← Back to Clink

Privacy Policy

Last updated: June 29, 2026

1. Introduction

Clink ("we," "our," or "us") is an iOS boxing interval timer. This Privacy Policy explains what data we collect, what we don't, and how your data flows between your device, Firebase, and RevenueCat.

Clink is built by one developer. We don't sell ads, we don't track you across other apps, and most of the app runs entirely on your device without ever sending data anywhere.

2. How Your Data Flows

The cleanest way to understand Clink's privacy model is to follow the data:

• Device only (no account needed): Your timer settings (color mode, sound preferences, keep-awake toggle), local presets, and session history are stored on-device via AsyncStorage and never leave your phone unless you sign in. A Clink account is completely optional — the full timer works without one.
• Device ↔ Firebase Auth REST (when you sign in):When you create an account or sign in, your credentials are sent to Firebase Authentication via HTTPS REST. Firebase returns a session token stored in your device's keychain via Expo Secure Store. We never store your password in plaintext.
• Device ↔ Firestore REST (logged-in users only):If you are signed in, your custom presets, custom drills, and session history are synced to Google Firestore under your user ID (UID). Firestore security rules restrict every document to your own UID — no one else can read or write your data. Guest users' data stays on-device only.
• Device ↔ Apple / Google (sign-in): If you sign in with Apple or Google, that provider handles authentication and returns a token to Firebase Auth. We never see your Apple or Google password.
• Device ↔ RevenueCat ↔ Apple (one-time purchase): If you purchase Clink Pro ($2.99 one-time), the purchase is processed by Apple. RevenueCat sits between the app and Apple to report whether your Pro entitlement is active. RevenueCat receives an anonymous user identifier we generate for you and the receipt data Apple returns. We never see your Apple ID or payment method.

Clink contains no analytics SDK — no PostHog, no Mixpanel, no Firebase Analytics, no Amplitude, or any equivalent. No behavioral events are sent anywhere. No AI or cloud processing is involved in any timer feature. The timer runs entirely on-device.

3. Information We Collect

Account information (only if you sign up)

• Email address (if you sign up with email or Google; Apple may relay a private address)
• A Firebase Authentication user ID (UID), generated when you create an account
• The sign-in provider you used (Apple, Google, or email)

Account creation is entirely optional. The timer works fully without one.

Timer configuration (logged-in users — synced to Firestore)

• Named presets you save: round count, round duration, rest duration, warmup duration, warning time, and sound preferences per preset
• Custom drills you create: drill name, per-round exercise key, label, duration, and rest duration

Session history (logged-in users — backed up to Firestore)

• For each completed session: completion timestamp, preset name, rounds completed, total rounds configured, round duration, rest duration, warmup duration, and total elapsed time

Session history is stored locally on-device first and is always available offline. Firestore is a backup for signed-in users. No session content — no audio, no recordings, no health data — is stored or transmitted.

Purchase state

• Whether your Clink Pro entitlement is active (true/false), as reported by RevenueCat and Apple

On-device only (never transmitted)

• Color mode preference (Dark, Light, System)
• Keep-awake setting
• Sound toggle preferences per bell event
• Active theme selection
• Share card color scheme and layout preference

What we do NOT collect

• No advertising identifier (no IDFA, no IDFV-based tracking)
• No location, contacts, calendar, microphone, or camera data
• No analytics or behavioral event tracking of any kind
• No AI or cloud processing — the timer runs entirely on-device
• No cross-app or cross-site tracking
• No health or biometric data
• No session recording or screen replay

4. Tracking & Advertising

Clink does nottrack you across other companies' apps or websites. We do not participate in ad networks, retargeting, or audience-building of any kind. We do not use Apple's IDFA (Identifier for Advertisers). Accordingly, Clink does not present an App Tracking Transparency (ATT) prompt because no cross-app or cross-site tracking occurs.

5. Third-Party Services

Clink relies on the following services, each with their own privacy policies:

• Google Firebase (Authentication, Firestore): handles account sign-in and stores your presets, drills, and session history if you are signed in. Data is processed in Google Cloud infrastructure.
• Apple: handles Sign in with Apple, App Store distribution, and Clink Pro in-app purchase billing.
• Google Identity: handles Sign in with Google.
• RevenueCat: reports your Clink Pro purchase status (active/inactive) to the app. RevenueCat receives an anonymous user identifier we generate and the receipt data Apple returns. RevenueCat processes data in the United States.

6. Data Retention & Deletion

Your presets, drills, and session history in Firestore are retained until you delete them or delete your account. You can delete any individual preset, drill, or session directly in the app.

You can delete your entire account from the Menu tab → "Delete my account." This performs a series of Firebase REST calls that:

• Delete all your presets in Firestore
• Delete all your custom drills in Firestore
• Delete all your session history in Firestore
• Delete your Firebase Auth account (invalidating all sessions)

This is irreversible. On-device data (settings, local presets, cached history) is removed when you uninstall the app.

7. Legal Basis for Processing (GDPR)

If you are located in the EEA, United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Contractual necessity (Art. 6(1)(b) GDPR): account creation and cloud sync of your presets, drills, and history — necessary to deliver those optional cloud features if you opt in.
• Legitimate interest (Art. 6(1)(f) GDPR): basic platform operation and abuse prevention.

8. International Data Transfers

Firebase and RevenueCat process data in the United States. If you access Clink from outside the U.S. and choose to sign in, your data is transferred to and processed in the U.S. These providers offer Standard Contractual Clauses for cross-border transfers.

9. Your Rights

You have the right to:

• Access the data stored in your account (your presets, drills, and session history are visible in the app)
• Delete individual presets, drills, or sessions at any time
• Delete your entire account at any time from the Menu tab
• Request a copy of your data by emailing us

EEA/UK residents (GDPR): you also have the right to data portability, the right to restrict or object to processing, and the right to lodge a complaint with your local data protection authority.

California residents (CCPA/CPRA):you have the right to know what personal information we collect, the right to delete it, and the right to opt out of "sale" or "sharing" of personal information. We do not sell or share your personal information.

10. Children's Privacy

Clink is not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has signed up, contact us and we will delete the account.

11. Security

Authentication tokens are kept in iOS Keychain via Expo Secure Store. All traffic between the app and Firebase uses HTTPS. Firestore security rules restrict every user's data to their own UID. The timer itself runs entirely on-device and does not transmit data during a session.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced on this page and (if significant) in the app. Continued use of Clink after changes constitutes acceptance.

13. Contact

Questions, requests, or anything else: write to support@moetalaat.com.

14. Summary

In short: Clink works entirely on-device and never transmits anything if you don't sign in. If you do create an account, only your timer presets, custom drills, and session completion records go to Firestore under your private UID. There is no analytics SDK, no AI processing, no advertising, and no tracking. Delete your account and all server-side data is gone.