Privacy Policy — Timeframer

Timeframer is a clock. It works without an account, without cookies, and without following you around the internet. This page explains exactly what is collected when you do sign in or buy something — and, just as importantly, what isn't.

Who is responsible

Timeframer is operated by Riccardo Cereser, a sole trader established in Denmark ("Timeframer", "we", "us"). We are the data controller for the personal data described on this page.

Contact: support@timeframer.app

Using the clock without an account

You can use Timeframer — on the web, in the iPhone app, as a desktop wallpaper or as a screen saver — without creating an account and without telling us who you are.

In that mode, everything you set up is stored on your own device, in your browser's local storage or the app's local storage. It is never uploaded. That includes your chosen digit set and gallery, per-clock art holds, world clocks, alarms, timers and countdowns, Pomodoro settings, saved timer templates, favourite and hidden sets, sound and frame preferences, and a locally generated device name used only by Remote Control.

Clearing your browser's site data, or deleting the app, erases all of it. We have no copy.

Accounts

An account exists for one reason: so that a purchase and your saved galleries follow you between devices. When you sign in we store:

Your email address.
A display name, if your sign-in provider supplies one or you set one yourself. You can change or clear it at any time.
An identifier from your sign-in provider (Apple or Google), so we can recognise you next time.
Your membership status — whether Timeframer Pro is unlocked.

There are three ways to sign in, and each behaves slightly differently:

Sign in with Apple: If you choose Hide My Email, Apple gives us a relay address ending in @privaterelay.appleid.com and we never see your real one. We also store an Apple refresh token — solely so that deleting your account can also revoke Timeframer's access to your Apple ID, which Apple requires us to do.
Sign in with Google: Google gives us your email address and, if available, your name. We do not receive your Google password and request no other access to your Google account.
Email one-time code: We email you a short code. To stop this being abused as a way to send mail to strangers, we briefly store the IP address that requested the code alongside the code itself, purely for rate limiting. Both are short-lived.

What syncs when you are signed in

Galleries you save, and the items in them, are stored on our server so they appear on your other devices. Your Timeframer Pro unlock is stored the same way. Alarms, timers and device preferences do not sync — they stay on the device that created them.

Remote Control

Remote Control lets one of your devices drive the clock on another. It uses a third-party realtime service, Pusher. When you use it, the device identifier and the device name shown in the picker are sent through Pusher so your devices can find each other. Channel names are derived from your account so that only your own devices can join.

For transparency: the Pusher script currently loads on every visit to the web clock, not only when Remote Control is used. It establishes no connection and transmits nothing until you actually start a Remote Control session.

Analytics

The website uses Plausible, a privacy-focused, EU-hosted analytics service. It sets no cookies, collects no personal data, does not fingerprint you, and cannot follow you to other websites. We use it to see which pages and features get used at all.

Analytics is deliberately switched off in several places:

Entirely off in the iPhone and iPad app — the app loads no analytics whatsoever.
Off on the desktop wallpaper and screen saver, which run unattended for hours and would otherwise produce meaningless traffic.

One flag is kept in your browser's local storage to distinguish a first visit from a returning one. It is a single value on your own device, not an identifier we can tie to you.

Separately, when a purchase completes, our server reports the purchase to Plausible so the figure isn't lost to ad-blockers. That report contains the amount and where the purchase started from. It contains no name, email or account identifier.

Payments

We never see or store your card details.

On the web: Paddle is our merchant of record. Paddle — not Timeframer — takes your payment details, handles VAT and sales tax, and appears as the seller on your statement. Their own privacy policy governs what they collect.
In the iPhone and iPad app: Purchases go through Apple's In-App Purchase system, with RevenueCat as the service that tells our server a purchase happened. Apple handles the payment; we receive confirmation that an unlock is owed to your account.

We keep a record of each purchase event — including the buyer's email address and the confirmation sent by Paddle or RevenueCat — as an accounting and audit record. See deletion and retention below, because this is the one thing that outlives your account.

Other services that load in your browser

On the website, the following third parties may load. Each is used for the stated purpose only:

Google Fonts — the Poiret One typeface.
Apple ID and Google Identity — the sign-in buttons, loaded on every page so the buttons are ready; they do nothing until you click one.
Pusher — Remote Control, as described above.
Plausible — analytics, as described above.
Paddle — the checkout overlay, loaded only when you start a purchase.

The iPhone and iPad app loads none of these except what is needed for sign-in and purchases.

Cookies

Timeframer sets no advertising or tracking cookies, and there is no consent banner because there is nothing to consent to. Your preferences are kept in local storage on your device, and signing in uses a token stored the same way.

Deleting your account, and what is kept

You can delete your account yourself at any time — in the app under Settings → Account → Delete account, or on the web in the same place. No email, no waiting.

Deleting your account immediately and permanently removes your user record, your saved galleries and their contents, and your Timeframer Pro entitlement. If you signed in with Apple, we first ask Apple to revoke Timeframer's access to your Apple ID.

Two things deliberately survive account deletion, and you should know about them.

Payment records. If you ever bought Timeframer Pro, the record of that transaction — including the email address used to buy it and the confirmation message from Paddle or Apple — is retained as an accounting record. We are required to keep proof of sales for tax purposes, and this is the legal basis for keeping it after you leave. It is retained for five years from the end of the financial year in which the purchase was made, then deleted.

Art you contributed. If you authored a digit set or a gallery that forms part of the public catalogue, that content stays in the catalogue but is disconnected from you — the record no longer points to any account.

Short-lived sign-in codes and their associated IP addresses expire on their own schedule and are not tied to your account record.

Children

Timeframer is a general-audience clock. It is not directed at children, we do not knowingly collect personal data from anyone under 13, and nothing in the app is designed to appeal specifically to children. Some digit sets are tagged For Kids — that describes an art style, not an audience.

If you believe a child has created an account, email support@timeframer.app and we will delete it promptly.

Your rights

If you are in the EU, the EEA or the UK, you have the right to access your data, to correct it, to have it erased, to restrict or object to processing, and to receive it in a portable form. Most of these you can exercise yourself: your data is visible in Settings, editable there, and deletable in one tap.

The legal bases we rely on are:

Performance of a contract — running your account, syncing your galleries, and delivering what you paid for.
Legal obligation — retaining accounting records of purchases.
Legitimate interests — aggregate, non-identifying analytics, and rate-limiting sign-in codes to prevent abuse.

For anything you cannot do yourself, email support@timeframer.app.

Data is stored on servers in the EU. Some of the services above (Apple, Google, Paddle, RevenueCat, Pusher) operate internationally and may process data outside the EEA under their own safeguards.

If you think we have handled your data badly, please tell us first — but you also have the right to complain to the Danish Data Protection Agency (Datatilsynet), or to the supervisory authority in your own country.

Changes to this policy

If this policy changes in a way that affects you, we will update the date at the top of the page and, for anything significant, say so in the app's What's new.