Privacy Policy

The short version

• You can use the timer without an account. Then your sessions stay on your phone.
• If you sign in (email, Google or Apple), your meditation sessions are also saved in the cloud, so you can see them on all your devices.
• Presets, reminders and stones stay on your phone.
• We use Google Firebase for sign-in, backup, crash reports and usage statistics, PostHog for usage statistics and RevenueCat to manage purchases.
• You can delete your account and its cloud data inside the app.
• No ads, no advertising ID, no selling of data.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is the publisher of the app in the store you downloaded it from:

App Store (iPhone, iPad): Digital Snacks OG, Servitengasse 10/14, 1090 Vienna, Austria

Google Play (Android): Josef Wilhelm, Wolfgang-Schmälzl-Gasse 12/20, 1020 Vienna, Austria

Email for all questions: me@josefwilhelm.com

2. Data that stays on your device

The app stores these on your phone:

• your sessions (date, length, type of session) if you do not sign in
• your presets, reminder settings and stones
• your sound, bell and app settings

Presets, reminders and stones are never uploaded. Reminders are local notifications scheduled by your phone; the app only asks for the notification permission after you agree. Uninstalling the app deletes this data. Phone backups (iCloud, Google) may contain a copy, depending on your phone's settings.

3. Account and cloud backup

An account is optional. You can create one with email and password, or sign in with Google or Apple. We receive your email address (or the one Apple or Google gives us) and a user ID. For email sign-in, Firebase handles your password.

When you are signed in, each session you save is stored in Google Cloud Firestore under your user ID: start time, day, length, planned length, type (timer, count-up, manual, guided or breathing), the chosen preset, guided session or breathing exercise, a device ID and sync times. Only you can read or write your data; the security rules check this. If you used version 1.x of the app with an account, your old cloud sessions are imported. Profile pictures from version 1.x, if you uploaded one, are stored in Firebase Storage.

When you sign in on a phone that already has sessions without an account, they are moved to your account.

4. Services that receive data

Firebase Authentication, Firestore, Storage, App Check and Remote Config (Google Ireland Ltd.): sign-in, session backup, a check that requests come from the real app, and switches we can change without an app update. Google receives your user ID, IP address and device and app information.

Firebase Analytics (Google Ireland Ltd.): usage events such as screens viewed, onboarding steps, paywall viewed, purchase started or completed. We do not send free text. The advertising ID is not collected.

Firebase Crashlytics (Google Ireland Ltd.): crash reports with the error trace, device model, operating system and app version.

PostHog (PostHog, Inc., EU cloud): the same usage events as Firebase Analytics, plus whether you have Pro. If you are signed in, they are linked to your user ID; without an account they stay anonymous. We switched off automatic capture of taps and screens and session recordings. PostHog never receives the content of your sessions.

RevenueCat (RevenueCat, Inc., USA): your user ID (a random ID if you are not signed in, your account ID if you are) and the purchase receipts from Apple or Google (product, price, country, dates). It is used to tell whether you have Pro and to restore purchases.

Apple and Google process your payment and, if you use it, your sign-in with them under their own privacy policies. We never see your payment details.

5. Legal bases

• Account, backup and purchase check: Art. 6(1)(b) GDPR (providing the app and what you bought).
• Crash reports: Art. 6(1)(f) GDPR (our interest in an app that works).
• Usage statistics: Art. 6(1)(f) GDPR (our interest in improving the app).
• Purchase records: Art. 6(1)(b) and (c) GDPR. Kept as long as tax law requires (in Austria 7 years).

We do not make automated decisions about you with legal or similarly significant effects.

6. Transfers outside the EU

Google and RevenueCat may process data in the USA. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46 GDPR).

7. Deleting your data

In the app, open the account page and choose "Delete account". This deletes your account and all sessions saved in the cloud. You choose whether to keep your sessions on this device. Our payment provider RevenueCat keeps purchase receipts as tax law requires; you can ask us to delete them too. Details: Delete your data.

8. Your rights

You have the right to access, correction, deletion, restriction, data portability and objection, and to withdraw consent at any time. Write to me@josefwilhelm.com.

You can also complain to a data protection authority, in Austria the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna.

9. Children and changes

The app is not directed at children under 16.

If the app starts using data in a new way, we update this page and the date at the top. See also the Terms of Use.