Privacy Policy

Who is responsible

Dominik Liebler, Leonhard-Frank-Str. 5a, 97855 Triefenstein, Germany, is the controller responsible for the data processed by Pomonaut within the meaning of Art. 4(7) GDPR. Contact: support@pomonaut.com. See also our contact page.

What data we collect

Pomonaut only collects what the app needs to function:

• Account data — email address and, if you set one, a bcrypt password hash. Passwords themselves are never stored. An account created through Google or GitHub has no password at all.
• Your content — tasks, projects, and focus session history you create in the app.
• Your preferences — the settings you choose in the app: timer lengths, focus mode, auto-start, notification sound, theme, and whether you have been through the dashboard tour. These stay on our server so the app behaves the same on every device you sign in from. Notification sounds are generated in your browser, not fetched from anyone.
• Two-factor authentication — a TOTP secret and backup codes, if you enable 2FA, stored encrypted.
• Todoist / Spotify / Google Calendar integration tokens — OAuth access and refresh tokens, only if you connect those services, stored encrypted. The Google Calendar grant is deliberately the narrowest one Google offers: it can list your calendars and read only your free/busy times — not the titles, attendees, locations or descriptions of your entries — and it cannot create, change, or delete anything.
• Social sign-in — if you sign in with Google or GitHub: the provider's name, your account id at that provider, and the email address it reports. No access token is kept — the token from the sign-in handshake is used once, to read those details, and then discarded.
• Calendar subscriptions — either the iCal/ICS URLs you add in Settings, stored encrypted because such a URL is itself the access credential to the calendar behind it, or, if you connect Google Calendar, the ids and names of the calendars you pick from that account. In the Google case we never receive what your entries are called: the dashboard shows them as "Busy". Your calendar events are never stored on our servers: they are read from your calendar provider when you open the dashboard and after each focus session, passed straight to your browser, and cached only there — in your browser's local storage — until you clear it or remove the calendar.
• Technical data — session cookies to keep you signed in, and server logs (IP address, timestamp, requested path) kept only as long as needed to operate and secure the service.

Why we process it (Art. 6 GDPR)

• Contract performance (Art. 6(1)(b)) — providing the account, task management, and timer features you sign up for. Signing in with Google or GitHub falls here rather than under consent: where you choose it, it is how your account is authenticated, not an optional extra.
• Consent (Art. 6(1)(a)) — connecting third-party integrations (Todoist, Spotify, Google Calendar) and adding calendar feeds, all of which you explicitly opt into and can disconnect or remove at any time.
• Legitimate interest (Art. 6(1)(f)) — operating server logs to keep the service secure and debug failures.

Encryption

Passwords are hashed with bcrypt and never stored in recoverable form. OAuth tokens (Todoist, Spotify, Google Calendar), calendar feed addresses, and two-factor secrets are encrypted at rest with AES-256-GCM before they touch the database. Social sign-in stores no credential at all, so there is nothing there to encrypt. Regular content — task titles, project names, focus session snapshots — is stored as plain text so it can be searched and exported; it is protected by access control and transport encryption (TLS), not field-level encryption.

Where your data is hosted

The infrastructure we operate runs entirely in the EU:

• Application servers & database — Hetzner Online GmbH (Germany), on a Kubernetes cluster we operate ourselves. Your account, tasks, projects, and focus sessions live in a PostgreSQL database on this infrastructure.
• File storage — Hetzner Object Storage (S3-compatible, Nuremberg, Germany), used only to hold your generated data-export zip files until you download them or they expire.
• Transactional email — SparkPost EU, used to send account confirmation, password reset, and security notification emails. Only your email address and the relevant message content are shared with SparkPost EU for this purpose.
• Todoist / Spotify — if you choose to connect these services, Pomonaut exchanges data with them (via OAuth) strictly to provide the sync/playback features you enabled. No data is sent to them otherwise.
• Google Calendar — if you connect it, our servers ask Google for the list of your calendars and, for the ones you picked, your free/busy times over the next two days. We do not request, and are not granted, the contents of your calendar entries. Nothing of yours is sent to Google beyond that request, and you can revoke the grant at any time from Settings or from your Google account. Google LLC is certified under the EU-US Data Privacy Framework, which is the basis for that transfer.
• Google LLC / GitHub, Inc. (USA) — only if you use "Continue with Google" or "Continue with GitHub". Starting that sign-in sends you to the provider, which means your IP address and browser reach them, and we receive back your account id and verified email address. This happens only when you press the button; if you sign in with a password, nothing is sent to either. Both companies are certified under the EU-US Data Privacy Framework, which is the basis for that transfer.
• Your calendar provider — if you add a calendar feed, our servers request that URL from whichever provider you pointed us at (Google, Apple, Microsoft, or your own server). Only the URL you supplied is sent; the events that come back are forwarded to your browser and not retained by us, and none of your other Pomonaut data is sent there.

We do not use any analytics, tracking, or advertising services.

How long we keep it

• Account data and content are kept for as long as your account exists.
• Focus session history is purged automatically after three months.
• An account that signs up but never confirms its email is deleted automatically 30 days after registration, freeing the email address for a future signup. We send a reminder 2 and 7 days after signup if it is still unconfirmed, and a notice once the account has been removed.
• Data export files are deleted automatically after they expire, along with their record and the underlying file in object storage.
• Calendar events have no retention period here because they are never written to our storage in the first place. Removing a calendar, or disconnecting Google Calendar, stops the reading immediately; clearing your browser's local storage removes the cached copy. Disconnecting Google Calendar also deletes the calendars you picked from it and the stored grant.
• Deleting your account (Settings → Delete account) permanently removes your account and all associated tasks, projects, focus sessions, and sessions immediately.

Your rights

Under the GDPR, you have the right to:

• Access your data — download a full export of your tasks, projects, focus sessions, and calendar subscriptions from Settings at any time. The export lists each calendar's name and origin but not the full ICS feed URL, since that URL is a credential.
• Rectify inaccurate data — edit your tasks, projects, and account details directly in the app.
• Erase your data — permanently delete your account and everything in it from Settings, without contacting us.
• Restrict or object to processing, and withdraw consent given for optional integrations, by disconnecting Todoist/Spotify/Google Calendar, removing a calendar, or unlinking a Google/GitHub sign-in in Settings.
• Data portability — the data export is provided in a structured, machine-readable format (CSV in a zip).
• Lodge a complaint with a supervisory authority — in Germany, the authority for Bavaria is the Bayerisches Landesamt für Datenschutzaufsicht.

For any request that isn't self-service in Settings, reach out via the contact page.

Changes to this policy

If Pomonaut starts processing data differently — a new integration, a new processor — this page will be updated and the date at the top will change.