PomoGlen Privacy Policy
Effective: 26 October 2026
Publisher: WizPlayo
Privacy contact: wizplayo.developer@gmail.com
This policy describes the Android PomoGlen focus timer, its optional Premium purchase verification and private access-code services, and the service providers involved. It covers technical processing as well as the progress you create in the app.
1. Focus progress and choices on your device
Your timer state, completed focus sessions and durations, village progress, decorations, character, map, language, motion, reminder and music choices are stored locally. PomoGlen has no app account or cloud progress sync and does not ask you to describe your work. Focus history and decorations are not included in PomoGlen purchase verification requests.
Settings → Privacy & data lets you export a readable JSON copy or erase local progress after confirmation. An export is not an importable in-app backup. It goes to the destination you choose, which may be a cloud document provider. PomoGlen does not receive that exported copy. Exported files remain at that destination until you delete them there.
2. Premium purchases and Restore
Google Play processes payment. When verifying or restoring a purchase, PomoGlen sends the product identifier, purchase token, a random installation identifier and a fresh request nonce over HTTPS to its Cloudflare-hosted verification service. The service checks the purchase with Google, acknowledges it where required and returns a signed entitlement. PomoGlen's verification service does not receive your card number or Google password.
The service stores a token hash, product/package identifiers, purchase and acknowledgement state, revision, test/production marker and relevant timestamps to recognize Lifetime access and prevent misuse. Installation identifiers and nonces bind a request and response; they are not columns in the purchase ledger. The local entitlement is encrypted separately from focus progress, excluded from progress exports and excluded from the app's Android backup configuration. Reinstalling or clearing app data may require an online Restore.
3. Device, network and diagnostic processing
Google Play Billing initializes when the app starts. Its diagnostic transport can process technical information such as device model, Android/app version, build information, language, timezone, mobile-network operator and connection type. These diagnostics are separate from your local focus history. There is no app-authored advertising or behavioral-analytics service, but that does not mean the app and its SDKs transmit no technical data.
Cloudflare hosts the verification service and database. Infrastructure request logs can include IP address, headers, approximate network-derived region, request time, duration and status. This is network-derived information, not a request for GPS or precise-location permission. Service diagnostics help operate, troubleshoot and secure the verification service. App-authored failure messages use fixed reason/stage values and optional upstream status, without intentionally logging purchase tokens, signed proofs or request bodies.
Google processes Billing/payment and associated SDK data under its applicable policies, including the Google Privacy Policy. Cloudflare provides hosting/database and infrastructure processing; see its privacy policy. Providers can process information outside your country. PomoGlen does not sell focus progress or purchase evidence or use them for advertising.
4. Retention and deletion
A raw purchase token can be stored encrypted while acknowledgement is unresolved. The current service removes that encrypted copy after acknowledgement is confirmed through verification. Older confirmed records still containing an encrypted token are minimized when next verified; there is no general bulk sweep.
Unresolved encrypted tokens become eligible for removal after seven days from the record's retention origin when an enabled recovery invocation reaches them. No scheduled recovery trigger is currently active. This is not a guarantee of automatic deletion within seven days. A migrated record's retention origin may be its migration date rather than the original transaction date.
Minimal purchase evidence is retained while needed to provide and recognize Lifetime rights, maintain revocation integrity, prevent fraud or comply with applicable obligations. Local progress deletion does not refund a purchase, cancel Lifetime rights, erase Google's order records or erase the separate verification ledger.
Infrastructure logs and database recovery copies follow the providers' schedules and can outlast live-record removal. Current Workers Paid invocation-log retention is documented as seven days; this does not describe all Google or Cloudflare records and backups. PomoGlen does not promise immediate deletion from provider recovery copies.
5. Privacy requests and support
Contact wizplayo.developer@gmail.com to ask about access, correction, deletion or other applicable privacy rights. Explain whether you mean local progress, exported copies or purchase verification records. We assess the request and verify ownership proportionately before disclosing or changing purchase information. We explain any data that must be retained and the relevant reason. A request is not an automatic refund or a promise that every transaction record can immediately be erased.
Support messages contain what you choose to send and are processed through the support email provider. Send only relevant details such as app version, error text and approximate incident time. Do not send passwords, verification codes, full purchase tokens, invitation codes, card details or unrelated private files. Hide personal information in screenshots. You do not need to uninstall the app or delete local progress to make a privacy request.
6. Optional features and permissions
Reminders use optional Android notification permission. Music is bundled, can be switched off and plays only while the app is open. Export uses Android's document picker rather than broad file access. The reviewed candidate does not request location, contacts, microphone, camera, Accessibility or VPN permission.
The Android app includes optional, dated invitation access for testers. When a campaign is enabled, entering an invitation code sends it, a random installation identifier and a fresh request nonce over HTTPS to the verifier. The service compares an owner-provisioned code hash without creating a tester purchase record. The app does not save the typed code; it keeps a separate encrypted temporary authorization excluded from progress exports and Android backup. Each authorization lasts no more than 24 hours and cannot extend beyond the campaign end; after expiry or a phone restart, online code entry is needed again. Previously issued offline authorization can remain valid until its deadline even if new access is stopped. This is not a Google purchase or Lifetime entitlement. Do not share access codes in support messages.
Optional Google Play reviewer access
Google Play reviewers may use a private review code to access all eight maps without a payment or a PomoGlen account. Entering the code sends it, a random identifier for this installation and a fresh request nonce over HTTPS to PomoGlen's verification service. This random identifier is a pseudonymous device or other identifier; it is not a hardware or advertising identifier. The request contains no focus history, village, decoration, card or Google password data.
The review credential has no scheduled expiry and can be entered again from different devices and locations. Each signed device authorization lasts no more than 24 hours. After it expires, or the phone restarts, the same code must be entered online again. The app verifies the authorization and keeps it in a separate encrypted local cache excluded from progress exports and the app's Android backup configuration. The typed code is not saved by the app, and the service keeps only an owner-provisioned hash as a Secret. This check creates no purchase, order or per-reviewer identity database record.
Hosting receives normal connection metadata and can retain the invocation and diagnostic records described above. No per-reviewer database record does not mean no hosting logs. Review access can be forgotten through its own in-app control without changing purchases or focus/village data. Revoking a credential does not instantly revoke an already cached offline authorization, which can remain valid until its deadline. Review access is separate from Lifetime purchases and dated tester campaigns.
7. Security, audience and changes
Verification uses HTTPS. Stored raw server tokens and local entitlement caches are encrypted. No system or modified/rooted device is guaranteed tamper-proof. PomoGlen is intended for people aged 13 and older and is not designed specifically for children under 13. If you believe a child under 13 supplied personal information to the service, contact us for review.
Material changes to these practices will be reflected in the dated policy and relevant app/store disclosures. Your applicable privacy rights depend on your jurisdiction; this policy does not remove rights granted by law.