Privacy Policy

Last updated: October 16, 2026

1. Introduction

POMODIARY LLC ("we," "our," or "the Company") operates the Pomodoro Diary App and is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our app or services.

It covers the Pomodoro Diary apps for iOS and Android and the website at pomodorodiary.com (together, "the Service").

2. Information We Collect

We follow the principle of data minimization and only collect information needed to provide the Service:

  • Account information (only if you create an account)

    • Your email address and display name
    • Your password, which is stored only in hashed form, if you sign in with email and password
    • If you sign in with Google: your Google account identifier, name, email address, and profile photo (if any)
    • If you use Sign in with Apple (iOS app): your Apple user identifier and the email address Apple shares with us, which may be a private relay address

  • Your records

    • Tasks and habits, categories, check-ins, pomodoro and timer sessions with their times, notes you write, and your settings
    • These are stored on your device (in the app) or in your browser's local storage (on the website when you are not signed in). When you sign in, they are synced to our servers so they can be shared across your devices.
    • If you use cloud backup in the app, a copy of your app database is uploaded to our storage.

  • Purchase information

    • Your plan, purchase and subscription status, product identifiers, transaction or order identifiers, purchase tokens, and validity dates, needed to confirm and restore Pro access. Website payments are processed by Stripe and app purchases by the App Store or Google Play; we do not receive or store full card details.

  • Usage and technical information

    • IP address, browser or operating system type, device model, app version, and the store or channel the app was installed from
    • Pages and screens viewed, feature usage events, and crash reports, collected through the analytics and crash-reporting services listed in Section 4

  • Messages you send us, such as support emails.

We do not request sensitive personal information that the Service does not need. We do not send your account email or your records to analytics services.

3. How We Use Your Information

We use the information we collect to:

  • Provide the timer, habit, record, and statistics features
  • Sync your data across your devices and keep cloud backups you create
  • Create and secure your account and keep you signed in
  • Process purchases, confirm payment status, and restore Pro access
  • Send service emails, such as password reset and email verification messages
  • Understand how the Service is used, measure the website, and fix crashes and bugs
  • Verify app integrity, prevent abuse, and keep the Service secure
  • Respond to your questions and requests

We do not sell your personal information. We do not use your information to train AI models, and the Service has no AI features.

4. Where Your Data Is Stored and Who Processes It

We use the following service providers. Each receives only the information it needs for its function and handles it under its own privacy policy:

  • Cloudflare: runs the website and our APIs (Cloudflare Workers) and stores synced records, cloud backups, and backup snapshots (Durable Objects and R2 storage)
  • A cloud server we operate: hosts our PostgreSQL database for accounts, sign-in sessions, purchase records, and backup records; Cloudflare Hyperdrive connects to it
  • Stripe: processes website payments and subscriptions
  • Apple (App Store) and Google (Google Play): process in-app purchases; we verify purchases with them
  • Google: Google Sign-In; Google Analytics on the website; Firebase Analytics and Firebase Crashlytics in the Android app
  • Apple: Sign in with Apple in the iOS app
  • Umeng: usage statistics and crash reporting in Android builds distributed through app stores in mainland China
  • Resend: delivers service emails
  • VibeLoft (vibeloft.ai): a telemetry script loaded on the website, which receives standard technical information from your browser, such as your IP address, browser type, and the page address

Our servers are not located in mainland China: they are provided by cloud providers based outside mainland China, and Cloudflare operates a global network. Your information may therefore be processed in countries or regions other than the one where you live.

WebDAV backup: If you turn on WebDAV backup in the app, backups are sent directly from your device to the WebDAV server you specify. We do not receive these backups. Your WebDAV credentials are stored only on your device.

5. Data Security

We use reasonable technical and organizational measures to protect your information:

  • HTTPS encryption for all data in transit
  • Passwords stored only in hashed form
  • Sign-in tokens in the app stored in the device's secure storage
  • Access to production systems limited to those who need it
  • Backup snapshots and recovery procedures for synced data

No method of transmission or storage is completely secure, but we work to protect your information and fix problems as soon as we find them.

6. Consent and Your Choices

  • When you first open the app, we ask you to read and agree to the Terms of Service and this Privacy Policy. We do not use pre-checked boxes or hidden agreements.
  • You can use the app and the website without an account; your records then stay on your device or in your browser.
  • You can withdraw your consent at any time by stopping use of the Service, signing out, deleting your account, or contacting us.

7. Your Rights

Subject to applicable law, you have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate information
  • Delete your records or your account
  • Export your data
  • Object to or restrict certain processing
  • Withdraw your consent

Export: In the app, open "Settings → Data management" and choose "Export data" to get your records as CSV and JSON files together with the original database file.

Account deletion: In the app, choose "Delete account" on the account page in Settings. The website does not offer account deletion; if you only use the website, email us from your account email address. For any other request, contact us at the address in Section 12. We will respond within a reasonable time.

8. Data Retention and Deletion

We keep your information only as long as needed for the purposes in this policy, generally for as long as your account exists.

When you delete your account, we delete your account, sign-in connections, synced records, and cloud backups from our servers, and we delete your customer record at Stripe. The app also removes that account's local data from the device where you deleted the account. Please note:

  • Deleting your account does not cancel an App Store or Google Play subscription. Cancel it in your store account settings first.
  • If you have an active website subscription, cancel it before deleting your account.
  • Files you exported and backups on your own WebDAV server are not affected.
  • Records kept by Apple, Google, and Stripe about your payments are governed by their own policies.

If you ask us to delete information in any other way, we will handle the request within a reasonable time, unless we must keep certain information to meet legal obligations or resolve disputes.

9. Cookies and Similar Technologies

Website. We use:

  • Necessary cookies and local storage: a sign-in session cookie, a cookie that remembers your language, and local storage for your theme and for records you create while not signed in
  • Google Analytics: Google Analytics cookies (such as _ga and _ga_<ID>) distinguish visitors and sessions so we can measure visits, the pages viewed, approximate location, device and browser type, and actions such as viewing pricing plans. Google processes this information under its own policies; see "How Google uses information from sites or apps that use our services" at policies.google.com/technologies/partner-sites.
  • VibeLoft: the telemetry script described in Section 4

The website does not currently provide an in-page cookie setting. To opt out of Google Analytics, block or delete cookies in your browser settings, or install the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.

App. The app stores your records in a local database, and your settings and sign-in tokens on the device. Firebase Analytics and Crashlytics (Android) and Umeng (Android builds from app stores in mainland China) use app-instance or device identifiers instead of cookies.

The Service does not show ads.

10. Children

The Service is not directed at children. If you are under 14, or under the age at which you can consent to data processing where you live, please use the Service only with the consent of a parent or guardian. If you believe a child has given us personal information without such consent, contact us and we will delete it.

11. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in the Service or legal requirements. For significant changes, we will:

  • Notify you in the app or on the website
  • Update the "Last updated" date at the top of this policy
  • Ask for your consent again where required by law

Continued use of our services indicates your acceptance of the updated policy.

12. Contact Us

If you have any questions, comments, or requests regarding this Privacy Policy, please contact us at:

POMODIARY LLC

  • Address: 131 Continental Dr, Ste 305, Newark, DE 19713-4324, United States
  • Email: hi@pomodiary.com