on this server – without cookies, without third-party services and without storing anything on your device (section 3).

Only the non-public administration area (/admin, used exclusively by the operator) sets two technically necessary session cookies for signing in and, if the operator chooses so there, one more cookie that leaves the operator's own browser out of the visitor count. Visitors to the sales pages do not receive these cookies.

3. Visiting this website (server logs)

On every request the web server processes the connection data that is technically necessary: IP address, date and time, the address requested, the HTTP status code, the amount of data transferred, the referring page and the browser identifier. The purpose is to deliver the page, to find errors and to fend off attacks; the legal basis is Art. 6(1)(f) GDPR (secure, uninterrupted operation). The logs are rotated automatically and deleted after 14 days.

Application log of the licence server. In addition, the licence server keeps its own log of its operation: the time and type of important events, and error messages. This log includes personal data: the IP address from which a payment page was requested; the IP address on failed sign-in attempts to the administration area and on support messages rejected by the spam protection; the email address when a support request comes in, when a licence is issued or deleted and when an email could not be sent; and order numbers, ticket numbers, licence IDs, payment identifiers and device IDs. The purpose is running the server, analysing errors and security, for example detecting attacks on the administration area; the legal basis is Art. 6(1)(f) GDPR. The log is deleted automatically after 14 days.

Visitor counting without cookies. So that we know whether and in which languages the website is used, the server counts per day: the views of each page and the page's language, the clicks on “Download” and “Buy”, the number of visitors, and the domain of the website a visit came from (only the domain, such as “reddit.com”, never the full address). To count each visitor only once a day, the server derives a hash value (SHA-256) from the IP address, the browser identifier and a random secret that is generated afresh every day. The IP address is not stored for this. The hash value is deleted together with the secret within an hour after the end of the day and cannot be linked to anyone without that secret; the daily numbers themselves contain no personal data. No cookies are set, nothing is stored on or read from your device, and no analytics provider is involved. Requests from search engines and programs are not counted, based on the browser identifier; the addresses from which the operator signs in to the administration area are remembered by the server for 30 days so that the operator's own visits are not counted. The legal basis is Art. 6(1)(f) GDPR (our interest in knowing whether and how the website is used).

Which language version you see is decided by the server based on the language preference your browser sends with the request (Accept-Language). This information is only evaluated for the redirect and is not stored.

4. Hosting

The website and the licence server run on a rented server of a German hosting provider; we name the provider on request. The server is located in Germany; all data that we store ourselves under this policy is kept there, except the emails in our mailbox (section 7).

5. Purchase and payment via Stripe

For payment we use the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe Payments Europe works together with other companies of the Stripe group, in particular with Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA.

When you click the buy button on the price card (“Buy” on the English site), we create a payment session with Stripe and redirect you to checkout.stripe.com. This payment page is a page run by Stripe, not by us. There you enter your email address, your billing address and your payment details. When creating the payment session we send Stripe only the product, the language, a random order reference and the wording of the declaration on the right of withdrawal (section 6), but no data about you. Your full card number and security code never reach our server; payment details are collected and processed by Stripe alone. After payment Stripe sends our server the payment session with your customer details (email address, name, billing address), and in the case of a refund or chargeback also payment information such as the card type, the last four digits and the expiry date of the card. Of this we use and store only your email address, which we need to issue and send the licence key, together with the amount, the currency and the identifier of the payment. After payment you yourself return to our thank-you page, which shows the licence key.

Categories of data processed: name, billing address, email address, payment details, IP address, language of the order, purchase amount and the identifiers of the payment session and of the payment at Stripe. Name, billing address and payment details are collected by Stripe on its payment page. Name and billing address are held in our Stripe account and serve payment processing and tax records. In our own database we store neither your name nor your billing address nor any payment details. Without an email address and payment the purchase cannot be completed and no licence key can be issued; the billing address is a required field on Stripe's payment page.

Legal bases: Art. 6(1)(b) GDPR for processing the payment and delivering the licence key; Art. 6(1)(f) GDPR for detecting and preventing fraud and abuse (our own interest and Stripe's interest in a secure payment); Art. 6(1)(c) GDPR in conjunction with Section 147 of the German Fiscal Code (AO) and the GoBD (the German principles for keeping books and records in electronic form) for retaining the payment record.

For payment processing and fraud prevention Stripe acts as an independent controller under the GDPR; details can be found in Stripe's privacy policy at stripe.com/privacy.

Transfer to the USA. Through the involvement of Stripe, Inc., data may be transferred to the USA. This is based on the standard contractual clauses of the EU Commission under Art. 46(2)(c) GDPR, which Stripe has incorporated into its data protection terms, and – to the extent that Stripe, Inc. is certified under the EU-US Data Privacy Framework – on the adequacy decision of the EU Commission of 10 July 2023. Despite these safeguards, access to the transferred data by US authorities cannot be completely ruled out.

For each order we store a record ourselves. It is created as soon as you click the buy button and we create the payment page with Stripe, and it contains: the identifiers of the payment session and of the payment at Stripe, the time of creation and of the last change, the status of the order, the language, the IP address from which the order was placed, amount and currency, your email address (once Stripe tells us after payment), the licence ID issued, whether and when the licence email was sent and how many sending attempts were made, the proof of your declaration on the right of withdrawal (section 6) and an internal note on the status of the order (for example on a refund or chargeback). If no payment is made, the record is deleted automatically 30 days after it was created (section 12).

The notifications Stripe sends us about a payment, a refund or a chargeback are stored with their identifier, type, time of receipt, the related payment session and the result of processing, so that the same notification is not processed twice. Processed notifications are deleted automatically 180 days after their receipt (section 12).

6. Proof of your declaration on the right of withdrawal

Because Hours Booster 2 is digital content that is provided immediately after payment, you make a declaration during the order process: that you expressly request immediate performance and confirm that you thereby lose your right of withdrawal. Stripe displays the wording of this declaration on its payment page right at the pay button; by paying you make it. As proof we store, together with the order, the time the payment page was created, the IP address, the language and a fingerprint of the wording, not the text itself. Our server computes this fingerprint (the SHA-256 hash) from exactly the text it hands to Stripe for your order to show on the payment page.

Every licence email for an order – including one we send late or resend – contains your order details (order number, date, price), the wording of the declaration Stripe shows at the pay button, the withdrawal instructions with the model withdrawal form and the terms and conditions.

The purpose is to prove that the declaration was made and which wording was shown to you; in a dispute we have to prove this (Section 356(5) of the German Civil Code (BGB)). The legal basis is Art. 6(1)(f) GDPR (proof in the event of a dispute). The proof is kept with the order record and deleted with it (section 12).

7. Licence key and email

For each licence we store the licence ID, your email address, the licence key, the date of issue, the order number, an internal note (for example the purchase price) and, if the licence has been revoked, that status. The purpose is delivery, proof of your purchase, resending the key on request and revoking it after a refund or chargeback; the legal basis is Art. 6(1)(b) GDPR.

After payment we send the key by email to the address you entered on Stripe's payment page. The email is sent from a mailbox at a German email provider (name on request), whose mail server in Germany delivers it. Your replies to our emails and the server's notifications about support requests and chargebacks also arrive in this mailbox and are stored there. There is no newsletter, and your address is not used for advertising.

8. Devices and activations

A licence is valid for one active PC at a time. So that this can be checked, the licence server keeps a register of devices and activations. The following is stored: a device ID calculated from the public key of the respective installation (the first 16 characters of the SHA-256 hash – it contains no hardware characteristics and cannot be traced back to your PC), this public key, a freely chosen device name, first and last contact, the IP address last seen, the program version and, for each activation, the time, the IP address and which earlier activation it replaced.

The purpose is to perform the licence agreement (one active PC) and to detect unauthorised sharing of keys; the legal bases are Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR. Steam accounts, game names or playing times are neither transmitted nor stored in the process.

9. Support form

If you use the support form, we store the ticket number, name (optional), email address, category, subject, your message, a licence ID if you provide one, the language, the IP address and our replies. The purpose is to handle your request; the legal bases are Art. 6(1)(b) GDPR (requests about the contract) and Art. 6(1)(f) GDPR (general requests, protection against abuse). Tickets are deleted automatically 24 months after their last activity (section 12).

10. The Hours Booster 2 app

The app connects to Steam (Valve Corporation) to report the selected games as “playing”. If you use Direct mode, Steam login details are stored only in encrypted form on your own PC and are transmitted only to Steam; we never receive them, and they never leave your PC in our direction.

In addition, the app asks this server whether a new version is available and whether your licence key is still valid. The following is transmitted: on activation, the licence key (it contains the licence ID and your email address), the public key and the name of the device, and the program version; during the regular licence checks and when a session ends, the licence ID, the device ID and the program version; for the update check, only the program version; and – as with every internet connection – your IP address. Your Steam account is not transmitted. The legal basis is Art. 6(1)(b) GDPR; for updates additionally Art. 6(1)(c) GDPR in conjunction with Section 327f BGB.

So that the app keeps running without a connection to the licence server, also after a restart, it stores the server's last approval in encrypted form on your PC: licence ID, device ID and expiry time (at most 14 days). This file stays on your PC and is deleted when you remove the licence.

11. Recipients

Apart from the following, nobody receives your data – in particular, it is not sold and not passed on for advertising:

  • our hosting provider in Germany (hosting; name on request)
  • our email provider in Germany (sending email and mailbox; name on request)
  • Stripe Payments Europe, Ltd. and Stripe, Inc. (payment processing and fraud prevention, as an independent controller)
  • Tax advisor and tax office, where required by law

12. Storage periods

  • Web server logs and the licence server's application log: 14 days.
  • Visitor counting: the daily numbers (page views, visitors, clicks, languages, referring domains) permanently, as they contain no personal data; the daily counting hash until the end of its day, at the latest one hour after.
  • Order record and payment record of a paid order, including the proof of your declaration on the right of withdrawal contained in it: 8 years from the end of the calendar year of the order (Section 147(1) no. 4 and (3) AO, Section 14b of the German VAT Act (UStG), GoBD).
  • Order record of an order that was never paid (for example because you left the payment page, it expired or the payment failed): 30 days after it was created, then deleted automatically.
  • Licence ID, email address and licence key: for as long as the licence exists – it is a lifetime licence – so that the key can be proven and resent.
  • Devices and activations: for as long as the licence exists; on request we reset the device list of a licence, which deletes the old entries.
  • Support tickets: 24 months after their last activity – creation, reply or status change, whichever is latest – then deleted automatically.
  • Emails in our mailbox: up to 24 months after the matter is closed, then deleted.
  • Stripe notifications: 180 days after receipt, then processed notifications are deleted automatically. Notifications whose processing failed are not deleted automatically but are kept so that the error can be resolved.

The automatic deletions in the licence server's database (orders that were never paid, support tickets, Stripe notifications) run when the server starts and then once a day.

13. Deletion and statutory retention

Deletion under Art. 17 GDPR can conflict with retention obligations under tax law. Where we must retain data under Section 147 AO or Section 14b UStG, we may not and cannot delete it (Art. 17(3)(b) GDPR). In that case we instead block the data from any further use: it is kept only to meet the retention obligation and to defend or enforce claims, and it is deleted when the period ends. Everything that is not subject to retention – such as device entries, tickets or the use of your address for resending a key – we delete immediately on request. The consequence of such a deletion is that a licence key can no longer be assigned to you and can no longer be resent.

14. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Simply write to us at support@hoursbooster.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). We name the authority responsible for us on request; you may also turn to the supervisory authority of your place of residence.

15. No automated decisions about you

We make no automated decisions within the meaning of Art. 22 GDPR and create no profiles. Stripe checks payments automatically for fraud risks and may therefore decline a payment. Once payment is confirmed, we issue the licence automatically. Whether a refund is made and whether a licence is revoked after a chargeback is decided by a person; after a full refund the licence is revoked automatically.

16. Changes

If the processing changes – for example because another service provider is added – we will change this policy and update the date at the top. For a purchase in progress, the version that was available at the time of purchase applies.