Back to timer.design RO EN

Privacy Policy

Last updated: November 2, 2026

Timer Design ("we", "us", "our") operates the timer.design website and web application. This policy explains what data we collect, why, and how we protect it.

1. Data you record

The app records only what you enter and what it needs in order to work:

  • Account information: email address, first name, last name, display name.
  • Session data: timer sessions you record (title, description, duration, stages, mood, metadata). All text content is encrypted with AES-256-GCM before storage.
  • Journal entries: the notes you write in the Journal tab. Titles, text and tags are stored encrypted (AES-256-GCM) and are shown only in your account. Images you upload are stored as files and are not encrypted.
  • Device identifier: a random code generated by the app and kept in your browser or phone. It contains no information about you and cannot identify you; it is only used to know which device owns the active session.
  • Weather and city: only if you allow location access, the city and the weather conditions are recorded when a session starts, as context for your statistics. They are stored encrypted, only with that session, and are visible only to you. Coordinates are not stored. Without permission, the session is saved without weather.

2. Data we do NOT collect

  • We do not use cookies for tracking or advertising.
  • We do not use third-party analytics (no Google Analytics, no tracking pixels).
  • We do not sell, rent, or share your data with third parties.
  • We do not display ads.

3. Local mode

You can switch to Local mode in Settings at any time. In Local mode, all data is stored exclusively in your browser's localStorage. Nothing is sent to our server. We cannot access, read, or recover data stored in Local mode.

4. Encryption

In Cloud mode, all session titles, descriptions, journal entries, and notes are encrypted with AES-256-GCM before being stored in the database. Even with direct database access, the content is unreadable.

5. How your data recorded on the server is used

Your data is used exclusively to:

  • Provide the timer, history, journal, and dashboard features.
  • Sync your sessions across devices (in Cloud mode).
  • Only you can export it to generate your personal statistics and analyses.

6. Data retention

Your data is stored as long as your account exists. You can export all your data (JSON or CSV) from the Dashboard at any time. You can request account deletion by contacting us.

7. Security

  • CSRF protection with nonce tokens on all forms.
  • Honeypot fields and minimum submission time to prevent automated attacks.
  • Per-IP rate limiting: 10 login attempts per 5 minutes, 3 registrations per hour.
  • Device-locked sessions: only the device that owns a session can modify it.

8. Third-party services

The app uses the following external services. Each one receives only what is described below, plus your device's IP address, as with any request on the internet:

  • Lemon Squeezy: processes the subscription and payment. You enter your payment details directly with them; we never see or store them.
  • YouTube (youtube-nocookie.com): the web music widget, in YouTube's privacy-enhanced mode. No cookies are set until you play a track.
  • MET Norway (api.met.no): weather data for the Weather widget and for sessions. It receives your location coordinates, rounded.
  • OpenStreetMap Nominatim: turns coordinates into the city name. The request goes through the timer.design server, so Nominatim receives only coordinates rounded to about 1 km, without your IP address.
  • ExchangeRate-API (open.er-api.com): exchange rates for the currency converter. It receives only the chosen currency.
  • jsDelivr: serves the library that draws the session handoff QR code, only when you open the QR code.
  • Google Fonts: serves the fonts of the pages and of the mobile app.

9. Children

Timer Design is not directed at children under 16. We do not knowingly collect data from children under 16.

10. Changes

We may update this policy. Changes will be posted on this page with an updated date. Continued use of the service after changes constitutes acceptance.

11. Cookies and local storage

Timer Design does not use tracking, analytics or advertising cookies. We only use what is strictly necessary for the service to work:

  • Authentication cookies: set by WordPress when you sign in, so you stay signed in. Without them you cannot sign in. They are removed when you sign out or expire automatically (at most 14 days, if you checked "Remember me").
  • Browser local storage (localStorage): keeps your settings, chosen language, device identifier, the session in progress and, in Local mode, all your data on your device. If you block it, the app no longer remembers your settings and Local mode does not work.
  • YouTube: only after you play a track in the web music widget, YouTube may store its own cookies, under its own policy.

The public pages of the site set no cookies. You can delete cookies and local data at any time from your browser settings.

12. Contact

For questions about this policy or to request data deletion, contact us at hello@timer.design.