Privacy Policy

Effective date: 20 September 2026

This Privacy Policy explains how BluePomodoro collects, uses, stores and protects your personal data, and the rights you have under the EU General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).

1. Data controller

Controller: Santiago Vega
Tax ID (NIF): 32944811W
Country: Spain
Contact (privacy and data requests): support@bluepomodoro.com

2. Data we collect

Account data. When you sign in with Google, Apple, Discord or X, we receive your email address, name and profile picture from that provider.
Your content. Tasks, projects, labels, comments, reactions, pomodoro session history and files you upload (attachments).
Preferences. Layout, theme, spaces, task-list width, auto-archive, selected AudioWheel and similar settings.
Team data. Teams you create or join, member roles and the email addresses you invite. Your account email is also visible to the people who share a team with you (that is how a teammate can be contacted), and to nobody else except the founder through the restricted admin panel described in section 3.
Billing data. Your Stripe customer identifier, plan, subscription status and billing currency. Card details are collected and processed directly by Stripe; we never receive or store your full card number.
Anti-abuse data. A salted, irreversible hash of your IP address and email, used only to prevent repeated free trials. We do not store your raw IP address.
Device storage. The app stores your session token and preferences in your browser's local storage. We do not use advertising or tracking cookies.

3. Why we use your data and legal bases

To provide the service (account, tasks, sync, audio, teams): performance of a contract.
To process payments and subscriptions: performance of a contract.
To prevent abuse of free trials and secure the service: our legitimate interest.
To operate, secure and support the service: our legitimate interest. The founder can access account metadata and aggregates (signups, plans, usage totals) through a restricted admin panel to run the service and answer support requests. Task contents, messages and files are excluded from it.
To send service and team emails (for example, team invitations): performance of a contract and our legitimate interest.

We do not sell your personal data, we do not use it for advertising, and we do not send marketing emails.

4. Who processes your data (sub-processors)

Supabase: database, authentication and file storage (hosted in the European Union, Ireland).
Vercel: website hosting.
Stripe: payments and subscription management.
Resend: transactional emails (team invitations) and the email-to-task address: it receives the messages you forward and delivers the notifications we send.
OpenAI: reads the text of an email you forward and turns it into a task. The text is processed to answer the request and is not used to train their models; we ask them not to store it (see section 5).
Google: sign-in (OAuth) and automated moderation of uploaded images.
Apple, Discord and X: sign-in providers, when you choose to use them.

Your core data is stored in the European Union. Some providers (for example Stripe, Resend or Google) may process limited data outside the EEA; these transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

5. How long we keep your data

Account and content: until you delete your account.
Items you delete: removed permanently within 30 days.
Notifications: up to 90 days.
Anti-abuse hashes: up to 180 days.
Technical logs: up to 7 days.
Emails you forward to a task: the copy we keep is part of that task and disappears with it. The AI provider is asked not to store the text (no training, no application storage); their abuse-monitoring logs are deleted within 30 days.

6. Your rights

You have the right to:

access the personal data we hold about you;
request correction of inaccurate data;
request deletion of your data (right to be forgotten);
receive your data in a portable format;
request restriction of, or object to, certain processing;
withdraw any consent you have given at any time.

You can exercise most of these rights from your account (export your data and delete your account), or by emailing support@bluepomodoro.com. You also have the right to lodge a complaint with the Spanish data protection authority, the AEPD.

7. Cookies and local storage

BluePomodoro uses your browser's local storage for essential and functional purposes: to keep you signed in and to remember your preferences and your cookie choice. Because these are strictly necessary to provide the service you request, they do not require consent. You can clear them at any time from your browser settings.

With your consent, we also use cookies for analytics (Google Analytics, to understand how the product is used) and, when we run campaigns, for marketing measurement. These stay off until you accept them in the cookie panel, and you can change your mind at any time from the "Cookie settings" link in the footer.

8. Children

BluePomodoro is intended for people aged 14 or older. We do not knowingly collect personal data from children under 14. If you believe a child under 14 has provided us with data, contact us and we will delete it.

9. Security

We apply appropriate technical and organisational measures to protect your data, including encryption in transit, row-level security so that each account can only access its own data, and server-side handling of payment and anti-abuse information.

10. Changes to this policy

We may update this policy from time to time. Material changes will be announced in the app. The effective date at the top shows the latest revision.

11. Contact

Questions about this policy or your data? Email support@bluepomodoro.com.