Privacy Policy

The Short Version

• We don't sell your data. Not to anyone. Ever.
• We don't track you across other websites.
• We collect only what's needed to run the service.
• You can delete your account and all data at any time.
• All timer tools work without an account - no login required.
• We will always tell you plainly if something changes.

This policy applies to the website at stopwatch.now and all subdomains operated by us. It does not apply to third-party websites linked from our pages. For questions about how we handle cookies specifically, see our Cookie Policy.

1. What Data We Collect

1.1 Anonymous visitors (no account)

When you visit Stopwatch.now without logging in, our web server automatically records a standard access log entry containing: your IP address, browser type and version, operating system, the page you visited, the page you came from (referrer), and a timestamp. These logs exist so we can diagnose errors and understand which tools are most useful.

We also count aggregate page views per tool so we know, for example, that the stopwatch is more popular than a niche timer. These counts are not linked to individuals - they are just running totals.

Server logs are retained for 30 days on a rolling basis, then automatically purged. No personal profile is built from them.

1.2 Registered users (free account)

When you create an account we collect:

• Username - chosen by you; displayed on your profile if you share it.
• Email address - used only for login, password resets, and (if you opt in) occasional product updates. We do not share your email with third parties for marketing.
• Password - stored as a salted bcrypt hash. We never store or transmit plain-text passwords.
• Account creation date - for record-keeping and fraud prevention.
• Login activity - date and time of each login, login streak count (used to show your streak badge).
• Saved preferences and favourites - e.g. your default timer sound, saved preset timers, and which tools you have bookmarked.

We do not store individual timer sessions, lap times, or countdown history unless you explicitly choose to save them using the save feature. Your timer usage stays on your device unless you actively save it.

1.3 Information you send us voluntarily

If you use the contact form or submit feedback, we store your name, email address, and message so we can respond. These records are kept for up to 2 years and then deleted.

2. How We Use Your Data

We use the data we collect for the following purposes only:

• Providing the service - keeping you logged in, remembering your preferences, and delivering the right timer tools.
• Improving the service - understanding which tools are used most so we can build better features and fix issues faster.
• Security and fraud prevention - detecting unusual login patterns, preventing abuse, and protecting our infrastructure.
• Transactional communications - sending password reset emails, or notifying you about material changes to these terms. We don't send marketing emails unless you explicitly opt in.
• Legal compliance - retaining records where required by applicable law.

We never use your data to build advertising profiles, we never sell it, and we never share it with data brokers.

3. Cookies and Local Storage

We use a minimal set of cookies. The table below summarises each one. For full details, read our dedicated Cookie Policy.

Cookie / Storage key	Type	Purpose	Duration
session	Essential	Keeps you logged in to your account between page loads	30 days or logout
csrf_token	Essential	Protects forms from cross-site request forgery attacks	Session (browser close)
flash	Essential	Stores one-time notification messages (e.g. "Saved!")	Session (browser close)
sw_theme (localStorage)	Preference	Remembers your light/dark mode choice	Permanent (until cleared)
sw_sound (localStorage)	Preference	Remembers your default alert sound selection	Permanent (until cleared)
sw_prefs (localStorage)	Preference	Stores timer-specific display preferences (font size, colour theme)	Permanent (until cleared)

localStorage entries never leave your device and are not transmitted to our servers. We do not use advertising cookies, tracking pixels, or any cookie that follows you to other websites.

4. Third-Party Services

Running a web service requires a small number of third-party tools. Here is every service we use and what it receives:

4.1 Google Fonts

We load the Inter and JetBrains Mono typefaces from Google's font CDN (fonts.googleapis.com). When your browser requests these fonts, Google receives your IP address and the font request. Google's privacy policy governs that data. After the first visit, your browser caches the fonts locally so repeat visits do not trigger additional Google requests. If you prefer, you can use a browser extension to block Google Fonts; the site falls back to system fonts and remains fully functional.

4.2 Transactional email provider

We use a third-party email delivery service to send password reset emails and account notifications. Your email address is passed to this provider solely for the purpose of delivering that message. The provider does not use it for profiling or advertising.

4.3 Error monitoring (Sentry)

We use Sentry to capture application errors so we can fix bugs quickly. When an error occurs, Sentry receives a stack trace and basic request metadata (browser version, page URL, anonymised IP). Sentry does not receive your account data, email address, or timer history. Error events are retained for 90 days.

We do not use Google Analytics, Facebook Pixel, TikTok Pixel, or any advertising network tracking script.

5. Data Retention Periods

We keep your data only as long as necessary for the purposes described above. The table below sets out our standard retention periods:

Data type	Retention period	Reason
Server access logs	30 days	Security monitoring and bug diagnosis
Account data (username, email, preferences)	Until account deletion	Providing the service
Contact / feedback messages	2 years	Maintaining correspondence records
Sentry error events	90 days	Bug tracking and resolution
Transactional email logs	30 days	Delivery confirmation and anti-spam compliance
Backup snapshots	7 days rolling	Disaster recovery

6. Your Rights

Depending on where you live, you may have the following rights regarding your personal data. We honour these requests regardless of your location.

6.1 Right of access

You can request a copy of all personal data we hold about you. We will provide this in a common machine-readable format (JSON or CSV) within 30 days of your request.

6.2 Right to correction

If any of your data is inaccurate, you can correct most of it yourself via Account Settings. For data you cannot edit yourself, contact us and we will correct it promptly.

6.3 Right to deletion

You can delete your account at any time from Account Settings. Deletion is immediate and permanent - your account data, saved preferences, and favourites are removed from our live database instantly. Backup snapshots containing your data will be overwritten within 7 days. Server logs referencing your IP will be purged within 30 days.

6.4 Right to data portability

You can export your saved favourites, preset timers, and preferences in JSON format from Account Settings at any time. This lets you move your data to another service without losing it.

6.5 Right to object

If you believe we are processing your data in a way you object to, please contact us with specifics. Where processing is based on legitimate interest, you can object and we will stop unless we have overriding grounds.

6.6 Exercising your rights

To exercise any of the rights above, email [email protected] or use our contact form. We will respond within 30 days. For account deletion, the fastest route is Account Settings - it is immediate and requires no email.

7. Children's Privacy (COPPA)

Stopwatch.now is a general-purpose timer tool used widely in classrooms, but our service is not directed at children under 13. We do not knowingly collect personal information from children under 13 years of age.

If you are a parent or guardian and believe your child under 13 has created an account or provided personal information to us, please contact us immediately at [email protected]. We will delete the information promptly upon verification.

Teachers using Stopwatch.now in classrooms: all timer tools are fully functional without an account, so students can use the tools without providing any personal information. We recommend this approach for classroom use with students under 13. For more information, see our About page and our dedicated teacher resources.

8. Security

We take reasonable technical and organisational measures to protect your data. These include: HTTPS-only connections, bcrypt password hashing, CSRF protection on all forms, rate limiting on login endpoints, and server-side input validation. No system is perfectly secure, but we take these obligations seriously.

If you discover a security vulnerability, please report it responsibly to [email protected] before disclosing it publicly. We aim to respond to security reports within 48 hours.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "last updated" date at the top and, where appropriate, notify registered users by email. We encourage you to review this page periodically.

Continued use of the service after a policy update constitutes acceptance of the updated terms. If you disagree with changes, you can delete your account as described in Section 6.3 above.

For questions about our Terms of Service or our Accessibility Statement, please see those dedicated pages.

10. Contact for Privacy Requests

For privacy-related questions, data access requests, or deletion requests:

• Email: [email protected]
• Contact form: stopwatch.now/contact
• Response time: Within 30 days for formal rights requests; within 5 business days for general queries.