01The short version
- Your timers, alarms and settings stay in your browser. No account, no database on our side.
- Google Analytics counts visits. In the EEA, the UK and Switzerland, analytics cookies and personalized ads need your consent.
- Cloudflare and our security logs see IP addresses.
- The site may show Google ads. We don't sell your data for money.
02What stays in your browser
The tools run entirely in your browser: your settings, timers, laps, alarms, last countdown and focus totals are saved in its local storage and never sent to us. Clearing your browser data deletes them. The Cookie Policy lists every entry.
03Notifications, screen and sound
Notifications stay off until you turn them on and allow them. Your browser shows them itself, with no push service, and nothing reaches us. Keeping the screen awake involves no data, sounds are made in the browser, and the microphone is never used.
05Cloudflare and server logs
Cloudflare (Cloudflare, Inc.) delivers the site and processes IP addresses to protect it from attacks. Our web server's access logs keep IP addresses briefly for security and are rotated. Both rely on our legitimate interest in a safe, available site (Article 6(1)(f) GDPR).
06Consent and your choices
In the EEA, the UK and Switzerland, Google's consent message (Google Privacy & messaging, a Google-certified, IAB TCF-compatible platform) asks for your permission for analytics and advertising; the Privacy choices link in the footer reopens it to change or withdraw your choice.
07Google Analytics
Google Analytics 4 shows us, as totals, which tools and pages are used, visitors' countries, languages and devices, and how they found the site. It never receives what you time, alarm times or labels, or countdown titles. Our processor is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); Google LLC in the US may receive data under the EU-US Data Privacy Framework and standard contractual clauses.
With Google Consent Mode v2, Analytics cookies in the EEA, the UK and Switzerland are set only after you accept; otherwise Analytics gets only cookieless pings without identifiers. Advertising signals are denied everywhere by default, so Analytics data isn't used for ads. IP addresses aren't stored; data is kept for 14 months.
Analytics cookies rely on your consent where we ask for it (Article 6(1)(a) GDPR and the ePrivacy rules); the rest of Analytics relies on our legitimate interest in improving the site (Article 6(1)(f) GDPR). To opt out, use Privacy choices, block cookies, or use a content blocker or Google's Google Analytics Opt-out Browser Add-on.
08When you write to us
The contact form only prepares an e-mail in your mail app; nothing goes through the website. We use your address and message to reply, and keep them only as long as needed to answer and follow up.
09Advertising
Walnut Timer may show ads served by Google AdSense. Google, as an independent controller, and its partners may then use cookies such as __gads, __gpi and __eoi to deliver and measure ads, limit repeats and prevent fraud. In the EEA, the UK and Switzerland, personalized ads need your consent. Google explains this at policies.google.com/technologies/partner-sites, and you can turn off personalized ads at adssettings.google.com.
10Your rights
Under the GDPR and its UK and Swiss equivalents, you can ask to see, correct, delete or get a copy of your personal data, restrict or object to its use, and withdraw consent with Privacy choices. Write to [email protected], or complain to your data protection authority.
11If you're in the US
We don't sell personal information for money. When ads are shown, Google's ad cookies can count as sharing for cross-context behavioral advertising under some state laws, such as California's CCPA as amended by the CPRA. Where you have this right, the Do not sell or share my personal information link in the footer opts you out in that browser. Asking to know, correct or delete your data never changes how we treat you.
12Children
Walnut Timer is a general-audience tool, not directed at children. With no accounts and nothing collected, we don't knowingly collect children's personal data; if a child has e-mailed us, tell us and we'll delete it.
13Contact and changes
Questions or requests: [email protected]. Changes to this policy will be posted here with a new date.