Privacy Policy

About this Privacy Policy

Lofi Pomodoro is a web-based productivity tool that combines:

• a Pomodoro-style timer;
• Focus, Break and Long break phases;
• optional lofi music;
• educational blog content.

The timer can be used without creating an account and without allowing analytics.

Who is responsible for Lofi Pomodoro?

The data controller is:

[LEGAL_CONTROLLER_NAME]
Operating under the name Lofi Pomodoro
[LEGAL_CONTROLLER_TYPE]
[CONTROLLER_CONTACT_ADDRESS]
Spain

Privacy contact: privacy@lofipomodoro.com

Where applicable:

• Legal registration details: [LEGAL_REGISTRATION_DETAILS]
• Tax identification number: [TAX_IDENTIFICATION_NUMBER]

The data controller determines why and how personal data is processed through Lofi Pomodoro.

Information processed when you use Lofi Pomodoro

Depending on your choices and how you use the website, the following categories of information may be processed.

Consent information

We store whether analytics is:

• allowed;
• rejected;
• not yet selected.

This information is used to apply and remember your choice.

Local product-measurement information

After analytics is allowed, Lofi Pomodoro may store limited information in your browser, including:

• tracking version;
• dates and times associated with eligible visits;
• the first eligible landing path;
• Focus sessions started and completed;
• timer-cycle progression;
• the article and CTA that led to the timer;
• timestamps used to prevent duplicate measurement;
• whether a measurement cohort has been initialised.

This local state is used to connect actions performed in the same browser over time.

It does not intentionally contain your name, email address, message content or payment data.

Google Analytics information

When analytics is allowed, Google Analytics may process information such as:

• page views;
• public page paths;
• approximate location;
• browser and device information;
• operating system;
• general acquisition source or medium;
• interaction timestamps;
• analytics identifiers stored in cookies;
• timer modes and phase durations;
• Focus, Break and Long break events;
• timer-cycle progression;
• blog CTA interactions;
• article and CTA attribution;
• technical parameters used to prevent duplicate events.

Lofi Pomodoro does not intentionally send names, email addresses, free-text content or other directly identifying information to Google Analytics.

Google states that Google Analytics 4 does not log or store IP addresses.

Technical hosting information

Lofi Pomodoro is delivered in production through Vercel.

Vercel may process technical request information required to deliver, protect and operate the website, such as:

• IP address;
• date and time of a request;
• requested URL;
• browser or user-agent information;
• technical error, performance and security logs.

Hosting-log retention: [VERCEL_LOG_RETENTION_PERIOD]

Transfer and processing information: [VERCEL_DATA_TRANSFER_INFORMATION]

Source-code and deployment services

GitHub is used as a source-code repository and deployment integration.

Unless GitHub Pages or public assets are served directly from GitHub, GitHub is not presented as the production hosting provider for visitors to lofipomodoro.com.

Current status:

• GitHub Pages enabled: [GITHUB_PAGES_ENABLED]
• Public website assets served by GitHub: [GITHUB_PUBLIC_ASSETS_SERVED]

Domain registration, DNS and privacy email

The domain is registered through IONOS.

• DNS provider: [DNS_PROVIDER]
• Privacy email provider: [PRIVACY_EMAIL_PROVIDER]
• IONOS contracting entity: [IONOS_CONTRACTING_ENTITY]

Domain registration by itself does not mean IONOS receives analytics events from visitors. Additional processing must be described if IONOS provides DNS, email or other visitor-facing services.

Other external resources

The following production resources must be confirmed before publication:

• Audio provider: [AUDIO_PROVIDER]
• Audio-file host: [AUDIO_FILE_HOST]
• Font provider: [FONT_PROVIDER]
• External CDN providers: [EXTERNAL_CDN_PROVIDERS]
• Other external resources: [OTHER_EXTERNAL_RESOURCES]

If a browser connects directly to a third-party provider, that provider may receive technical request information such as IP address and user-agent information.

Why we process this information

To provide and secure the website

Technical information may be processed to:

• deliver pages and site assets;
• maintain availability;
• diagnose errors;
• prevent abuse;
• protect the service.

The legal basis is the controller's legitimate interest in operating and securing Lofi Pomodoro, where that interest is not overridden by your rights and freedoms.

To remember your privacy choice

Consent storage is used to remember whether analytics was allowed or rejected and to ensure the website applies that decision.

This storage is necessary to respect and apply your privacy choice.

To understand and improve Lofi Pomodoro

When you allow analytics, we process usage and product-interaction information to:

• understand how visitors reach the website;
• measure how the timer is used;
• identify where users stop during a timer cycle;
• measure first and later Focus sessions;
• understand whether blog visitors use the timer;
• detect duplicate or impossible analytics sequences;
• improve the product and its content.

The legal basis for optional analytics is your consent.

You may withdraw that consent at any time through Cookie settings. Withdrawal does not affect the lawfulness of processing performed before withdrawal.

Google Analytics

Lofi Pomodoro uses Google Analytics 4 with measurement ID:

G-4CPHVGHE75

Google Analytics is loaded only after analytics has been allowed.

Google Analytics may use _ga and _ga_<container-id> cookies to distinguish browsers and preserve session state. Google documents a default duration of two years for these cookies.

The following GA4 settings must be confirmed against the production property:

• Event-data retention: 14 months
• Reset user data on new activity: [GA4_RESET_USER_DATA_ON_NEW_ACTIVITY]
• Google Signals enabled: [GOOGLE_SIGNALS_ENABLED]
• Google Ads linked: [GOOGLE_ADS_LINKED]
• Ads personalisation enabled: [GA4_AD_PERSONALIZATION_ENABLED]
• User-provided data collection enabled: [GA4_USER_PROVIDED_DATA_COLLECTION_ENABLED]
• Enhanced Measurement enabled: [GA4_ENHANCED_MEASUREMENT_ENABLED]

Lofi Pomodoro does not require an account and does not use Google Analytics to identify visitors by name.

Service providers

The principal providers currently identified are:

We do not sell personal data.

We do not use Lofi Pomodoro analytics data for personalised advertising on the website, subject to confirmation that advertising-related GA4 settings are disabled.

International processing

Google, Vercel, GitHub and their subprocessors may process data in countries outside the country where you live, depending on the services used and their infrastructure.

Where European data-protection law applies, the relevant provider terms may rely on:

• processing in a country recognised as adequate;
• an alternative lawful transfer solution;
• Standard Contractual Clauses where applicable.

Production transfer details to confirm:

• Vercel: [VERCEL_DATA_TRANSFER_INFORMATION]
• GitHub: [GITHUB_DATA_TRANSFER_INFORMATION]
• IONOS or email provider: [IONOS_OR_EMAIL_TRANSFER_INFORMATION]

How long information is retained

Consent choice

Your analytics choice remains in browser storage until:

• you change it;
• you clear site data;
• it is replaced by a newer consent mechanism.

Local measurement state

The local measurement state normally expires after up to 90 days of eligible timer activity.

It may be deleted earlier when:

• analytics is rejected;
• the tracking version changes;
• the stored state is invalid;
• you clear browser data.

Temporary blog attribution

A valid blog CTA may be stored temporarily for up to 24 hours before the first measured Focus.

When copied and locked to the first measured Focus, the article attribution may remain associated with product events for up to eight days.

Google Analytics cookies

Google documents a default expiration period of two years for _ga and _ga_<container-id>, although actual duration can be shortened by browser settings, deletion or withdrawal.

Google Analytics user and event data

The GA4 property is configured to retain user-level and event-level data for 14 months.

The retention setting used for Explorations and user-level or event-level data does not remove all aggregated standard reporting data in the same way.

Technical logs

• Vercel hosting and security logs: [VERCEL_LOG_RETENTION_PERIOD]
• Other infrastructure logs: [OTHER_LOG_RETENTION_PERIODS]

Your data-protection rights

Subject to the conditions and limitations established by applicable law, you may have the right to:

• request access to personal data concerning you;
• request correction of inaccurate data;
• request deletion of data;
• request restriction of processing;
• object to processing based on legitimate interests;
• request data portability where applicable;
• withdraw consent at any time;
• lodge a complaint with a competent supervisory authority.

To exercise a right, contact privacy@lofipomodoro.com and describe your request clearly.

Because Lofi Pomodoro does not use accounts and may only hold browser-based analytics identifiers, we may not always be able to identify data as belonging to a particular person. We may ask for limited additional information when necessary to locate the relevant data, but we will not request more information than reasonably required.

Withdrawing analytics consent

You can withdraw analytics consent at any time by selecting Cookie settings in the footer.

When analytics is rejected, Lofi Pomodoro:

• stops future analytics sends;
• disables Google Analytics for the current page;
• deletes or invalidates local measurement state;
• deletes or invalidates temporary attribution;
• attempts to remove visible _ga and _ga_* cookies;
• reloads the page following a withdrawal from an accepted state.

Cookie removal is best effort and may be affected by browser or cookie restrictions.

Withdrawing consent does not automatically erase analytics data that was processed before withdrawal.

Complaints

You may lodge a complaint with the data-protection authority responsible for your habitual residence, place of work or the place of the alleged infringement.

For a controller established in Spain, the principal national supervisory authority is the Agencia Española de Protección de Datos (AEPD).

Security

We apply technical and organisational measures intended to reduce risks such as:

• analytics loading before consent;
• duplicate analytics events;
• unauthorised reuse of rejected attribution;
• accidental inclusion of unnecessary information;
• continued tracking after withdrawal.

No online service can guarantee absolute security. We review the implementation when analytics, storage or service providers change.

Children

Lofi Pomodoro is a general productivity tool and is not designed to knowingly collect names, contact details or account information from children.

Optional analytics should only be enabled by a person who is legally able to provide the required consent or by the appropriate parent or guardian where applicable.

External links

Lofi Pomodoro's blog may link to third-party websites.

We do not control the privacy practices of external websites. Their own privacy policies apply when you leave Lofi Pomodoro.

Changes to this Privacy Policy

We may update this Privacy Policy when:

• the website changes;
• analytics events or purposes change;
• service providers change;
• retention settings change;
• applicable legal requirements change.

The date at the top of the policy indicates the latest revision.

Where a material change affects the basis or purpose of optional analytics, we will update the relevant consent information and request a new choice when required.

Contact

Questions about this Privacy Policy or the use of personal data can be sent to:

Lofi Pomodoro
Operated by [LEGAL_CONTROLLER_NAME]
[LEGAL_CONTROLLER_TYPE]
[CONTROLLER_CONTACT_ADDRESS]
Spain
Email: privacy@lofipomodoro.com