Privacy policy
What we collect, why, and how to delete it
TomatoMaster is operated from Brazil by Luciano Santos (the data controller). This page describes what personal data we collect, why we collect it, who we share it with, and the rights you have under the Brazilian General Data Protection Law (LGPD) and, where applicable, the EU General Data Protection Regulation (GDPR).
What we collect
Account data
When you create an account or sign in with Google, we receive your email address and (optionally) the display name your provider returns. We use it to identify your licence and to email you about purchases or service notices.
Payment data
Payments are handled entirely by Stripe — we never see or store your card number. Stripe shares back: a customer ID, the billing email, the country of the billing address, and (for Brazilian customers) the CPF/CNPJ you provide at checkout. We use it to issue invoices, including the NFS-e service invoice required by Brazilian fiscal law.
App usage
The desktop app stores your timer settings and overlay customisations on disk in your OS user folder. Network calls are limited to licence verification, plan fetching, and update checks. If — and only if — you opt in via the consent dialog on first launch, the app additionally sends anonymous crash reports (to Sentry) and anonymous usage events (to PostHog) so we can fix bugs and prioritise the features people actually use. Events are limited to things like \"app started\" and \"timer completed\" — never your focus content, never your email. The opt-in is keyed to a randomly generated device-scoped UUID (no email, no Firebase user ID), and you can revoke it at any time in Settings → Privacy.
This website
The landing page stores your language preference in your browser's localStorage. If — and only if — you click "Accept" on the cookie banner, we additionally enable Firebase Analytics (Google LLC) to collect anonymous pageview, navigation, and download-click events. No analytics scripts, cookies, or third-party tracking run before you accept. You can change your mind at any time below, and the change applies immediately and to all future sessions.
Your data preferences
TomatoMaster only collects analytics when you grant explicit consent. Withdraw it at any time below — the change takes effect immediately and for every future session.
Who we share with
- Stripe (Stripe Payments Brazil and Stripe Inc.) — for payment processing, subscription management, and invoice generation. Stripe is GDPR + LGPD compliant; their privacy policy lives at stripe.com/privacy.
- Google Firebase (Google LLC) — hosts the licence verification + plan API. Authentication, when you sign in with Google, also routes through Firebase Auth.
- Sentry (Functional Software, Inc.) — receives anonymous crash reports if you opt in. Stack traces only; no personal data.
- PostHog Inc. — receives anonymous usage events if you opt in. Event names like \"app_started\" or \"pomodoro_completed\", scoped to a randomly generated device id.
- We do not sell, rent, or share your personal data with any party other than the processors named above.
How long we keep it
Account + licence data is kept for as long as your licence is active and for 5 years after cancellation, to comply with Brazilian fiscal record-keeping rules. Payment data lifecycle is governed by Stripe's own retention rules.
International data transfers
Stripe and Firebase store data on servers in the United States and the European Union. By using the service you consent to these transfers. Both providers comply with the EU Standard Contractual Clauses and Brazil's recognised mechanisms for international data transfers.
Your rights
Under the LGPD (and GDPR, where applicable) you have the right to access, correct, port, or delete the personal data we hold about you, to know who we share it with, and to revoke any consent you previously gave. To exercise any of these rights, email us — we respond within 15 days as required by Brazilian law.
Contact
Data controller: Luciano Santos. For privacy or data-deletion requests, write to contact@lucianosantos.dev.