Privacy Policy | UP TIMER

1. Who we are

UP TIMER is a browser-based work-rhythm product operated by Spixel Digital in the United Kingdom. It combines Focus, Hydrate, Move and Learn with UP Capture, plus the optional Interval Timer utility.

For data-protection questions, rights requests or complaints, email privacy@uptimer.app. General product support is available at support@uptimer.app.

2. Where this policy applies

This policy applies when you visit uptimer.app, use timer.uptimer.app, use UP Capture, create or access an account, manually activate the Full trial, subscribe to Full, contact support, make a privacy or security request, or contact the Company route about licences, a selected pilot or bespoke setup.

Separately hosted services can show their own privacy information. For example, Stripe applies its own notices when you use a Stripe-hosted checkout or customer portal.

3. Information we collect

Category	Examples	How it arises
Account and identity	Email address, user identifier, account status, confirmation and security events.	When you create, confirm, access or secure an account. Authentication is provided through Supabase.
Access and subscription	Lite status, Full-trial activation and expiry, Full membership status and related entitlement records.	When access is calculated, activated, renewed, cancelled or updated.
Payment and transaction	Stripe customer or subscription references, payment status, invoices, renewal and cancellation information. UP TIMER does not intend to receive or store full card numbers.	When you subscribe, manage billing, cancel or ask for payment help.
Signed-out UP Capture data	Notes, ideas, questions, reflections, to-dos and local Capture state held in the browser.	When you use UP Capture without signing in. This data can remain local to that browser and device.
Signed-in UP Capture data	Captured items, item type, planning state, task status, attached images or screenshots where used, and related account-backed Capture information.	When you use UP Capture while signed in and the feature synchronises information with your account.
Support and enquiries	Name, email, message, screenshots, browser or device information and correspondence.	When you contact product support, billing, privacy, security or the Company route.
Technical and security	IP address, timestamps, browser or device information, request logs, authentication logs, error information and security events.	Generated by hosting, authentication, security and diagnostic systems.
Website and product measurement	Page views, selected product events, device information, approximate location and campaign information where measurement is enabled.	Collected only in accordance with the live analytics, consent and storage configuration.
Browser-stored timer information	Timer settings, preferences, Lite-window timing and related application state stored on the device.	Saved locally so the timer can operate or remember selected settings.
Company enquiry	Organisation, role, approximate group size, workday challenge and whether licences, a pilot or bespoke setup is of interest.	When an organisation contacts the Company route.

Passwords and full card details: do not send them to us. Password handling belongs to the authentication service and card entry belongs to the payment provider.

UP Capture is intended as a private personal workspace.

We do not use product analytics to read the text of your notes, ideas, questions, reflections or to-dos. Technical processing needed to store, synchronise, secure or deliver signed-in Capture is different from analytics.

4. Timer, UP Capture and acknowledgement

Some timer settings and Lite-window information are stored in browser storage on your device. Clearing site data, changing browser profiles or moving to another device can remove or separate those settings.

Signed-out UP Capture can also keep captured items locally in the browser. If an item exists only in local browser storage, clearing that storage can remove it. Signed-in Capture can associate and synchronise items with your account instead of relying only on the local browser.

An acknowledgement records that a timer prompt received a response in the interface. It does not prove that you drank water, moved, took a break, completed learning or finished focused work.

Company access is designed around licences, pilots and rollout rather than personal monitoring. Personal Focus, Hydrate, Move, Learn, Interval Timer and UP Capture activity is not presented as an employer productivity or surveillance feed.

5. How we use information

Provide and secure the website, four core timers, the optional Interval Timer, UP Capture, accounts and access levels.
Confirm accounts, support sign-in and account-recovery journeys and protect against misuse.
Activate and expire the Full trial and provide Full membership access.
Store and synchronise signed-in UP Capture items and support the hand-off of ready tasks into Focus.
Create and maintain payment, subscription, invoice, cancellation and billing records.
Answer product, billing, Company, privacy, security and accessibility enquiries.
Diagnose faults, monitor availability and improve usability and performance.
Measure website and selected product events where the live analytics and storage setup permits this.
Comply with legal, tax, accounting, security and dispute-resolution requirements.

We do not sell personal information and do not use personal timer or UP Capture activity for hidden employee surveillance.

6. Lawful bases

The lawful basis depends on why the information is being used. The principal bases used for the current service are:

Purpose	Basis	Why
Account, Full trial, Full membership and signed-in product features	Contract / steps at your request before contract	Needed to create and operate the access or signed-in feature you ask us to provide.
Operate Lite, site security and essential technical functions	Legitimate interests, and contract where applicable	Needed to operate, protect and maintain the service and prevent misuse.
Payments, invoices and tax records	Contract and legal obligation	Needed to process billing and keep records required by law.
Support and Company enquiries	Legitimate interests or steps at your request before contract	Depends on the question and whether you are asking us to take steps towards a service or commercial arrangement.
Security, fraud prevention and diagnostics	Legitimate interests and legal obligation where applicable	Protects users, accounts, systems and the service.
Optional analytics or marketing	Consent where consent is used; otherwise another documented UK GDPR basis where legally appropriate	The UK GDPR basis must be considered separately from any PECR consent or storage/access exception.

8. International transfers

Some providers operate internationally. Where personal information is transferred outside the United Kingdom, we will rely on an applicable adequacy regulation, recognised safeguards such as approved contractual clauses, or another lawful transfer mechanism.

Contact privacy@uptimer.app for information about safeguards relevant to a specific provider.

9. Company access and privacy boundaries

Company is an enquiry-led route for licences, selected pilots and bespoke setup. An organisation may need information needed to administer access, rollout, billing or support.

That does not require personal timer or UP Capture surveillance. Personal Focus, Hydrate, Move, Learn, Interval Timer and UP Capture activity is intended to remain personal rather than becoming a manager dashboard.

If a future Company feature would make additional personal information visible to an organisation, that change would need to be explained before the feature is used. An employer can also be a separate controller for information it supplies or decisions it makes about staff, and its own privacy notice should explain that processing.

10. How long information is kept

We keep personal information only for as long as needed for the purpose, security, legal obligations and disputes. The main criteria are:

Account and access records: while the account is active and for a limited period afterwards for security, recovery, disputes and legal obligations.
Signed-in UP Capture data: while needed to provide the account feature, until deleted or the account is closed, subject to proportionate backup, security and legal-retention periods.
Signed-out UP Capture data: normally remains in the local browser until you delete it, clear site data or the browser removes it.
Payment and invoice records: for the period required by tax, accounting, fraud-prevention and legal rules.
Support, Company and privacy correspondence: until the enquiry is resolved and for a proportionate follow-up or dispute period.
Security and technical logs: for a limited period based on diagnostic, abuse-prevention and incident needs.
Consent or preference records: for as long as needed to honour and demonstrate the choice.
Other browser storage: until it expires, is overwritten or you clear it, depending on the item and browser.

11. Your data-protection rights

Depending on the circumstances and lawful basis, you may have rights to be informed, access personal information, correct inaccurate information, request deletion or restriction, object to certain processing, receive portable data and withdraw consent. Rights are not absolute in every situation.

To object to processing: email privacy@uptimer.app and identify the processing you object to.

Data-protection complaints If you make a data-protection complaint to us, we provide a clear route for the complaint, acknowledge it within 30 days, investigate it appropriately and communicate the outcome. You can also complain to the UK Information Commissioner’s Office.

12. Security

We use access controls, hosted providers, encrypted connections and operational safeguards designed to protect information. No internet service can promise absolute security.

Report a suspected vulnerability to security@uptimer.app. Do not publicly disclose secrets or personal information belonging to other people.

13. Children

UP TIMER is designed for general work and study routines and is not intentionally directed at collecting personal information from young children. Paid membership should be purchased by someone legally able to enter the agreement or with appropriate parent or guardian involvement.

14. Changes to this policy

We may update this policy when the service, UP Capture, Company access, providers, analytics, law or data practices change. Material new uses of personal information will be explained before they begin where required.

15. Contact and complaints

Email privacy questions, rights requests or data-protection complaints to privacy@uptimer.app.

You can also complain to the UK Information Commissioner’s Office if you are unhappy with how personal information is handled. Contacting us first does not remove your right to complain to the regulator.