What Untimer knows about you, and what it does with it.

Who is responsible

Untimer is made and operated by Kristaq Kola, a sole trader registered in Albania, who is the controller of the personal data described here. For anything about your data, write to privacy@untimer.com.

What is stored, and why

Your account. An email address and a password. The password is never stored as written; it is hashed by the authentication service before it reaches the database. These exist so that your records are yours and only yours.

Your sessions. For each session: when it started and ended, how long it was planned to run and how long it actually ran, how it ended, how many interruptions you noticed and whether they were internal or external, the task it was for if you named one, and the time zone you were in. This is the product. It exists so that your days, the insights and the milestones can show you what happened.

Your notes and tasks. The line you write at an interruption, what it was, which exists so that it can meet you when you return. And the tasks you make: a name, how many sessions you said it would take, and when you finished it.

Your settings and marks. The end of your working day if you set one, your time zone, the lengths the timer runs at, and which milestones have happened and when.

Daily totals. One row per day you used Untimer, kept as sessions end, so that the insights never need to read your whole history.

Technical records. The providers that host the site, the app and the database keep ordinary server logs, which include the IP address a request came from, for security and to operate the service. Untimer does not read these to learn about you.

If you buy Plus. The payment is taken by Lemon Squeezy, the merchant of record, on their own page. They hold your card and billing details and Untimer never sees a card number. Untimer keeps a customer reference and a subscription reference from them, so that it knows Plus is on and until when, and so that you can open your subscription from Settings.

If you sign in with Google. Google tells the authentication service your email address and your name, and nothing more is asked for. Untimer keeps the email address, exactly as it does for an account made with a password.

What is not collected

• No analytics. There is no analytics script on this website or in the app, and nothing records which screens you open or how long you look at them.
• No trackers, no advertising, no pixels, no fingerprinting.
• No contacts, location, calendar, microphone or camera. The app never asks for them.
• No fonts or assets loaded from third parties. The fonts are served with the app, so using Untimer makes no request to anyone else on your behalf.

Cookies and local storage

This website sets no cookies. The app keeps your sign in token, your theme and whether sound is on in your browser's local storage, which is how it remembers you between visits. None of it is used for anything other than that, and none of it leaves your browser except the token, which is sent with each request so the server knows whose records to answer with.

Where it lives

Your data is stored in a Postgres database operated by Supabase, in the European Union, in their Ireland region. Supabase acts as a processor on Untimer's behalf and is bound by its own data processing terms. Every table is protected by row level security, which means the database itself refuses to show one account's rows to another, whatever the application does.

A few other companies do one job each on Untimer's behalf, and each sees only what that job needs. Cloudflare serves this site and the app and forwards the mail sent to Untimer's addresses. Resend delivers the emails Untimer sends you, which are the confirmation of your address, a password link if you ask for one, and nothing else. Lemon Squeezy takes payments, as above. Google is involved only if you choose to sign in with it. None of them is given your sessions, your tasks or your notes.

Who can see it

You. The founder can access the database to operate and repair the service, and does not read people's records for any other reason. Nobody else can. Your data is never sold, rented, shared for advertising or used to train anything.

How long it is kept

Until you delete it. There is no automatic expiry, because a long history is the point. When you delete your account, every row that belongs to it is deleted at once. Untimer currently runs on a hosting tier that keeps no automatic backups, so deletion is final and there is no copy to restore from.

Your rights

You can exercise all of these yourself, from the app, without asking anyone.

• Access and portability. Settings, then Download my data. Everything you have recorded, as one JSON file.
• Erasure. Settings, then Delete my account. See account deletion for the steps and for what to do if you cannot sign in.
• Correction. Notes and tasks can be rewritten from the app as they are recorded. For anything else, write to us.
• Objection and restriction. Untimer processes your data only to provide the service you asked for, on the basis of that agreement, and to keep it secure, on the basis of legitimate interest. If you object to either, deleting your account ends both.

If you are in the European Union or the United Kingdom you also have the right to complain to your data protection authority. We would rather hear from you first, and we will answer.

Children

Untimer is not directed at children under sixteen, and does not knowingly keep an account for one. If you believe a child has created one, write to us and it will be removed.

Changes

If this page changes, the date at the top changes with it, and anything material is said here in plain words. There is no mailing list, so changes are announced here.

Contact

privacy@untimer.com. A person replies.