Privacy

Data stored in your browser

To remember things between visits, Tomatock uses your browser's localStorage on this device. By default and for its core timer features, Tomatock itself sets no cookies (optional Google Analytics follows regional privacy controls). It stores:

• Your settings, such as session lengths, sounds, theme and auto-start options.
• Your task list, including titles, estimates and finished sessions.
• Your session history: when each session started and ended, its length and the task it belonged to.
• The state of a running timer, so it can continue after a refresh.

This data is never sent to us or to anyone else. We cannot see it, recover it or delete it for you. It is not synced between devices or browsers.

How to export or delete your data

• Export: open the report and download your history as CSV or JSON.
• Delete: use the clear-all-data option in the report, or clear the site data for this website in your browser settings.
• Private windows: data saved in a private or incognito window is removed when you close the window.

Some browsers delete data from sites you have not used for a while, and clearing your browsing history can remove it too. If your history matters to you, export it from time to time.

What we do not use

• No accounts and no sign-in.
• No advertising, no Google Signals and no ad networks.
• No advertising trackers; first-party server statistics run without cookies, and optional Google Analytics follows regional consent and opt-out controls.
• Core timer scripts and assets run locally; no remote fonts or unconsented tracking scripts.
• Your timer tasks, settings and focus history are never sent to external servers or analytics.

Optional page analytics

Tomatock may offer optional Google Analytics 4 to understand general visitor traffic under regional privacy policies. In regions requiring prior consent (EEA, UK, Switzerland, and conservative jurisdictions) or where visitor region is unknown, measurement only activates if you explicitly choose Allow in the footer settings. In other recognized regions, measurement is enabled by default with opt-out available at any time via the footer settings. If your browser sends a Global Privacy Control (GPC) or Do Not Track (DNT) signal, Google analytics remains completely inactive. Choosing not to allow analytics or opting out never restricts access to any timer feature.

When enabled, Google Analytics uses pseudonymous cookies (such as _ga, expiring in up to 180 days) to distinguish unique visits, and your choice is remembered in localStorage for up to 180 days (or temporary memory if storage is unavailable). Google receives standard connection metadata, including your IP address, browser type, device details, referring domain, and clean page paths without timer tasks or settings. While advertising features, Google Signals, and ad personalization are disabled with no cross-site identification, network requests naturally touch your IP address and we do not claim complete anonymity. Data may be processed on servers outside your country by Google and its affiliates. Learn how Google uses information from sites at policies.google.com/technologies/partner-sites and see Google's privacy policy at policies.google.com/privacy.

User and event data retention in Google Analytics is limited to 2 months with reset on new activity disabled; aggregate reports may remain longer. You can opt out or withdraw consent at any time via the footer settings; doing so immediately stops data collection and clears Google analytics cookies without affecting your stored timer history.

Notifications and sound

If you allow notifications, your browser shows them locally when a session ends. We do not run a push service and we do not receive your permission choice. Alert sounds are generated in the page; no audio files or recordings are involved, and Tomatock never uses your microphone or camera.

Hosting, Cloudflare and server logs

Tomatock runs on our own server and is delivered through Cloudflare, which acts as a content delivery network and security proxy. To deliver and protect the site, Cloudflare processes technical data about each request, such as your IP address and browser information. Cloudflare handles that data under its own privacy policy: cloudflare.com/privacypolicy

Our server also keeps standard access logs. For each request they may record the IP address, date and time, the page or file requested, the response status, the referring page and the browser's user agent. The logs are rotated daily and kept for about 14 days at most.

We use these logs only to operate the site and keep it secure. We do not build user profiles from them, sell them or share them with third parties, apart from the request data Cloudflare processes under its own policy as described above.

Visit statistics

Separately from these logs, our server counts page views for its own statistics, without cookies, scripts or any third-party analytics service. For each page view it keeps the time, the page path and language, the country code supplied by Cloudflare, the host name of the referring website (not the full address), a coarse device type, operating system and browser type, and whether the request came from a known crawler. These statistics do not store your IP address or your full user agent.

To count unique visitors, the server combines the IP address and user agent with a random value that changes every day and keeps only the resulting irreversible hash, so visits on different days cannot be linked. These records are deleted after 14 days; after that only daily totals remain, kept for 90 days. Your tasks, settings and history are never part of these statistics.

When you email us

If you write to contact@tomatock.com, the message is received by the email routing service of Cloudflare, which passes it on to the mailbox our operators read, hosted by Google (Gmail), and also hands a copy to a small program we run on Cloudflare, which keeps it only until our own server has fetched it — normally within minutes and never longer than 14 days. Our server, hosted by Google Cloud in the United States, keeps your email address and name, the subject, the text of the message, the technical headers and the names and sizes of any attachments (not the attachments themselves) in our internal support list for up to 180 days and then deletes them. Cloudflare's delivery log records the sender and recipient addresses, the subject and the result of the delivery for about a month. We use your message only to answer you, keep it only as long as we need it and delete it when you ask us to.

Changes and contact

If this policy changes, we will update this page. Questions about privacy can be sent to contact@tomatock.com.

• Back to the timer
• About Tomatock