Privacy Policy

1. Introduction

TimerMVP ("we", "us", or "our") operates the TimerMVP.com website and application (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. By using TimerMVP, you agree to the collection and use of information in accordance with this policy.

Data Controller: TimerMVP is the data controller of personal data collected through the Service. If you have questions about how your data is processed, contact us at support@gogowebdesign.com.

2. Information We Collect

Account Information

When you create an account, we collect your full name, email address, and password. Passwords are securely hashed and never stored in plain text.

Usage Data

We collect information you voluntarily provide while using the Service, including but not limited to: time tracking sessions, client information, journal entries, lead pipeline data, planner notes, contract content, and any other data you input into the application. This data is stored to provide the Service to you.

Payment Information

Payment processing is handled by Stripe, Inc. We do not store your credit card number, CVV, or full payment details on our servers. Stripe collects and processes your payment information in accordance with their own privacy policy. We receive only a confirmation of your subscription status, transaction ID, and billing period.

Calendar Data

If you connect a Google Calendar via ICS feed URL, we fetch and process your calendar event data (event titles, times, descriptions) to display within the application. We store the ICS feed URL you provide. Calendar data is fetched on-demand and is not permanently stored beyond caching for display purposes.

Automatically Collected Information

We may automatically collect certain information when you access the Service, including your browser type, operating system, IP address, and usage patterns. This information is used for analytics and to improve the Service.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process your subscription and manage your account
• Send you important service-related communications (e.g., billing confirmations, security alerts)
• Respond to your support requests
• Detect, prevent, and address technical issues or abuse
• Generate anonymized, aggregated analytics to improve our product
• Measure the effectiveness of our advertising campaigns (with your consent)

We do not sell your personal information to third parties. We do not use your data to train AI models. We do not serve advertisements within the application.

4. Data Storage and Security

Your data is stored securely using Supabase, which provides enterprise-grade PostgreSQL databases with Row Level Security (RLS). This means your data is isolated at the database level — only you (and team members you explicitly authorize) can access your records.

We implement industry-standard security measures including encrypted data transmission (TLS/SSL), secure authentication tokens, and access controls. However, no method of electronic storage is 100% secure, and we cannot guarantee absolute security.

5. Data Sharing and Disclosure

We may share your information only in the following circumstances:

• With your consent: When you share notes, contracts, or client request boards via public links, the content you choose to share becomes accessible to anyone with the link.
• Team members: If you create or join a team, certain data (sessions, clients you grant access to, tasks, and announcements) is visible to other team members as configured by team permissions.
• Service providers: We use Stripe for payment processing, Supabase for data storage and authentication, Google Analytics for website analytics, and Meta for advertising measurement. These providers access only the data necessary to perform their services.
• Legal requirements: We may disclose your information if required to do so by law, regulation, or legal process.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide you the Service. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or regulatory purposes. Archived items (clients, notes, tasks) remain in your account until you delete them or delete your account.

7. Your Rights

You have the right to:

• Access your personal data at any time through the application
• Export your data via CSV export from the profile settings
• Correct your personal information through your profile settings
• Delete your account and all associated data
• Restrict the visibility of financial data using the built-in Privacy Mode
• Withdraw consent for analytics and marketing cookies at any time by clearing the cookie-consent key from your browser's local storage

To exercise any of these rights, you can use the in-app settings or contact us at support@gogowebdesign.com.

8. Cookies and Local Storage

TimerMVP uses browser local storage to persist user preferences such as theme selection (light/dark mode), privacy mode setting, active team selection, and report period selection. We use essential cookies for authentication session management.

With your consent, we also use analytics and marketing cookies. These are only loaded after you accept via the consent banner shown on your first visit. The specific cookies are:

Analytics Cookies (Google Analytics 4)

Marketing Cookies (Meta Pixel)

For a complete breakdown of all cookies we use, how to manage them, and how to opt out, please see our Cookie Policy.

9. Third-Party Services

Our Service integrates with the following third-party services:

• Supabase — Database hosting, authentication, and real-time subscriptions
• Stripe — Payment processing and subscription management. Stripe may set cookies (such as __stripe_mid and __stripe_sid) on its domain for fraud prevention and session management.
• Google Analytics 4 — Website analytics (loaded only with your consent)
• Meta (Facebook) Pixel — Advertising measurement (loaded only with your consent)
• Google Calendar — Calendar event display (only when you provide an ICS feed URL)
• Google OAuth — Authentication when you sign in with your Google account

Each of these services has its own privacy policy governing how they handle your data. We encourage you to review their policies.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know — You may request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Delete — You may request deletion of your personal information, subject to certain exceptions
• Right to Opt Out of Sale — We do not sell your personal information to third parties
• Right to Non-Discrimination — We will not discriminate against you for exercising your privacy rights

To exercise these rights, contact us at support@gogowebdesign.com. We will respond to verifiable consumer requests within 45 days.

11. European Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:

• Contractual necessity — Processing required to provide the Service to you (account data, session data, client data)
• Legitimate interest — Processing for fraud prevention, security, and product improvement, where these interests do not override your rights
• Consent — Processing for analytics and marketing cookies, which are only activated after you provide explicit consent via our cookie banner

Under GDPR, you have additional rights including the right to data portability, the right to restrict processing, and the right to object to processing based on legitimate interest. You also have the right to lodge a complaint with your local data protection authority.

Our Data Processing Addendum (DPA) is available at TimerMVP.com/dpa and forms part of our Terms of Service.

To exercise any of these rights, contact us at support@gogowebdesign.com.

12. Children's Privacy

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child, we will take steps to delete that information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: support@gogowebdesign.com