1. Who we are
Pomi ("we", "us") is a focus timer app operated by Northstack Studio. This policy explains what we collect, how we use it, and the rights you have over it.
2. The short version
We collect the minimum needed to make the app work and to bill you. We never sell your data. We do not train AI models on your task history. You can export or delete everything at any time.
3. Information we collect
- Account data — your email, name, and a hashed password.
- Session data — completed focus sessions, durations, and task labels you choose to save.
- Device data — basic device info (model, OS version, language) for diagnostics.
- Billing data — handled by Stripe. We never see your card number.
4. How we use it
We use this data to deliver the app, sync your sessions across devices, send you essential service emails (receipts, security notices), and to fix bugs. We do not use your data for behavioral advertising.
5. Sharing
We share data only with the subprocessors needed to run the service: Stripe (billing), Postmark (transactional email), and Cloudflare (delivery and security). They process data on our behalf under written contracts. Full list available on request.
6. Retention
We keep your data for as long as your account exists. When you delete your account, we delete everything within 30 days, except where we are required to keep records (e.g. invoices for tax purposes, kept for 7 years).
7. Your rights
You can access, export, correct, or delete your data at any time from your account settings. If you are in the EU, UK, or California, you also have specific rights under the GDPR and CCPA — write to privacy@northstackstudio.com and we will respond within 30 days.
8. Security
Data is encrypted in transit (TLS 1.3) and at rest (AES-256). We run quarterly security reviews and never store your password in plain text.
9. Children
Pomi is not directed at children under 13. If you believe a child has created an account, contact us and we will remove it.
10. Changes
If we make material changes to this policy, we will email you at the address on file at least 30 days before the change takes effect.
11. Contact
Questions? Write to privacy@northstackstudio.com or by post to Northstack Studio, Northstack Studio.