- You can use Pomotoro without an account. Your tasks and stats then stay in your own browser and never reach us.
- If you create an account, your email, name and focus data are stored so they can sync between your devices.
- No advertising, analytics or tracking cookies. We don't sell your data or use it for ads.
- You can delete your account and all of its data at any time from inside the app.
1. Who is responsible
The data controller for Pomotoro (the "Site") is Furkan KOÇYİĞİT, based in Türkiye. This policy is provided under the EU General Data Protection Regulation ("GDPR") and Türkiye's Law No. 6698 on the Protection of Personal Data ("KVKK").
Contact: furkankcygt20@gmail.com
2. What we process
| Identity and contact | Your email address and, optionally, your name. If you sign in with Google: the name, email and profile picture link that Google shares with us. |
|---|---|
| Account security | Your password. We never see it in plain text; only an irreversible hash is stored. |
| App data | Your tasks (title and note), the start/end time and length of your focus sessions, the theme selected during a session, your settings, daily goal, themes unlocked with coins, streak freezes you've bought and coin records. |
| Security logs | Sign-in/sign-out times, IP address and browser details, logged automatically by our service providers for security. |
| Weekly leaderboard (optional) | Only if you tap "Join" in the Report and confirm: your account name, the preset avatar you picked in your Profile and your pomodoro count each week are shown to signed-in users. Visitors who aren't signed in only see ranks and counts; names and avatars are hidden. Your email and other data are never shown. |
| Feedback | The message you send from Settings → Help, its type (bug/idea/other), the email address you optionally leave, your language, current theme and browser details. If you have an account, the message is linked to it. |
When you delete your account, the optional "why are you leaving?" answer and note are stored anonymously, without any link to your account or email. Please don't put personal details in that note.
3. Why we process it and on what legal basis
- Creating your account, signing you in and syncing your data: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c).
- Confirmation and password reset emails: performance of a contract (Art. 6(1)(b); KVKK 5/2-c).
- Keeping the service secure, preventing abuse and fixing bugs: our legitimate interests (Art. 6(1)(f); KVKK 5/2-f).
- Showing your name and pomodoro count on the weekly leaderboard: your consent (Art. 6(1)(a); KVKK 5/1). Joining is optional and asks for a separate confirmation. To keep the leaderboard fair (no last-minute leaving and rejoining) there is no leave button in the app, but you can still withdraw your consent at any time: email furkankcygt20@gmail.com from your account's address or delete your account. We act on it within a few days and your name is removed from the list.
- Reading and answering your feedback and fixing bugs: our legitimate interests (Art. 6(1)(f); KVKK 5/2-f).
- Answering your requests and meeting legal obligations: legal obligation (Art. 6(1)(c); KVKK 5/2-ç).
We don't use your data for advertising, profiling or marketing, and we never sell it.
4. Who we share it with
Only as far as needed to run the service:
- Supabase Inc.: database and authentication. Your data is stored on Supabase servers in Frankfurt, Germany (EU).
- Google LLC: only if you choose "Continue with Google", to verify your identity.
- Hosting provider: to deliver the website; standard server logs (IP address, browser details).
- Email delivery service: to send confirmation and password reset emails.
- Public authorities: only where required by law.
Our providers may access data from outside the EU (for example Supabase Inc. and Google LLC in the United States). Such transfers are covered by the safeguards those providers offer, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
5. How long we keep it
- Account and app data are kept for as long as your account exists.
- When you choose "Delete account", your account and all synced data are deleted immediately and permanently. Providers' security logs and backups are removed when their short retention periods end.
- Feedback is kept for at most one year after it has been handled. If you delete your account, its link to your messages is removed and any contact email you left is deleted.
- Without an account, data stays only in your browser; clearing your browser data deletes it.
6. Your rights
You have the right to:
- access your personal data and get a copy of it,
- have inaccurate data corrected,
- have your data erased,
- restrict or object to processing based on legitimate interests,
- receive your data in a portable format,
- lodge a complaint with a supervisory authority: the data protection authority in your EU country, or in Türkiye the Personal Data Protection Board (KVKK Art. 11 and 14).
You can do much of this yourself: Settings → Data → Export downloads all your data as a file, and Account menu → Delete account erases it. For anything else, email furkankcygt20@gmail.com from the address registered to your account. We reply free of charge within 30 days.
7. Cookies and browser storage
Pomotoro does not use cookies. Your preferences (language, theme, volume), timer state, which notices you have seen (such as achievements or the support note), guest tasks and stats and, if you're signed in, your session token are kept in your browser's local storage. This is strictly necessary for the site to work and is never used for ads or tracking. If we ever add analytics or ads, we'll update this policy and ask for your consent first where required.
8. Other features
- Voice input: if you tap the microphone while adding a task, your browser's own speech recognition service is used (in Chrome, for example, audio is sent to Google to be transcribed). We never receive the audio, only the resulting text.
- Notifications: if you allow them, a browser notification appears when a session ends. It's created on your device; nothing is sent to us.
- Support link: the "Support" link in My coins takes you to Buy Me a Coffee. Nothing is sent to that site unless you click the link; once you do, what happens there is covered by that site's own privacy policy.
- Children: Using Pomotoro without an account is suitable for all ages; your data then stays only in your browser. Anyone under 18 should get permission from a parent or guardian before creating an account or joining the leaderboard.
- Security: all connections are encrypted (HTTPS), and each user can only read and change their own data (row-level security).
9. Changes
We may update this policy. The current version and its last-updated date are always on this page.