Privacy Policy

This Privacy Policy explains how Joshua & Company Inc ("we", "us") handles information in connection with the Pomodoro+ mobile application for iOS and Android (the "App"). It applies to the App and to the services it connects to. Please read it before using the App.

1. Who we are

The data controller responsible for the App is:

• Joshua & Company Inc
• Contact: support@joshuanco.com

If you have any question about this policy or about how your data is handled, email us at the address above.

2. Information we collect

2.1 Data stored on your device

The core of Pomodoro+ works offline. The following is created by you and stored locally on your device, in the App's private storage:

• Focus session records — start time, end time, duration, whether the session was completed, the focus mode it belonged to, and the daily goal that applied at the time.
• Focus intervals — the individual work and break segments that make up a session.
• App settings — focus and break durations, sessions before a long break, daily goal, first day of the week, 12/24-hour time format, auto-advance preference, your custom focus modes, and theme/color preferences.

We cannot see this data. It never leaves your device unless you enable Cloud Sync (section 2.2), and it is removed when you uninstall the App.

2.2 Account and Cloud Sync (optional)

Cloud Sync is off by default. If you choose to turn it on, you sign in with Google Sign-In or Sign in with Apple through Firebase Authentication. In that case we process:

• Account identifiers — a Firebase user ID (UID), and the email address and display name released by Google or Apple during sign-in. If you use Sign in with Apple and choose "Hide My Email", we only ever see Apple's relay address.
• Synced app data — the focus session records and app settings described in section 2.1, stored in Google Cloud Firestore under a document path tied to your UID (users/{uid}).

The purpose is strictly to let you restore your history and settings on another device. We do not read this data for any other reason, and we do not use it for advertising or profiling.

2.3 Purchases and subscriptions

Premium purchases are processed by Apple's App Store or Google Play. We use Adapty as our purchase infrastructure to validate receipts and determine whether your Premium entitlement is active. This involves a pseudonymous customer identifier, the store transaction/receipt, product identifiers, and subscription status.

We never receive or store your payment card details, billing address, or full store account credentials. Those stay with Apple and Google.

2.4 Advertising

The free version of the App shows interstitial ads served by Google AdMob. To serve and measure ads, Google may process:

• your device advertising identifier — the Google Advertising ID (AAID) on Android, or the Identifier for Advertisers (IDFA) on iOS;
• IP address and coarse location derived from it;
• device and app information such as device model, operating system version, and app version;
• ad interaction events such as impressions and clicks.

This processing is carried out by Google as an independent party under its own privacy policy. Purchasing Premium removes ads and stops this ad-serving processing.

2.5 Device permissions

The App requests a small number of system permissions. They are needed for the timer to work reliably and are not used to collect information about you:

The App does not request access to your contacts, camera, microphone, photos, precise location, calendar, or health data.

3. How we use information

• To provide the App — running timers, recording your sessions, showing your statistics and calendar.
• To sync across your devices — only when you have signed in and enabled Cloud Sync.
• To unlock and restore Premium — verifying your purchase and keeping your entitlement active.
• To show ads in the free version — through Google AdMob, subject to your consent choices where required.
• To respond to you — when you contact support by email.

We do not use your data to build advertising profiles, and we do not sell or rent personal information to anyone.

4. Legal bases for processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR:

5. Third-party services

We use the following providers. Each processes data under its own privacy policy:

6. Advertising choices

• Remove ads entirely — purchase Pomodoro+ Premium.
• EEA, UK and other consent regions — on first launch you are shown Google's consent form. You can change your choice at any time in Settings → Privacy options inside the App.
• iOS — the App asks for App Tracking Transparency permission. You can change it at any time in iOS Settings → Privacy & Security → Tracking. If you decline, ads are still shown but are not personalized using your IDFA.
• Android — you can reset or delete your advertising ID in Android Settings → Privacy → Ads.
• Google ad settings — manage your Google-wide ad personalization at myadcenter.google.com.

7. Data retention and deletion

• On-device data is kept until you delete it in the App or uninstall the App. Uninstalling removes the App's local database and settings.
• Synced data is kept in Firestore for as long as Cloud Sync is enabled on your account. Using the account-deletion option in the App deletes your session documents, your settings document, and your user record from our Firestore database.
• Purchase records are retained by Adapty, Apple, and Google for as long as required for entitlement management, accounting, and tax obligations.
• Support emails are kept only as long as needed to resolve your request.

You can also email support@joshuanco.com to request deletion, and we will action it within 30 days.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, to withdraw consent, and to receive a copy of your data in a portable format. Residents of the EEA/UK (GDPR), California (CCPA/CPRA), Korea (PIPA), and other jurisdictions with comparable laws all have such rights.

Because most data stays on your device, you can exercise many of these rights directly in the App. For anything else, email support@joshuanco.com and we will respond within the period required by applicable law.

We do not sell or share personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. EEA/UK residents also have the right to lodge a complaint with their local supervisory authority.

9. International data transfers

Our providers — Google, Apple, and Adapty — operate globally, so data may be processed on servers outside your country, including in the United States. Where required, these transfers rely on the European Commission's Standard Contractual Clauses or another approved transfer mechanism put in place by the relevant provider.

10. Security

Data on your device is stored in the App's private, sandboxed storage. Data in transit is encrypted with TLS. Synced data in Firestore is protected by security rules that restrict every document to the authenticated account that owns it, and is encrypted at rest by Google Cloud. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.

11. Children's privacy

Pomodoro+ is a general-audience productivity app and is not directed to children under the age of 13 (or under 16 where local law sets a higher age). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact support@joshuanco.com and we will delete it.

12. Changes to this policy

We may update this policy as the App evolves or as the law requires. When we do, we will revise the "Last updated" date at the top of this page. For material changes we will provide additional notice in the App. Continuing to use the App after an update means you accept the revised policy.

13. Contact us

Questions, requests, or complaints about this policy:

• Joshua & Company Inc
• Email: support@joshuanco.com