Privacy policy

1. Information we use

• Your focus activity: the name you choose, project and task names, session dates and focus minutes, streaks, personal reward promises, timezone, and app settings.
• Your account: if you sign in, we process your email address, account identifier, and authentication information needed to keep you signed in.
• Usage information: visits to the app and landing page, clicks on start buttons, project creation, session starts and ends, session length, completed focus days, streak counts, and sign-ins. We also collect browser type, operating system, device type, screen size, whether you opened the installed app, and the page address without its query string or fragment.
• A browser identifier: we store a randomly generated identifier in your browser to recognize repeat visits from that browser. It is not linked to your Norimate account or email in our analytics.
• Technical information: our hosting, authentication, email, and analytics providers may process IP addresses, request times, and service logs when handling requests.
• Messages you send us: if you contact us, we use the information in your message to respond.

Our analytics events do not include your email, name, project names, task text, or reward promises. We do not record your screen or automatically track what you type. The timer records sessions you start in Norimate, not your activity in other apps.

2. When you sign in with Google

If you choose Google sign-in, Google shares basic account information with our authentication provider, Supabase. This can include your Google account identifier, email address and verification status, name, and profile picture. Supabase may store this information with your account.

We use this information to identify you, create or sign you into your Norimate account, and connect you to your saved progress. We do not receive your Google password or request access to your Gmail messages, Google Drive files, calendar, or contacts.

We do not sell Google user data, use it for advertising, or use it to train AI models. Norimate’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

You can remove Norimate’s access from your Google Account connections. Removing access there does not automatically delete your Norimate account or saved progress; see the deletion options below.

3. Why we use this information

We use your information to run the timer, save your history and settings, provide sign-in and account syncing, deliver sign-in emails, respond to requests, keep the service secure, and understand which features people use so we can improve Norimate.

4. What stays in your browser

Without an account, your focus history and settings stay in this browser’s local storage. General usage and technical information may still be sent to our service providers. Clearing your browser’s site data removes the local copy of your progress.

When you sign in, a copy of your project history and settings is stored in Supabase and synced between devices. The running timer and selected project remain specific to the device you are using. Authentication information is also saved in browser storage so you can stay signed in.

Norimate uses local storage for these features and for its analytics identifier. It also uses a service worker and browser cache to load app files, fonts, images, and sounds offline. Our analytics integration does not set analytics cookies. Google and other providers may use their own cookies on their services.

5. Services that help us run Norimate

• Vercel hosts the website and handles requests to it.
• Supabase handles sign-in and stores account details and synced progress.
• Resend delivers email sign-in codes and processes the email address and delivery information needed for those messages.
• PostHog processes usage events and device information through its European analytics endpoint.
• Google handles authentication when you choose Google sign-in.

These services process information to provide their functions. Their systems may process information in countries other than yours. Data may also be disclosed where required by law or necessary to address abuse or protect the service. We do not sell your personal information.

6. Your choices and deleting your data

• Use Norimate without an account: you can use the focus timer without sharing an email address or Google profile with Norimate.
• Delete your account: open the app, go to Settings, and choose the account deletion option. This removes your account and synced progress from the active account database and resets the current device’s app state.
• Remove local data: clear Norimate’s site data in your browser on each device you used. An offline device can retain a local copy until it reconnects or you clear it.
• Manage Google access: remove Norimate from your Google Account connections if you no longer want to use Google sign-in.
• Ask for help: contact us to request access to, correction of, or deletion of personal information. Depending on where you live, you may also have rights to receive a copy, object to certain uses, restrict processing, or complain to your local privacy regulator.

Deleting your account does not automatically delete analytics events, because the analytics browser identifier is not linked to your account. Clearing site data removes that identifier from your browser but does not erase events already received. Contact us for help with a privacy request; we may need information to locate the relevant records and verify the request.

7. How long information is kept

Local information stays until you clear it or your browser removes it. Synced account information is kept while your account exists, unless you remove it through the app. Operational logs, analytics, and backup copies have separate retention periods controlled by the relevant service settings; account deletion does not immediately erase those copies. Information may be retained where needed for security, legal obligations, or resolving a request.

8. Keeping information safe

Norimate uses encrypted HTTPS connections. Access rules restrict synced progress to the account it belongs to. No online service or device can be guaranteed completely secure. Please avoid placing sensitive information in project names, tasks, or reward promises.

9. Changes to this policy

We may update this page as Norimate changes. The date at the top shows when it was last updated.

10. Contact us

For questions about this policy or your information, contact hello@norimate.com.