Pomofit
Privacy Policy
The short version
PomoFit is a pomodoro timer that puts an exercise into your breaks. To do that across your phone and the website, it has to remember who you are and what you finished. That is essentially all it keeps.
- The app does not track you. No analytics SDK, no advertising identifiers, no third-party trackers of any kind. The website is a different matter — see sections 03 and 04.
- We do not sell or share your data for anyone else's marketing, ever.
- The timer works without us. It runs offline, on your device, and syncs what you finished when it can.
- The leaderboard is opt-in and off by default. Nothing about you appears on it until you switch it on.
- You can delete everything from inside the app, in two taps from the More tab. It is a real deletion, not a deactivation.
01Who we are
This policy explains how NEXO IV GRUPO, S.L. (ESB22740989), registered at Urb. Monja 22 – PBJ Fontaneres, 30811 Murcia, Spain, handles personal data in the PomoFit mobile app and at pomofit.online. In this policy we are “we” and “PomoFit”, and you are “you”.
For the purposes of the UK and EU General Data Protection Regulation, we are the data controller for the data described here. You can reach us about anything in this document at info@yotech.ai.
02What we collect, and why
Everything below is either something you typed in, or a record of something you finished in the app. There is no profiling and no inference.
Your account
Created when you sign up on either the app or the website. It is one account across both — signing in on your phone gives you the same history you have in the browser.
| What | Why we need it | Lawful basis |
|---|---|---|
| name | Shown to you in the app, and used as your display name on the leaderboard if you opt in. | contract |
| Signing in, verifying the address, and resetting a forgotten password. We do not send marketing to it. | contract | |
| password | Stored only as a bcrypt hash. We cannot read it, and neither can anyone who obtains the database. | contract |
| two-factor secret | Only if you turn on two-factor authentication. Stored encrypted. | contract |
What you do in the app
This is the product. Without it there are no statistics and nothing to sync between your phone and the browser.
| What | Why we need it | Lawful basis |
|---|---|---|
| focus sessions | When a pomodoro started and finished, how long it ran, and whether you completed it. | contract |
| exercise sessions | Which exercise, how many reps or seconds, which break it belonged to, and whether you finished it. | contract |
| planned days | The focus and break lengths you set for a day in advance, and the exercises you queued into it. | contract |
| custom exercises | Any exercise you create yourself, and the categories you give it. | contract |
| leaderboard opt-in | A single on/off flag recording whether you chose to appear. | consent |
Payment, if you subscribe to Pro
We never see or store your card number. Payment is handled entirely by Stripe on the website, and by Apple if you subscribe inside the iOS app. What reaches our database is only what we need to know whether your subscription is active: an opaque Stripe customer reference, the card brand and its last four digits so you can recognise which card is on file, the plan and its status, and the period end date. If you fill in a company name, VAT ID or billing address for a business invoice we store those too; all three are optional and blank for most accounts. Section 04 describes the payment page itself.
Referrals
If you arrive at the website through a referral link, a cookie remembers which code brought you, so that if you go on to subscribe the referrer can be credited. That is the whole of it — the cookie holds a code and nothing about you. Section 04 gives its name, its lifetime and its settings. The mobile app sets no cookies at all.
03Analytics, and the difference between the app and the website
These are two different products with two different answers, and rolling them together would be misleading.
The mobile app collects no analytics at all
- No analytics or product telemetry. No Google Analytics, Firebase, Mixpanel, Segment, Amplitude, Sentry or equivalent is present in the app.
- No advertising identifiers. The app does not request IDFA, does not present App Tracking Transparency, and carries no
NSUserTrackingUsageDescription, because there is nothing to track. - No location. The app never asks for it and never receives it.
- No contacts, photos, microphone, camera, health or fitness data. PomoFit does not read from Apple Health and writes nothing to it.
- No push notification tokens. Every notification PomoFit sends is scheduled locally by your own device. Nothing about your notifications reaches our servers, and we could not send you one if we wanted to.
The website is a different product
pomofit.online loads Google Tag Manager and Google Analytics 4, which set cookies in your browser and send Google information about your visit. That is a property of the website only. None of it is in the mobile app, and nothing carries across from one to the other, because the app has no browser for a cookie to live in. Section 04 names every cookie and every tag, and what you can do about them.
04Cookies, tags and the payment page
A cookie is a small file a site asks your browser to keep. Below is every cookie pomofit.online is responsible for, everything it loads from someone else, and what happens in your browser when you pay. The mobile app appears nowhere in this section: it sets no cookies and loads no third-party scripts.
The cookies we set ourselves
Four, and not one of them measures you. The first three are strictly necessary — the site cannot sign you in or protect a form without them, which is why they need no consent. The fourth carries a referral code and nothing else.
| Cookie | What it is for | How long |
|---|---|---|
| pomofit-session | Keeps you signed in as you move between pages. It holds a session identifier, not your details. Marked httpOnly so no script can read it, and SameSite=Lax so another site cannot make your browser send it. | 120 minutes |
| XSRF-TOKEN | Proves a form was submitted from our own page rather than someone else's. It is a random token and says nothing about you. | 120 minutes |
| remember_web_* | Written only if you tick “Remember me” when signing in, so you are not asked again on that browser. Signing out deletes it. | up to 5 years |
| pomofit_ref | Holds a referral code, so the person who referred you can be credited if you subscribe. httpOnly and secure, readable only by our own server, and deleted as soon as it has been used. | 30 days |
Google Tag Manager and Google Analytics
Every page of pomofit.online loads a Google Tag Manager container
(GTM-KPRZFDBV) and, separately, a Google Analytics 4 tag
(G-XHR3HSSQEN). The two do different jobs. Tag Manager sets no cookies of
its own; it is a loader, whose job is to fetch and run other tags. Analytics is what
actually measures the visit, and it is Analytics that sets the cookies below.
| Cookie | What it is for | How long |
|---|---|---|
| _ga | Gives your browser a random identifier, so that several visits are counted as one returning visitor rather than several new ones. | 2 years |
| _ga_XHR3HSSQEN | Holds the state of your current visit for this particular Analytics property — when it began, and whether it is still the same visit. | 2 years |
Through these, Google receives your IP address, which pages you opened and in what order, your device and browser, and the site or search that sent you. It derives an approximate location from the IP address. We use the result to decide which pages are worth keeping. It is never combined with your account, and we never send Google anything about your sessions, your exercises or your statistics.
One honest caveat about Tag Manager. The Analytics tag above is the only Google tag written into this site's source, but the container's contents are configured in Google's console rather than in our code. If a further tag is added there — an advertising tag, for instance — it can set its own cookies without anything on this site changing. If that happens, this section is updated with it.
Stripe, and why there is no Stripe cookie here
Paying happens on Stripe's pages, not ours. When you start a subscription we hand you
to checkout.stripe.com; when you change or cancel one, to Stripe's billing
portal. Your card number is typed into Stripe's page over Stripe's own connection, and
never passes through our servers.
Because we embed none of Stripe's payment scripts on pomofit.online,
Stripe sets no cookies on this site. Stripe does set its own —
__stripe_mid and __stripe_sid, which it uses to detect card
fraud — but on Stripe's domain, while you are on Stripe's page, governed by
Stripe's privacy policy.
What returns to us is only the outcome: the customer reference, card brand and last four digits, plan, status and period end listed in section 02. Stripe also notifies our server directly when a payment succeeds or fails, so that what you see in your account stays true without us having to ask.
Turning them off
Every browser can block or delete cookies, and most can block third-party scripts outright — look for “Cookies and site data” in its privacy settings. You can also opt out of Google Analytics on every site at once with Google's own browser add-on. Blocking the analytics cookies costs you nothing here. Blocking the first three in the first table will stop you signing in; blocking the fourth only loses the referrer their credit.
Analytics cookies need consent before they are set, under the EU ePrivacy Directive, article 22.2 of the Spanish LSSI and the UK PECR. Today the Tag Manager container and the Analytics tag both load on the first paint of every page, with no banner and no Consent Mode default, so that consent has never been asked for.
Two ways out. Add a consent banner and hold both tags behind it — Consent Mode v2
with analytics_storage denied by default is the least invasive version.
Or drop Google for a cookieless analytics tool that needs no banner at all, which
would let the top of this policy say “we do not track you” without the
asterisk. Either way the four cookies in the first table are unaffected: strictly
necessary cookies have never needed consent.
05What stays on your device
- Your sign-in token is held in the iOS Keychain, the encrypted store the operating system provides for credentials. It is not in ordinary app storage and is not included in an unencrypted backup.
- Your name and email are cached so the app can open and show your account with no connection. Cleared the moment you sign out.
- The running timer — which phase, how long is left, what you have ticked off — so a force-quit does not lose your session.
- Finished sessions waiting to sync. If a session cannot reach us it is queued on the device and sent when the connection returns, rather than thrown away.
All of it is removed when you sign out or delete the app. Deleting the app does not delete your account — see section 08.
06The leaderboard
Ranks is the only part of PomoFit where anything about you is visible to another person, so it gets its own section.
- It is off by default. You are not on it until you switch it on, and switching it off removes you.
- Only signed-in PomoFit users can see it. It is not public on the web and is not indexed by search engines.
- What appears is your first name and a total — minutes focused, or exercises completed. Never your email, never your surname, never anything about a specific session or day.
- Consent is the lawful basis, and you can withdraw it at any time from the Ranks tab. Withdrawal takes effect immediately.
Your surname is removed on the server, before the leaderboard is sent to anyone. It is not trimmed by the app for display — a privacy guarantee that depends on the client honouring it is not a guarantee.
07Who else processes your data
Each of these acts as a processor on our instructions, under a data processing agreement, and none may use your data for their own purposes.
| Provider | What it does | What it receives |
|---|---|---|
| Stripe | Takes subscription payments made through the website, hosts the payment and billing pages, and raises the invoices. | Your name and email, the card you enter on their own page, and any company name, VAT ID or billing address you saved for invoicing. |
| Apple | Takes subscription payments made inside the iOS app, and delivers the app itself. | Your payment details, which we never see. Apple gives us only an anonymous transaction identifier. |
| Resend | Sends transactional email — address verification and password resets. | Your email address and the contents of that message. |
| Analytics, website only. Not present in the mobile app. | Your IP address, pages visited, device and browser, and referrer. | |
| DigitalOcean | Runs the servers and the database, in their Amsterdam region. | Everything in section 02, at rest. |
Stripe is a processor for taking the payment, but in detecting card fraud and meeting its own duties as a regulated payment institution it acts as a controller in its own right, on its own terms rather than ours. Apple is in the same position for anything bought through the App Store. We cannot instruct either of them there, and their own privacy policies govern that part.
We do not sell your personal data and we do not share it for anyone's advertising. We will disclose data if legally compelled to, and where the law allows us to tell you, we will.
Where it is, and when it leaves
The servers and the database are in Amsterdam, inside the EEA. Everything in section 02 — your account, your sessions, your plans, your exercises — is stored there and stays there.
The processors are a different matter. Stripe, Resend and Google are US-headquartered, so what reaches them may be processed outside the EEA. Those transfers rely on the European Commission's Standard Contractual Clauses, together with the EU–US Data Privacy Framework where the provider is certified under it. If you are in the UK, the UK Addendum to those Clauses applies in the same way. Apple's contracting entity for the App Store in Europe is Irish, so a purchase made there does not leave the EEA on Apple's side.
08How long we keep it, and deleting your account
Your account and its history are kept for as long as the account exists. This is deliberate: statistics that quietly stopped going back a year would make the product worse.
You can delete your account entirely from inside the app: More → Delete
account. Before it happens the app shows you exactly what will be destroyed —
the real number of focus sessions, exercise sessions, planned days and custom exercises
on your account, not a vague warning. You then type the word DELETE to arm
the button and confirm once more.
Deletion is immediate and permanent. There is no recovery period, no archive, and no export afterwards, so take your data first if you want it.
Two things outlive the deletion, because they have to.
Invoices and payment records are kept for 6 years. Spanish company law obliges a business to keep its books and the invoices behind them for six years from the last entry, and that outlasts the four years in which the tax authority can still reopen a return. The invoices themselves are raised and held by Stripe; what remains on our side is the record of which subscription was paid for and when. Neither contains anything about your sessions, your exercises or your statistics — those go with the account.
Backups are overwritten on a 30 day cycle, so data you delete can persist in a backup for up to that long. A backup is only ever used to recover from a failure, never to bring back an account someone asked us to delete.
Deleting your PomoFit account does not cancel a subscription bought through the App Store, because Apple bills it, not us, and we have no ability to stop it. Cancel it yourself in Settings → your Apple Account → Subscriptions, or you will keep being charged for an account that no longer exists.
09Your rights
Under the UK and EU GDPR you have the following rights. They are free to exercise, and we will respond within one month.
- Access — a copy of everything we hold about you.
- Rectification — correction of anything inaccurate.
- Erasure — deletion, which you can do yourself at any time under section 08.
- Portability — your data in a structured, machine-readable format.
- Restriction — a pause on processing while a dispute is resolved.
- Objection — to any processing carried out on the basis of legitimate interests.
- Withdrawing consent — for the leaderboard, instantly, from the Ranks tab.
Write to info@yotech.ai. You also have the right to complain to a supervisory authority — ours is the Spanish Agencia Española de Protección de Datos (AEPD), and if you live elsewhere in the EU or in the UK you may complain to your own instead. We would rather you gave us the chance to put it right first.
10How we protect it
- Everything travels over HTTPS. The app refuses plain HTTP.
- Passwords are stored as bcrypt hashes and are never recoverable, by us or by anyone reading the database.
- Your sign-in token is held in the iOS Keychain rather than ordinary app storage, and is revoked on the server when you sign out.
- Sign-in, registration and password-reset endpoints are rate limited to blunt credential-stuffing attempts.
- A password reset link is single-use and expires after 60 minutes.
- Asking for a reset link returns the same answer whether or not the address has an account, so the endpoint cannot be used to discover who has one.
- Deleting your account revokes every sign-in token on every device, not just the one you are holding.
No system is perfectly secure and we will not pretend otherwise. If we discover a breach affecting your personal data we will notify the supervisory authority within 72 hours as required, and tell you directly where the risk to you is high.
11Children
PomoFit is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, write to us and we will delete it.
12Changes to this policy
If we change how we handle your data we will update this page and move the “last updated” date at the top. For a change that materially affects your rights we will tell you in the app or by email before it takes effect, rather than relying on you to re-read this page. Previous versions are available on request.