Privacy Policy

Last updated: April 16, 2026

This policy covers PomoDo's Free tier and all Pro plans (Trial ₹9/3 days, Monthly ₹99/month, Annual ₹499/year). See the About page for plan details.

PomoDo ("we", "our", "the app") is a pomodoro timer and todo list application. We respect your privacy and are committed to protecting your personal data.

1. Information We Collect

Depending on how you sign in, we collect:

Google Sign-In: name, email address, and profile picture provided by Google.
Email / Password Sign-In: the email address you register and an optional display name. Passwords are never visible to us — they are stored and verified by Google Firebase Authentication using industry-standard hashing.
Guest mode: no account is created and no personal data leaves your device.

We also store your todo list, timer and alarm-sound preferences, subscription status, and focus streak data.

2. How We Store Your Data

All signed-in user data is stored in Google Firebase Firestore.
Firestore Security Rules enforce strict per-user data isolation — each user can only read and write their own documents. No other user or unauthenticated party can access your data.
Guest data lives only in your browser's localStorage and never reaches our servers.

3. How We Use Your Information

To provide and maintain the app's functionality.
To sync your data across devices when you sign in (Pro tier).
To process payments via Razorpay for Pro subscriptions.
To send transactional emails: account verification, password reset, subscription confirmation, and a 3-day-before-expiry renewal reminder.
To generate PDF and Excel reports that only you can download.

4. Third-Party Services

Google Firebase — Authentication (Google and Email/Password providers) and data storage (Firestore).
Razorpay — Payment processing (PCI DSS compliant). We never see or store your card details.
Vercel — Web hosting and serverless functions for transactional email.
Gmail SMTP — Delivery channel for transactional emails from our admin account.

We do not sell, trade, or share your personal data with any other third parties.

5. Data Security

Firebase Security Rules for per-user data isolation (request.auth.token.email == userEmail).
HTTPS for all data in transit.
Passwords handled exclusively by Firebase Authentication — we never see or store them.

6. Cookies & Local Storage

We do not use advertising or tracking cookies. We use localStorage on your device to: remember your session, keep the app usable offline, store guest-mode data, and persist your focus streak. You can clear this at any time from your browser settings.

7. Subscriptions & Cancellations

All PomoDo paid plans are one-time payments with no auto-renewal. You can cancel your active subscription at any time from the User Menu or Pricing Modal — a confirmation dialog will show you exactly what you'll lose before the cancellation is finalized. Cancelling takes effect immediately; no pro-rated refunds are issued for the remainder of your paid period, but you retain Pro access until the originally-scheduled expiry date.

8. Data Retention & Deletion

Your data is retained as long as you have an active account. You can delete your account and all associated data at any time by emailing pomodo.support@gmail.com from the address on file.

9. Your Rights

You have the right to access, correct, export, or delete your personal data. For any of these requests, contact us at pomodo.support@gmail.com.

10. Children's Privacy

PomoDo is not directed at children under 13. We do not knowingly collect personal information from children under 13.

11. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with a new "Last updated" date.

12. Contact

For questions about this privacy policy, contact: pomodo.support@gmail.com

← Back to PomoDo