# Privacy policy

Effective October 18, 2026. Eggtimer.app is operated by Gotoh Industries LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA. Contact [support@eggtimer.app](mailto:support@eggtimer.app) for privacy requests, support or security reports. This policy covers the website, installed web app, HTTP APIs, MCP servers and our Eggtimer Zapier integration.

## API, MCP and integrations

Public link tools process submitted durations, labels, recipe data and display options to validate and return a timer URL. They do not create a stored server timer. MCP receives tool names and the arguments the client sends; we do not receive the rest of a chat unless the client includes it. Returned content is sent to that client. We do not use this data to train AI models or sell it. The AI/client provider has its own data practices.

Authenticated automation processes workspace identifiers, credential hashes, timer labels, durations/deadlines, recipes, step/event records, delivery outcomes and authorized Zapier destinations. This information is required to run timers, enforce limits, return status and investigate failures. Server routines retain at most 1,000 workspace events for seven days. Run records expire seven days after termination; pending hook secrets are removed at terminal delivery or cancellation, with the routine parent copy removed once its outboxes are dispatched. Timers and routines are not part of anonymous browser-start aggregates.

Cloudflare hosts and processes service traffic and stored operational data on our behalf. Rate limiting may process network addresses; registration protection stores daily salted IP hashes for the current UTC day. Ordinary hosting network metadata may be handled under Cloudflare's policies. Application request/body logging is disabled. Data may be processed in countries other than yours through these providers. We do not claim to avoid every provider log or backup.

Zapier receives only the selected, authorized timer or routine event payloads at the Catch Hook you provide. These can include your label, routine steps and scheduled/observed times. Its later actions are controlled by you and are subject to Zapier and connected services' policies. Using our native Zapier connection gives Zapier the workspace API key; it can act within that workspace. Keep the recovery key private.

Support email includes what you send, your email address and correspondence metadata. It is forwarded by Cloudflare Email Routing and SimpleLogin to our support inbox and kept while required to resolve and follow up on the request. Do not email API keys, recovery keys, hook URLs or sensitive timer labels. Mailgun recovery email is not enabled. Clicking the optional Buy me a coffee link opens a separate service; no payment data is collected by Eggtimer.

## Your choices and requests

Clear site data to remove local timers, preferences and cached app files. Use your recovery key to revoke an API key or close a workspace; closure stops future attempts, but sent or in-flight webhooks cannot be recalled. You can inspect your operational data using the workspace, API and retained event history. Contact support to request access, correction or deletion of personal data, or to ask about applicable rights or complaints. We may request proof of control; never send the complete recovery credential by email. We cannot reconstruct lost credentials or restore expired data. Anonymous aggregate counts cannot be tied back to a particular person for deletion.

We use HTTPS, scoped keys and hashed stored credentials, but no service can promise absolute security. Do not submit sensitive health, financial, identity or confidential information in labels or recipes. The service is for general timing, not collecting children's personal information; a parent or guardian can contact us about information submitted by a child. Material policy changes will be dated here and linked from the site.

## Browser storage and aggregate usage counts

Eggtimer stores hourly aggregate timer-start counts for product research and possible blog posts. Each stored row contains a UTC hour, local hour-of-day (0–23), a fixed timer category, rounded duration in seconds (0 for stopwatch starts), and a count. No individual event log, visitor/device identifiers, IP addresses, custom labels, recipe content, full URLs, exact event timestamps, timezone, or location is stored in this database. Built-in categories are derived from interval structure; custom recipe names are never sent.

There are no tracking cookies or third-party analytics scripts. The collection request omits browser credentials and referrer information. Counts are retained as aggregates; administrator exports require a private token. The hosting provider still receives normal HTTP request information and transient edge abuse protection can use an IP address; this metadata is not passed into the aggregate database.

A fresh run is counted once by that tab. Pause/resume and reload do not intentionally count it again; reset/restart is a new run. Counts are starts, not unique people or completed sessions. Offline requests may be missed, bots and test runs can affect counts, and a public collection endpoint cannot guarantee fraud-free measurements. The separate workspace-authenticated server-timer API stores operational timer data and pending hooks so it can run without a browser. This data is not part of the anonymous count database; see [server storage and retention](https://eggtimer.app/server-timers.md).

Browser timers use per-tab session state plus up to 100 private local timer records for unique /t/UUID links. Their labels/recipes remain in that browser, not in the count database. New setup links create new timer instances. Copy link / C copies a portable setup; each recipient gets an independent timer. For makers can copy the private local resource address. Clearing site data or evicting old records removes local access. See [linking](https://eggtimer.app/linking.md).

Automation workspaces store an opaque workspace ID, credential hashes, usage limits and recent timer metadata. Keys are returned once and kept in the page memory unless the person explicitly downloads a private credential file. Recovery uses a separate key; no emails are collected or sent in this release. Idle workspace data expires after 90 days; closed workspace metadata is purged after seven days. Enrollment abuse protection uses daily salted IP hashes retained for that UTC day. These operational records are separate from anonymous browser-start totals. Preferences, saved remixes and recent durations also remain local to the browser.