Privacy Policy

Last updated: 3 November 2026. This policy explains which personal data we process, why and how, in line with the Turkish Personal Data Protection Law (KVKK) and the EU GDPR. In short: no ads, no tracking, we never sell your data.

1. Controller

Halil Eren Sontay (Pomodoro Flow). Contact: sontayhalileren@gmail.com

2. Data we process

Account data: e-mail address, display name, password (stored only as an irreversible hash), sign-up date, and the date and version of the legal texts you accepted.
App data: focus sessions (duration, time, tag, intention text), tasks, parked thoughts, badges and settings. By default these stay on your device and are uploaded only while Pro sync is active.
Pro data: whether your account has Pro access and its end date. The App collects no payment or card details.
Technical data: IP address, country, browser and device information and request times in server logs. Used for security, abuse prevention and visit and download statistics; detailed logs are kept for at most 90 days and statistics only as aggregate counts.
Social data (with an account): for friends, groups and community features your display name, level, streak and daily/weekly focus totals are stored on the server and shown only to your friends and members of your groups. The community counter and community goal use anonymous totals only. Your intentions, tasks and areas are never shared.
Public profile (optional, off by default): if you turn it on, your name, level, streak, total focus time, crystal counts and a summary of the last 7 days are published on a page anyone with the link can see. You can turn it off at any time.
Weekly summary e-mail (optional, off by default): if you turn it on, a summary is sent to your e-mail address once a week; every e-mail has a one-click unsubscribe link.
Error reports (optional): when the App catches an error it shows what would be sent and asks for your permission. Reports are anonymous: app version, platform, error text, a technical trace and browser information; your account, e-mail or IP address are not linked to the report. Reports are kept for at most 90 days.
Calendar link (optional): the calendar address you connect is stored only on your device. Because of browser restrictions the calendar is read through our server function; the address and events are not stored on the server and are cached only on your device for 30 minutes.

In guest mode no personal data is sent to our servers. If you connect Spotify, the access token is stored only on your device. The Focus Shield browser extension only reads the end time of your focus and keeps its block list in the browser’s own storage; it sends no data to us.

3. Purposes and legal bases

Creating your account, sign-in, password reset and verification codes — performance of a contract.
Verifying Pro and syncing between your devices — performance of a contract.
Friends and groups features — performance of a contract (when you use them); public profile and weekly summary e-mail — your consent (when you turn them on; you can withdraw it at any time).
Finding and fixing errors — your consent (asked before each report, or “always send” chosen in settings).
Security and fraud/abuse prevention — legitimate interests.

4. Processors and transfers

We share data only with providers needed to run the service:

Supabase (accounts, cloud database and server functions)
An e-mail delivery provider (verification and reset codes; the weekly summary e-mail if you turned it on)

Their servers may be located outside your country. Transfers are made under the providers’ standard contractual clauses and security commitments in line with KVKK Art. 9 and the GDPR. We never share or sell your data for advertising or marketing.

5. Retention

Account and cloud data are kept until you delete your account. On deletion cloud data is removed immediately and purged from backups within 30 days. Data on your device is removed when you uninstall the App or use “clear data on this device”.

6. Security

All connections are encrypted (TLS). In the database every user can access only their own rows (row-level security). Passwords are stored irreversibly.

7. Your rights

Under KVKK Art. 11 and the GDPR you can access, rectify, erase and port your data, object to processing and lodge a complaint with a supervisory authority. You can export your data and delete your account in the App; for anything else write to us and we will reply within 30 days.

8. Children

The App is not directed to children under 13 and we do not knowingly collect account data from them.

9. Changes

We may update this policy and will inform you in the App about material changes, asking for consent again where required.