Version . Effective July 29, 2026.
Box Timer is a workout timer app, and this is its website. This page is the privacy policy for both: the app first, thenthis website. They collect different things, so each is described on its own.
I run Box Timer personally, not as a company, so the person responsible for everything here is me, Edvin Lindén. Write tohelp@boxtimer.app.
If you email me, your message and address stay in my email archive. Nothing goes on a mailing list, nothing is shared, and I'll delete a message on request.
Box Timer collects usage analytics. With analytics switched on, this is what is collected:
An identifier for your installation of Box Timer. It cannot be traced back to you, and it cannot be matched against any other app, including my own.
When it happened. An identifier for the current session, and the date and time.
What happened. Every event Box Timer sends:
What the app is running on. The device model, operating system, screen size, language, region and time zone, whether the app is in light or dark mode, its version, and whether it came from the App Store or from a test build.
How much you use the app. How many sessions you have had, how long they last, and how many days you have opened it.
Technical details of the analytics software, such as its version.
Analytics keeps a small record of when you have opened the app, which is what the usage counts above are worked out from. Events waiting to be sent are held on the device too, until they're delivered. Turning analytics off deletes both. If you never turn analytics on, it is never written.
Box Timer also stores your analytics decision: whether it is on or off, when and how you decided, the version of this policy in force at the time, and the country of your App Store account. The country decides whether you have to be asked for consent, and is never sent anywhere.
Your workout history, timer presets and settings are stored on your device too. They stay there and are never sent.
No name, email or account, because Box Timer has no accounts. No advertising identifier, no ad networks. No tracking across other companies' apps or websites. No GPS or location services data. Nothing about your accessibility settings. Nothing about your workouts: not how many, not how long, not how often. That data never leaves your device, so I have no way to see it. I do not sell data or share it with advertisers or brokers.
Three reasons, and no others:
In the European Economic Area the legal basis is your consent, Article 6(1)(a) GDPR. Box Timer asks first, sends nothing until you say yes, and you can withdraw any time. Everywhere else it is my legitimate interests, Article 6(1)(f), those interests being the three purposes above, and analytics is on by default with a switch to turn it off.
The switch is under About and then Privacy, in the same place whether you were asked for consent or not. Turning it off ends collection immediately, deletes anything that had not yet been sent, and deletes what analytics had stored on your device. Box Timer works the same with analytics off.
Turning it back on records a fresh decision against the current policy version.
Data goes to TelemetryDeck GmbH in Augsburg, Germany, which provides the analytics service. Their privacy policy is athttps://telemetrydeck.com/privacy.
TelemetryDeck stores it in the EU and does not transfer it outside the EU or the EEA. TelemetryDeck keeps it available for 24 months, and after that moves it to cold storage rather than deleting it.
You have the right to access your data, correct it, delete it, restrict its use, object to its use, receive a copy, and withdraw your consent. Email me.
The analytics data holds nothing that identifies you, so I can't find your records in it. Article 11 GDPR doesn't require me to start collecting more about you to make that possible, and I won't. What I can do is stop collecting from you, which is what the switch above does.
You have the right to lodge a complaint with the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), or with the supervisory authority where you live.
This policy may be updated. Changes are published on this page with a new effective date.
The person responsible is the same: me, Edvin Lindén, athelp@boxtimer.app. The website collects less than the app, and asks for nothing.
boxtimer.app uses the same analytics service as the app. When you load a page, this is sent:
Which visit it was. An identifier worked out from your IP address, an identifier for this site, what your browser says about itself, and a code that changes every day. It cannot be traced back to you, it cannot follow you to another website, and it stops matching you when the day ends.
When it happened. The date and time of the request.
What happened. Every event this site sends:
Which page. The address of the page you loaded, including anything after the question mark in it, and the address of the page you came from if you followed a link.
What you're browsing on. Your browser and its version, your operating system and its version, whether you are on a phone, a tablet or a desktop, whether the screen responds to touch, your language, and an approximate country and continent. All of it comes either from what your browser tells every website it visits, or from your IP address.
Technical details of the analytics software, such as its version.
No cookies. Nothing is stored on your device unless you opt out below, and that opt-out setting is the only thing this site ever looks for there.
No name, email or account, because the site has no accounts. No advertising identifier, no ad networks. No tracking across other companies' apps or websites. No location beyond the approximate country above. Your IP address is never stored by the analytics service: it is used to work out that country and the daily identifier, and then it is gone. Nothing you type anywhere is collected, and nothing on this site connects your visit here to your use of the app. I do not sell data or share it with advertisers or brokers.
Three reasons, and no others:
Legal basis: Article 6(1)(f) GDPR, legitimate interests in understanding website traffic well enough to improve the site. The data is minimal, no identifier outlasts the day, nothing is stored on your device unless you opt out, and none of it is used to profile you or shared with anyone.
Use the switch below and analytics stops for you on this site, immediately and on this page. It saves one opt-out setting in your browser, so it covers this browser on this device. If your browser sends a Global Privacy Control signal, analytics is skipped automatically and there is nothing for the switch to do. Everything on the site works the same either way.
Data goes to TelemetryDeck GmbH in Augsburg, Germany, the same service the app uses, on the same terms: stored in the EU, never transferred outside the EU or the EEA, kept available for 24 months and then moved to cold storage rather than deleted.
The site is served by GitHub Pages, operated by GitHub, Inc. (United States). GitHub receives your IP address to deliver the page and records it in its own logs for security and abuse prevention. I have no access to those logs and no control over how long GitHub keeps them.
Legal basis: Article 6(1)(f) GDPR, legitimate interests in running the site securely.
GitHub adheres to the EU-U.S. Data Privacy Framework and also relies on the European Commission's Standard Contractual Clauses. Details:GitHub General Privacy Statement.
The rights listed above apply to what this website collects too, and so does the limit on them: the analytics data holds nothing that identifies you and no identifier that outlasts the day, so I can't find your records in it. What I can do is stop collecting from you, which is what the switch above does. The complaint route is the same, to Integritetsskyddsmyndigheten (IMY) or to the supervisory authority where you live.
This policy may be updated. Changes are published on this page with a new effective date. Questions about any of it go tohelp@boxtimer.app.
