Privacy Policy
Last updated: 28 October 2026
This is an English translation provided for convenience. In case of any discrepancy, the Spanish version prevails.
Pomodoro Sync is a Pomodoro timer that syncs your session across devices through your Google account. We collect only the data needed for that to work. We do not sell your data, we do not show advertising and we do not use advertising or tracking cookies.
1. Data controller
The controller of your data is the owner of Pomodoro Sync, a private individual resident in Spain who develops and runs the app (see the terms of service). For any question about your data, write to traderacero26@gmail.com.
2. What data we process
- Your Google account data: email, user identifier and, if Google provides them when you sign in, your name and profile photo (the app only displays the email). We do not have access to your password or to any other data in your Google account.
- Timer settings: length of the phases and number of sessions before the long break.
- Timer state: current phase, whether it is running or paused, and the moment at which the phase ends.
- Session history: date, duration and type (work or break) of each completed session.
- Statistics summary: accumulated totals of sessions and focused time, and your day streak.
- Platforms used: which families of systems (Android, Windows or web) you have used your account on.
- Random installation identifier: a code generated by the app itself the first time it is opened in each installation, which accompanies the timer state and each session in order to avoid conflicts when syncing between your devices. It is not the device identifier or the advertising identifier, and it cannot be used to identify your device outside the app.
- Purchase data (only if you buy the unlock): the fact that the account is unlocked, the date, the payment method used (Stripe or Google Play), the transaction identifiers they provide to us and, if the payment is refunded, voided or disputed, the date and the reason. We never receive or store your card details: they are handled directly by Stripe or Google.
- Payment screen usage events: a minimal record of three specific moments (starting to use the free timer, and coming across the payment screen when trying to sync or view statistics), with the platform and the date. It is used to find out whether the free/paid model works; it does not record anything else you do in the app.
- Error reports (Android only): if the app closes unexpectedly, a technical report with the device model, the system and app versions, and the details of the error is sent through Firebase Crashlytics.
- Technical data: like any internet service, our providers log technical data about connections (for example, the IP address) for security and operational purposes. In addition, to prevent abuse, we count how many times a day each account starts a payment or records an event; these counters are deleted after a few days.
Sound, theme, language and desktop preferences (launch at system startup, system tray) are stored only on your device and do not reach us.
3. What we use it for and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and maintaining your account, syncing the timer and settings, and showing you your statistics. | Performance of the contract (Art. 6(1)(b)): it is the service you request. |
| Managing the purchase, activating the unlock and handling issues and refunds. | Performance of the contract (Art. 6(1)(b)). |
| Keeping the record of purchases. | Compliance with legal, tax and consumer-protection obligations (Art. 6(1)(c)). |
| Payment screen events and error reports, to improve the app and fix bugs. | Legitimate interest (Art. 6(1)(f)) in the app working well and being sustainable, with minimal impact on your privacy. |
| Security and prevention of fraud and abuse of the service. | Legitimate interest (Art. 6(1)(f)). |
We do not make automated decisions that produce legal effects concerning you, nor do we carry out profiling.
4. Who it is shared with
Only with the providers that are essential to provide the service, who process the data following our instructions or, in the case of payments, as independent controllers subject to their own policies:
- Google (Firebase): sign-in, database, server functions, web hosting and error reports. Firebase privacy.
- Stripe: processes payments on Windows and web. Stripe Privacy Policy.
- Google Play: processes payments on Android. Google Privacy Policy.
If you download the app from Google Play or Microsoft Store, those stores process their own data about the download in accordance with their policies. We do not disclose your data to anyone else, except where required by law.
5. Where it is stored and international transfers
The database containing your settings, sessions and statistics is hosted on Google servers in the European Union. Some services (sign-in, server functions, error reports and payments) may process data in the United States. Those transfers are covered by the EU-U.S. Data Privacy Framework, to which Google and Stripe have adhered, and by the standard contractual clauses approved by the European Commission.
6. How long we keep it
- Details of each session: 21 days; after that they are deleted automatically.
- Account, settings, timer state, statistics summary and platforms used: for as long as you keep your account.
- Payment screen events: a maximum of 24 months.
- Error reports: 90 days.
- Daily usage counters to prevent abuse: a few days.
- Purchase records: for the periods required by law (up to 6 years), even if you delete your account.
7. How to delete your account and your data
In the app, go to Settings → Account → "Delete my account and all my data". Your sign-in account, your settings, the timer state, your entire session history, your statistics summary and the platforms used are deleted permanently and immediately. This action cannot be undone and, if you had bought the unlock, you lose it as well.
The only things kept, no longer linked to an active account, are the purchase record (due to a legal obligation) and the payment screen events until they expire. Stripe and Google keep their own payment records in accordance with their policies. If you cannot access the app, you can ask us by email to delete your account, writing from the address of your Google account.
8. Your rights
You can exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to traderacero26@gmail.com from the email address of your Google account. We will reply within a maximum of one month.
If you believe that we have not processed your data properly, you can lodge a complaint with the Agencia Española de Protección de Datos (the Spanish Data Protection Agency, www.aepd.es) or with the data protection authority of your country of residence.
9. Cookies and local storage
The website does not use advertising, analytics or tracking cookies. The web version of the app stores in your browser's local storage the information that is essential to keep you signed in and to keep your preferences; it is strictly necessary for the app to work and does not require consent. The Stripe payment page uses its own cookies, which are necessary to process the payment securely and to prevent fraud.
10. Security
All communications with our servers are encrypted (HTTPS). Access to your data is restricted to your own account by means of security rules on the server, and payments are always verified on the server before the unlock is activated.
11. Minors
Pomodoro Sync is not directed at children under 14 and we do not knowingly collect their data. If you believe that a child under that age has created an account, write to us and we will delete it.
12. Changes to this policy
If this policy changes significantly, we will notify you in the app or by email before the change applies, and we will update the date shown above.