Privacy Notice
Last updated: 7 October 2026
PomoSouls is a free focus timer that runs in your browser. This notice explains, in plain words, what happens to your data — without an account, with an account, and when you leave. It applies to the web app served at this address. The Turkish data-protection notice (KVKK aydınlatma metni) is at /kvkk; the terms of use are at /terms.
1. Who is responsible
The controller of your data is Ömer Faruk Tatar, a natural person operating PomoSouls. Contact: privacy@pomosouls.com.
2. Using PomoSouls without an account
You do not need an account. Without one, everything you do stays in your browser: your tasks, sessions and settings are written to this site's IndexedDB database (named pomosouls, store kv) and to localStorage (the keys pomo:journal and zenith:*, which hold a fallback and a rollback copy). None of it is sent to our server: without an account the app only asks our server whether this browser is signed in, a request that carries none of your data and stores nothing. When the app crashes, with or without an account, it sends the error message, the technical trace, the page path, the page language and the first 160 characters of your browser's user-agent string to our server logs so we can fix the bug; we do not attach your account or e-mail address, and the report itself does not contain your IP address. The requests that load the page itself pass through Cloudflare like on any website (see section 5). If you clear this site's data in your browser, that information is gone and we cannot recover it.
3. What we store when you create an account
Account
Your e-mail address; your password only as a scrypt hash (N = 2^14, r = 8, p = 5) — the password itself is never stored or logged; the time your address was verified; your plan (free); and the time the account was created.
Synced content
With an account, the app's data is also stored on our server so that your devices share it: tasks (title, notes, subtasks, category, priority, due date, estimated pomodoros, order, created and completed times), categories, focus sessions (task or category, type, planned and actual minutes, start and end times), XP events, your timer, sound, notification, world and daily-goal settings, the music player state (the YouTube link you pasted and its volume), sound levels, the active task and the daily challenges. Each stored record version carries a random device identifier so that conflicts between your devices can be resolved. The following stay on the device and are never synced: theme, dashboard mode, focus variation, live background, tray and launch flags, the UI volume and the onboarding state.
Sessions
Each browser you sign in with receives one random session token, which we store only as a hash. For each session we keep a device label (the first 64 characters of the browser's user-agent string), when it was created, when it was last used and when it expires. A session lasts 30 days from its last use.
Security data
- One-time links: the verification link is valid for 24 hours, the password-reset link for 30 minutes. We store their tokens hashed; a verification link additionally carries the scrypt hash of the password chosen at that sign-up until the link is used or removed. Both are removed one day after the link expires.
- Failed sign-ins: we count failed sign-in attempts per e-mail address — also for addresses that have no account. After 5 failures within 15 minutes the address is locked for a doubling period of up to 24 hours. The counter is removed on a successful sign-in or password reset; otherwise the daily clean-up removes it once any lock has ended and at least one day has passed since the first failed attempt.
Your IP address
Your IP address is never stored in our database. It is used in memory to limit requests (at most 10 authentication requests and 120 crash reports per 60 seconds per IP address) and it is sent to Cloudflare Turnstile together with the human check on sign-up and password reset.
4. E-mails we send
We send only service messages: the verification link when you sign up, a notice when someone tries to sign up with your address, and the password-reset link when you ask for one. We send no newsletters and no marketing.
5. Who else processes your data
- Cloudflare, Inc. acts as our processor: it hosts the app and the API, runs the database (D1), delivers our e-mails (Cloudflare Email Service), provides the human check (Turnstile), the request limiting, the cookie-free visit counting (Web Analytics) and the server logs that hold crash reports. Cloudflare's servers may be located outside Türkiye and the European Union.
- YouTube (Google), only if you open the music player: the player is loaded from
youtube-nocookie.com/youtube.com, and Google processes that request as an independent controller under its own policies. Until you open the player, the app contacts no Google service.
We count visits with Cloudflare Web Analytics: it sets no cookies, does not follow you across sites and shows us only totals such as page views, load times, referring sites, browsers and countries. We show no advertising and never sell your data.
6. Cookies
PomoSouls sets exactly one cookie, __Host-pomo_sid, which carries your session while you are signed in. It is strictly necessary, HttpOnly, Secure, SameSite=Lax and lasts 30 days. There are no other cookies, and none at all while you are not signed in.
7. How long we keep data
Server-side clean-up runs once a day, so each period below ends at the next daily run.
| Account and synced content | until you delete the record or the account. |
|---|---|
| Deleted-record markers | 90 days (so your other devices learn about the deletion). |
| Sessions | until you sign out, or 30 days after their last use. |
| Verification and reset tokens | removed one day after they expire (24 hours and 30 minutes respectively). |
| Failed sign-in counters | removed on a successful sign-in or reset; otherwise by the daily clean-up once any lock has ended and a day has passed since the first failure. |
| Unverified accounts | if the address was never verified: deleted 7 days after sign-up, or when the last verification link expires if that is later, together with everything stored for them. |
Deleting your account removes every server row tied to it at once. In the browser you delete from, the synced copy is removed as well if that browser was linked to the account (a snapshot taken before its first link, if there is one, stays and can be restored as a guest). On your other devices the local copy stays until you sign out there or clear this site's data; in a browser that was not linked it stays until you clear this site's data. Cloudflare's own platform logs follow Cloudflare's policy.
8. Your rights
You can exercise your rights directly in the app: download your data (Account & sync → Download my data), correct it (edit it in the app; the change syncs), and delete it (delete a record, or delete the account). You can also write to privacy@pomosouls.com from the e-mail address registered to your account to access, correct, delete or object; we answer within 30 days, free of charge. The rights under Turkish law (KVKK article 11) are listed in full on /kvkk. You may complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) and, if you are in the European Union, to your supervisory authority.
9. Legal bases
We process your account, your synced content and the service e-mails because they are necessary to perform the contract you enter when you create an account (KVKK article 5/2-c; GDPR article 6(1)(b)). We run request limiting, sign-in lockouts and the Turnstile human check out of our legitimate interest in keeping the service secure (KVKK article 5/2-f; GDPR article 6(1)(f)). No processing relies on your consent, which is why there is no consent checkbox.
10. Transfers abroad
Cloudflare may process your data on servers outside Türkiye and the European Union. Under Turkish law this transfer relies on KVKK article 9/4-c (as amended by Law No. 7499, in force since 1 June 2024) with an appropriate safeguard: the standard contract announced by the Personal Data Protection Board, which is notified to the Authority within five business days of signature (article 9/5).
11. Age
You must be at least 16 years old to create an account, or have your parent's or guardian's permission. Using PomoSouls without an account needs no age check, because we hold no data about you.
12. Changes
When this notice changes, we announce it in the app and update the date at the top of this page.