Privacy Policy

Who is responsible

Dominik Liebler, Leonhard-Frank-Str. 5a, 97855 Triefenstein, Germany, is the controller responsible for the data processed by Pomonaut within the meaning of Art. 4(7) GDPR. Contact: support@pomonaut.com. See also our contact page.

What data we collect

Pomonaut only collects what the app needs to function:

• Account data — email address and, if you set one, a bcrypt password hash. Passwords themselves are never stored. An account created through Google, GitHub or Apple has no password at all.
• Passkeys — if you add one: the name you give it, the id your device chose for it, its public key, its signature counter and backup flags, and when it was added and last used. Your fingerprint, face or device PIN never reaches us — your device checks them itself and only signs a one-time challenge, and the private key stays on your device or in your password manager.
• Your content — tasks (including their due dates, deadlines, reminders, when each was last set and when one last went out, labels, repeat rules and whether they are on today's focus list, plus the day that list was last planned for you), projects (including the names and order of a project board's columns, and which column each task is in), and focus session history you create in the app.
• Your preferences — the settings you choose in the app: timer lengths, focus mode, auto-start, notification sound, what happens to a task once you complete it, theme, the language the quick-add box reads, your timezone, how your task lists are sorted and whether they are grouped by due date, which projects and labels you pinned as favorites, the reminders a new task starts with, whether you are notified of comments on shared tasks, the colours you picked for labels, the layout (list, board or calendar) you last opened each project in, and whether you have been through the dashboard tour. These stay on our server so the app behaves the same on every device you sign in from. Notification sounds are generated in your browser, not fetched from anyone.
• Two-factor authentication — a TOTP secret and backup codes, if you enable 2FA, stored encrypted.
• Integration tokens — the personal API token you paste in to connect Todoist, and the OAuth access and refresh tokens of Google Calendar, only if you connect those services, stored encrypted. A Todoist token that Todoist stops accepting is deleted. The Google Calendar grant is deliberately the narrowest one Google offers: it can list your calendars and read only your free/busy times — not the titles, attendees, locations or descriptions of your entries — and it cannot create, change, or delete anything.
• Social sign-in — if you sign in with Google, GitHub or Apple: the provider's name, your account id at that provider, and the email address it reports. With Apple's "Hide My Email" that is an address Apple made for us, which forwards to yours; Apple would also offer your name, and we do not ask for it. No access token is kept — the token from the sign-in handshake is used once, to read those details, and then discarded.
• Calendar subscriptions — either the iCal/ICS URLs you add in Settings, stored encrypted because such a URL is itself the access credential to the calendar behind it, or, if you connect Google Calendar, the ids and names of the calendars you pick from that account. In the Google case we never receive what your entries are called: the dashboard shows them as "Busy". Your calendar events are never stored on our servers: they are read from your calendar provider when you open the dashboard or the mobile app and after each focus session, and passed straight to your device. Your browser caches them in its local storage until you clear it or remove the calendar; the iOS and Android apps keep them in memory only, never on the phone's storage, so they are gone when the app is closed. An app sees them only if you granted it the "calendar:read" permission when you connected it.
• Calendar feed link — if you create one (from Settings, or on a project), an unguessable token that lets whoever holds it read your task titles, descriptions, dates and repeat rules. It is stored as a one-way hash for lookup, plus a separately encrypted copy so the link can be shown back to you; we cannot recover one from the hash alone.
• Shared projects — if you share a project or join one: who is a member and since when, who added each task and whom it is assigned to, and the display name you may set. Everyone in a shared project sees its tasks and the name and email address of every other member. To invite someone we store the email address you entered and a one-way hash of the invitation link.
• Comments — the comments you write on tasks: their text, which task they are on, who wrote them, and when they were written and last edited. Everyone who can see the task reads them — on a task of your own that is only you, in a shared project everyone in it, along with the name of whoever wrote each one. When someone comments on a task in a shared project, its other people are notified (see push and browser notifications below), unless they turned that off in Settings.
• Connected apps and access tokens — if you connect an app (such as an AI assistant) or create a personal access token: the app's name, the permissions you granted, when it was added, last used and expires. The tokens themselves are stored only as one-way hashes, so even we cannot read them back. No IP address or device history is kept for them.
• Webhooks — if you add one: the HTTPS address it calls, which events it is sent, when it was added, when it last delivered and what the address answered (a status code such as "200", or a reason such as "timeout"), and since when it has been failing or that it was turned off. The secret that signs each delivery is stored encrypted. Nothing your server answers is kept beyond that status, and there is no log of individual deliveries.
• Push notifications — if you use the iPhone or Android app: the address Apple or Google gives the app for push notifications (a "push token"), which platform and kind it is, and when it was registered and last seen. The token is stored encrypted. It lets us tell your other devices when your timer or your task lists changed, so a phone shows the timer you started on the web, remind you of a task's due date or deadline, and tell you someone commented on a task in a shared project. A push through Apple or Google never carries a task's title, a comment's text or who wrote it — only that something happened and the ids the app needs to fetch it from us.
• Browser notifications — if you turn on reminders in a browser: the address that browser's push service gives it, the keys that encrypt what we send to it, a short label for the browser (such as "Firefox on macOS"), and when it was turned on and last seen. The address and the secret key are stored encrypted. It belongs to the sign-in it was turned on from, and is used only to deliver reminders and news of comments on shared tasks. What we send is encrypted for that browser alone, so its push service (run by the browser's maker) cannot read the task, the comment or its author's name inside.
• Browser extension — if you use Pomonaut for Chrome: it keeps a copy of your open tasks, your projects, the timer and its sign-in tokens in the browser's own extension storage on your computer, so it opens instantly and shows your list offline. Nothing about you is added on our side beyond the connected app it appears as. It talks to no one but our server, and its copy is deleted when you sign out of it or remove it from the browser.
• Technical data — session cookies to keep you signed in, and server logs (IP address, timestamp, requested path) kept only as long as needed to operate and secure the service.

Why we process it (Art. 6 GDPR)

• Contract performance (Art. 6(1)(b)) — providing the account, task management, and timer features you sign up for. Signing in with Google, GitHub or Apple, or with a passkey, falls here rather than under consent: where you choose it, it is how your account is authenticated, not an optional extra.
• Consent (Art. 6(1)(a)) — connecting third-party integrations (Todoist, Google Calendar), adding calendar feeds, and creating a calendar feed link of your own, connecting an app or AI assistant to your account, creating a personal access token, and adding a webhook, all of which you explicitly opt into and can disconnect, remove or revoke at any time.
• Legitimate interest (Art. 6(1)(f)) — operating server logs to keep the service secure and debug failures.

Encryption

Passwords are hashed with bcrypt and never stored in recoverable form. Integration tokens (Todoist, Google Calendar), calendar feed addresses, a calendar feed link's token, webhook signing secrets, and two-factor secrets are encrypted at rest with AES-256-GCM before they touch the database. A calendar feed link's token is additionally stored as a one-way hash, used to look the link up — the hash cannot be reversed back into the link. Access tokens for connected apps and personal access tokens are stored only as one-way hashes. Social sign-in stores no credential at all, so there is nothing there to encrypt. A passkey's public key is stored as is: it can check a signature but not make one, so it is not a secret. Regular content — task titles, due dates, labels, project names, focus session snapshots — is stored as plain text so it can be searched and exported; it is protected by access control and transport encryption (TLS), not field-level encryption.

Where your data is hosted

The infrastructure we operate runs entirely in the EU:

• Application servers & database — Hetzner Online GmbH (Germany), on a Kubernetes cluster we operate ourselves. Your account, tasks, projects, and focus sessions live in a PostgreSQL database on this infrastructure.
• File storage — Hetzner Object Storage (S3-compatible, Nuremberg, Germany), used only to hold your generated data-export zip files until you download them or they expire.
• Transactional email — SparkPost EU, used to send account confirmation, password reset, and security notification emails. Only your email address and the relevant message content are shared with SparkPost EU for this purpose.
• Apple Push Notification service / Firebase Cloud Messaging (Google) — if you use the iPhone or Android app, we send pushes to it through Apple or Google respectively. A push carries the device's push token, the kind of change (the timer or the task lists) and, for the timer, its mode, whether it runs, when it ends and the time left. A reminder carries the task's id, whether it is for the due date or the deadline, and when it was due to go out, under a generic "A task is due." text. It never carries a task's title or any other content — the app fills in what it shows from what it already holds.
• Your browser's push service — if you turn on reminders in a browser, we send them through the push service that browser's maker runs (for example Google for Chrome, Microsoft for Edge, Mozilla for Firefox, Apple for Safari). A reminder carries the task's title and when it is due, but it is end-to-end encrypted with keys only your browser holds, so the push service can read neither; it sees only the browser's push address, the size of the message and when it was sent. We pick none of these services — your browser does.
• Todoist — if you choose to connect it with your personal API token, Pomonaut exchanges data with Todoist strictly to provide the sync you enabled. When you save the token, our servers ask Todoist whether it is valid, which returns your Todoist account. After that they read your open Todoist tasks, your projects and your Todoist account id (used only to skip tasks assigned to someone else, and not stored) when a focus session ends or you pause the timer, and when you sync or import. Todoist does not send us anything on its own. For a task you link to Todoist, what we send includes its title, description, priority, project, due date, deadline, repeat rule, labels and estimate (as Todoist's duration) — a label you use that does not yet exist in your Todoist account is created there. No data is sent to Todoist otherwise.
• Google Calendar — if you connect it, our servers ask Google for the list of your calendars and, for the ones you picked, your free/busy times over the next two days. We do not request, and are not granted, the contents of your calendar entries. Nothing of yours is sent to Google beyond that request, and you can revoke the grant at any time from Settings or from your Google account. Google LLC is certified under the EU-US Data Privacy Framework, which is the basis for that transfer.
• Google LLC / GitHub, Inc. / Apple Inc. (USA) — only if you use "Continue with Google", "Continue with GitHub" or "Continue with Apple". Starting that sign-in sends you to the provider, which means your IP address and browser reach them, and we receive back your account id and verified email address. This happens only when you press the button; if you sign in with a password, nothing is sent to any of them. If you chose Apple's "Hide My Email", the emails we send you pass through Apple's relay on their way to your inbox. All three companies are certified under the EU-US Data Privacy Framework, which is the basis for that transfer.
• Your calendar provider — if you add a calendar feed, our servers request that URL from whichever provider you pointed us at (Google, Apple, Microsoft, or your own server). Only the URL you supplied is sent; the events that come back are forwarded to your browser or app and not retained by us, and none of your other Pomonaut data is sent there.
• People you share a project with — every member of a shared project sees its tasks and the name and email address of the other members. They are fellow users you chose to work with, not processors of ours. An invitation is a single email, sent through SparkPost EU to the address you entered, naming you and the project; the address is not contacted again.
• An app or AI assistant you connect — if you connect one (for example an MCP client such as Claude, ChatGPT or another assistant) or give a personal access token to a tool of your own, it can read and change the data covered by the permissions you approved, and it sends what it reads to wherever that app runs — for an AI assistant, typically the AI provider you chose to use. That provider is not acting on our instructions and is not a processor of ours: like a calendar app you hand a feed link to, it is the service you chose to share your data with. Every app you connected is listed under Settings → Security, where you can disconnect it at any time.
• The address a webhook you add points to — if you add a webhook, our servers send a signed request to the HTTPS address you entered whenever one of your tasks changes — tasks in projects shared with you included — carrying the task as the Pomonaut API returns it: its title, description, dates, priority, labels, project, assignee and the rest. A deleted task is reported by its id alone. Whoever runs that address is not acting on our instructions and is not a processor of ours: like an app you connect, it is the recipient you chose to send your data to. Every webhook is listed under Settings → Integrations, where you can delete it at any time; changing or resetting your password, turning two-factor authentication off, or your account being deactivated deletes them all.
• Whoever you give a calendar feed link to — if you create one and subscribe to it from a calendar app, that app (and whichever provider hosts it, such as Google, Apple or Microsoft) fetches your task titles, descriptions and dates directly from our server using the link. That provider is not acting on our instructions and is not a processor of ours for this purpose — it is the calendar service you chose to hand the link to, the same way pasting any other link into a calendar app would be.

We do not use any analytics, tracking, or advertising services. Every script, stylesheet and font on our pages is served from our own servers, so loading a page contacts no third party — no content delivery network and no Google Fonts.

How long we keep it

• Account data and content are kept for as long as your account exists.
• A passkey is kept until you remove it or delete your account. The one-time challenge of a passkey sign-in, or of adding one, is deleted once it is answered; one left unanswered expires after five minutes and is deleted with the next passkey sign-in anyone starts.
• Focus session history is purged automatically after three months.
• An account that signs up but never confirms its email is deleted automatically 30 days after registration, freeing the email address for a future signup. We send a reminder 2 and 7 days after signup if it is still unconfirmed, and a notice once the account has been removed.
• Data export files are deleted automatically after they expire, along with their record and the underlying file in object storage.
• Calendar events have no retention period here because they are never written to our storage in the first place. Removing a calendar, or disconnecting Google Calendar, stops the reading immediately; clearing your browser's local storage removes the cached copy; the mobile apps hold none to remove. Disconnecting Google Calendar also deletes the calendars you picked from it and the stored grant.
• A calendar feed link you create exists until you revoke or regenerate it, or until the project it belongs to (or your account) is deleted — at most one link per scope (all tasks, or one project) exists at a time, so there is nothing here that accumulates and needs a separate purge job.
• An app's access ends 60 days after it was last used (it has to be connected again after that), a personal access token on the expiry date you picked (at most one year), and both immediately when you revoke them, change or reset your password, turn two-factor authentication off, or your account is deactivated. Expired and revoked tokens are deleted automatically, as are the one-day records that stop an app's retried request from being carried out twice.
• An unanswered project invitation is deleted 14 days after it was sent. When you leave a shared project, or are removed from it, your assignments in it end at once; the record that you were a member is kept for 90 days, so your other devices learn you left, and then deleted. Tasks you added to someone else's project stay in it — they are part of that project — but no longer name you once your account is deleted.
• A webhook exists until you delete it, change or reset your password, turn two-factor authentication off, or your account is deactivated or deleted. One that has done nothing but fail for three days is turned off, but kept so you can turn it back on. It holds only its latest delivery's outcome, never a history, so nothing about it accumulates and needs a purge job.
• A push token is deleted when you sign out of the app (or disconnect it), when Apple or Google report it no longer works, and automatically once the app has not registered it for 60 days; the tokens for the iPhone's lock-screen timer are deleted when the timer ends, and at the latest after 12 hours.
• A browser's notification address is deleted when you turn reminders off in it, when you sign out there (or every sign-in ends, for example on a password change), when its push service reports it no longer works, and automatically once you have not opened Pomonaut in that browser for 60 days.
• A comment is kept until its author deletes it (the owner of a shared project can delete any comment on its tasks), or until the account of its author or of the task's owner is deleted. It stays when its task is removed, as the task does, and when its author leaves the project. It lives no longer than the task and the people it belongs to, so it needs no purge job of its own. No record of the notifications it set off is kept.
• Deleting your account (Settings → Delete account) permanently removes your account and all associated tasks, projects, comments (yours anywhere, and everyone's on your tasks), focus sessions, sessions, connected apps, webhooks, push tokens and browser notification addresses immediately — including your projects, for everyone you shared them with, and your memberships in other people's projects.

Your rights

Under the GDPR, you have the right to:

• Access your data — download a full export of your tasks, projects, focus sessions, calendar subscriptions, calendar feed links, connected apps, webhooks, the projects shared with you and the tasks you added to or are assigned in them, and the comments you wrote, from Settings at any time. The export lists each calendar's name and origin but not the full ICS feed URL, and for a calendar feed link it lists its scope and creation date but never the link's token, since both are credentials. A webhook's signing secret is left out for the same reason.
• Rectify inaccurate data — edit your tasks, projects, and account details directly in the app.
• Erase your data — permanently delete your account and everything in it from Settings, without contacting us.
• Restrict or object to processing, and withdraw consent given for optional integrations, by disconnecting Todoist or Google Calendar, removing a calendar, revoking a calendar feed link, disconnecting an app or access token, deleting a webhook, or unlinking a Google/GitHub sign-in in Settings.
• Data portability — the data export is provided in a structured, machine-readable format (CSV in a zip).
• Lodge a complaint with a supervisory authority — in Germany, the authority for Bavaria is the Bayerisches Landesamt für Datenschutzaufsicht.

For any request that isn't self-service in Settings, reach out via the contact page.

Changes to this policy

If Pomonaut starts processing data differently — a new integration, a new processor — this page will be updated and the date at the top will change.