Privacy Policy

1. Information We Collect

You can use the app without an account. In guest mode we do not collect your name or email, but the usage, diagnostic, and advertising data described below is still collected.

You can sign in with Google, Apple, or Kakao. We collect your email, name, and profile photo. If you change your profile photo by taking a picture or choosing one from your photo library, the photo is uploaded to our cloud storage.

Pomodoro records, tasks, tags, and app settings are stored on your device. If you are signed in with a premium subscription, they sync to the cloud so you can use them across devices.

For subscriptions, RevenueCat processes your user ID and subscription status. Payment information is handled by Apple or Google.

App usage and diagnostics: We use Google Firebase Analytics and Firebase Crashlytics. They collect how the app is used (for example, timers started, completed, or stopped, subscription screen views, and rewarded ad results), device and app information (device model, OS version, app version, language), an app instance identifier, approximate location derived from your IP address (country or city), and crash reports. We do not send your email, task names, or tag names to these services.

Advertising: The app offers optional rewarded ads through Google AdMob. When an ad is requested, Google may collect your device's advertising identifier (the Android advertising ID, or on iOS the IDFA only if you allow tracking), IP address, and device information to show and measure ads. Firebase Analytics may also receive the advertising identifier. In the EEA, the UK, and Switzerland, we ask for your consent through Google's consent message before requesting ads.

Live Activity (iOS): When the timer is shown as a Live Activity, the app sends a push token and the timer schedule (mode, remaining time, timer settings) to our server on Cloudflare so the lock screen timer can update. This data is not linked to your account, is kept only temporarily, and is deleted automatically.

2. Information We Do Not Collect

We do not collect your precise location, contacts, or microphone input. We access the camera or photo library only when you choose to set a profile photo. We do not send the content of your tasks, tags, or records to analytics or advertising services.

3. How We Use Your Information

User authentication, data synchronization, subscription management, customer support, understanding how the app is used so we can improve it, finding and fixing crashes, and showing optional rewarded ads.

4. Where We Store Your Data

Local: Your device (SQLite, SharedPreferences)

Cloud: Supabase (AWS, United States). Usage, crash, and advertising data: Google servers (United States and other countries).

5. Data Retention

Account data: until you delete your account. Local data: deleted with the app. Cloud data: deleted within 30 days of a deletion request. Analytics data: up to 14 months. Crash reports: 90 days. Live Activity data: kept temporarily and deleted automatically. Advertising data is retained according to Google's policies.

6. Third-Party Services

Supabase (authentication, storage), RevenueCat (subscriptions), Google Firebase Analytics and Crashlytics (usage statistics, crash reports), Google AdMob (rewarded ads, consent message), Cloudflare (Live Activity updates), Apple (push notifications), Google/Apple/Kakao (sign-in).

7. App Permissions

Notifications (optional): for timer alerts. Camera and photo library (optional): only to take or choose a profile photo. Tracking (iOS, optional): to personalize ads; you can deny it. On Android, the app also uses permissions that keep the timer running in the background (foreground service, battery optimization exemption). We do not request location, contacts, or microphone permissions.

8. Your Rights

You can access, correct, or delete your data, and delete your account in the app. You can change your ad consent in the app's ad privacy settings (EEA, UK, Switzerland), and limit ad tracking or reset your advertising identifier in your device settings. Contact: support@fixitdev.com

9. Security

HTTPS/TLS encryption, OAuth 2.0/PKCE authentication, secure token management.

10. Children's Privacy

We do not knowingly collect information from children under 13.

11. International Data Transfers

Your data may be processed in the United States and other countries where Supabase, RevenueCat, Google, and Cloudflare operate.

12. Contact Us

Fixitdev Studio is the data controller responsible for your personal data.

For more details about service terms, please review our Terms of Use (EULA): https://pomolings.fixitdev.com/en/terms

13. Changes to This Policy

We will notify you of changes through in-app notifications or email.

14. Effective Date

This Privacy Policy is effective as of September 25, 2026.