Privacy policy

1. What information do we collect?

Information you give us

We collect the information you give us when you create an account, use Clocked, or contact us. Depending on what you do, this may include:

• Account details: your email address and, if you sign up with email, a password. Passwords are handled by our sign-in provider, Firebase Authentication, and stored only in hashed form; we never see them.
• Profile: your username, and optionally a display name, bio, profile photo, Top 5 games and "Into" tags.
• Your activity: the games you log, their status (Playing, Played, Clocked or Dropped), dates and platforms played, ratings, reviews, likes, bookmarks, lists and notes, and drop reasons.
• Social activity: who you follow, who you block, and any reports you make about other people's content.
• Age confirmation: before you sign up, you enter your birthdate to confirm you're 13 or older. Your birthdate stays on your device and is never sent to us; we store only the time you passed the check.
• Messages: what you send us when you email us, including if you email us asking for updates about Clocked.

Please keep your information accurate, and update it in the app if it changes.

Information collected automatically

• Server logs: when the app or website talks to our servers, our providers automatically record technical information such as your IP address, device and operating system type, app version, the time of the request and any errors. We use this to keep Clocked running, secure and free of bugs.
• Search: when you search for a game, the text you type and your device's IP address are sent to our search provider (see section 3).

We don't use advertising identifiers, third-party analytics or crash-reporting tools, and we don't collect your device's location. Our website sets no cookies and uses no trackers.

Information from others

If you sign in with Google, we receive basic information from your Google account, described in section 4. Game information shown in Clocked (titles, cover art and so on) comes from IGDB.com; it isn't information about you.

2. How do we use your information?

We use your information to:

• Run your account: create it, sign you in, and keep it working, including syncing your diary across your devices.
• Provide Clocked's features: your diary, shelves, reviews, lists, profile and the Following feed.
• Build features from your activity: for example, a taste profile or a yearly recap of what you played, worked out from the games you've logged. These are made for you to see and share; we don't use them for advertising.
• Keep Clocked safe: filter offensive words, act on reports, enforce blocks, and prevent fraud and abuse.
• Talk to you: answer your messages, and send you important notices about your account or changes to our terms and policies.
• Send updates you asked for: if you've asked for news about Clocked, we'll send it. You can stop it at any time (see section 9).
• Improve Clocked: fix problems and understand, in general, how features are used.
• Follow the law: meet legal obligations, respond to lawful requests, and protect our legal rights.

We'll ask for your permission before using your information for any other purpose.

3. When and with whom do we share it?

Other Clocked users

Clocked is a social diary, so some of what you add is public to other Clocked users, and may be seen by anyone who views a profile link you share. Public: your username, display name, bio, profile photo, Top 5 and "Into" tags, follower and following lists and counts, your diary, ratings, reviews, likes, lists and shelves. Private: your email address, bookmarks, settings, blocks and reports. People you've blocked, and people who've blocked you, can't see your profile or activity. If you deactivate or delete your account, your profile and activity are hidden from everyone right away.

Service providers

We use these companies to run Clocked. They process information only on our behalf and under contract:

• Google (Firebase and Google Cloud): sign-in, our database, server functions, file storage and website hosting.
• Algolia: game search. It receives the text you search for and your IP address, not your account details. We may move search to another provider; if we do, we'll update this list.
• Porkbun: forwards email sent to hello@clocked-app.dev.
• Apple: handles any in-app purchases (see section 5).

Other situations

• Legal reasons: if the law requires it, or to protect the safety, rights or property of our users, the public or Clocked.
• Business transfers: if Clocked is involved in a merger, sale, financing or acquisition, your information may be transferred as part of it. We'll tell you before your information becomes subject to a different privacy policy.

We don't sell your personal information or share it for targeted advertising. We don't send your personal information to IGDB.

4. How do sign-in providers work?

You can sign up with an email address and password, or with Google. We may add other options, such as Sign in with Apple or Discord, and will update this policy when we do.

If you sign in with Google, Google sends us your name, email address and profile picture, and we receive only what Google shares for sign-in. We use it only to create and run your account. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

We don't control how Google or other sign-in providers use your information. Please read their privacy policies.

5. What about purchases?

Clocked may offer paid features, such as a Clocked Pro subscription. Purchases in the app are processed by Apple under Apple's terms and privacy policy. We receive confirmation of what you bought and your subscription status, never your payment card details.

6. How long do we keep your information?

We keep your information for as long as you have an account, unless the law requires us to keep something longer.

• Deleting your account: when you ask to delete your account in the app, it's hidden right away. After 30 days, everything tied to it is permanently deleted: your profile, diary, reviews, lists, bookmarks, follows, blocks, reports and your sign-in account. Signing back in before then cancels the deletion.
• Diary entries you delete are deleted permanently, right away.
• Server logs are kept for a limited time by our providers, then deleted.
• Emails you send us are kept as long as we need them to help you.

If something can't be deleted right away (for example, because it's in a backup), we'll keep it secure and out of use until it can be.

7. How do we keep your information safe?

We use reasonable technical and organizational measures to protect your information. For example, information is encrypted in transit, private data can be read only by its owner, and changes that need to be trusted run on our servers, not in the app. But no system is completely secure, so we can't guarantee that your information will never be accessed, used or changed without permission.

8. Do we collect information from children?

Clocked is for a general audience and is not meant for children under 13. We don't knowingly collect, ask for or keep personal information from anyone under 13, and we don't target Clocked at anyone under 18. The age check comes before sign-up, so someone under 13 can't create an account or send us any information.

If we learn we've collected personal information from a child under 13 without verifiable parental consent, we'll deactivate the account right away and permanently delete its data from our systems, including Firebase and Algolia. If you believe a child under 13 has given us information, please email hello@clocked-app.dev.

9. What are your privacy choices?

In the app, you can:

• Edit your profile and username in Settings → Edit profile.
• Delete any diary entry, review or list.
• Deactivate your account in Settings → Deactivate account. It's hidden until you sign back in and reactivate it.
• Delete your account in Settings → Delete account. The app shows the date it will be deleted (see section 6).

You can also email hello@clocked-app.dev to ask for a copy of your information, to correct it, or to delete it.

Updates about Clocked: you can stop them at any time by using the unsubscribe link in any update, or by emailing us. We'll still send messages you need about your account.

Withdrawing consent: where we rely on your consent, you can withdraw it at any time by emailing us. This doesn't affect anything we did before you withdrew it.

10. Do-not-track signals

Some browsers and devices can send a "Do Not Track" signal. There's no agreed standard for responding to it, so we don't respond to it. It makes little difference here: we don't track you across other sites or apps, and our website uses no cookies or trackers. If a standard is adopted that we must follow, we'll explain it in this policy.

11. Rights for US residents

Depending on the state you live in, you may have the rights below. They can be limited in some cases by law.

What we've collected in the past 12 months

We keep each category for as long as you have an account, except server logs, which are kept for a limited time (see section 6). We collect this information from you, your device, and Google if you sign in with Google (see section 1), and use and share it as described in sections 2 and 3.

Selling and sharing

We share personal information with service providers under written contracts, as described in section 3. We have not sold or shared personal information for targeted advertising in the past 12 months, and we won't. We don't use sensitive personal information to infer anything about you.

Your rights

• To know whether we process your personal information, and to access it
• To correct inaccuracies in it
• To have it deleted
• To get a copy of the information you gave us
• Not to be treated differently for using these rights
• To opt out of targeted advertising, sale of your information, or profiling that produces legal or similarly significant effects. We don't do any of these.

How to use your rights

Email hello@clocked-app.dev, or use the account tools in the app (section 9). We'll need to confirm you're the person whose information it is, usually by asking you to email us from the address on your account. We'll use the information you give us for that only to verify your request. You can ask someone you authorize to make a request for you; we may ask them for proof, signed by you, that they're allowed to act for you. If we turn down your request, you can appeal by replying to our answer.

12. Rights for people outside the US

Clocked is run from the United States, and your information is stored and processed in the US. If you're in the European Economic Area, the United Kingdom, Switzerland or Canada, you may have rights under local data protection laws, including the rights to access, correct, delete, or get a copy of your information, to object to or restrict how we use it, and to withdraw consent. To use them, email hello@clocked-app.dev.

Where these laws apply, we rely on these legal bases: contract, to provide the Services you signed up for; legitimate interests, to keep Clocked safe and improve it; consent, for updates you ask for; and legal obligation, where the law requires it. When information goes to the US, we rely on appropriate safeguards, such as our providers' standard contractual clauses.

You also have the right to complain to your local data protection authority.

13. Do we update this policy?

Yes. We'll update it when Clocked or the law changes; for example, before adding features that collect new kinds of information, such as connecting your gaming accounts. The date at the top shows the latest version. If we make important changes, we'll tell you in the app or by email before they take effect.

14. How can you contact us?

Email hello@clocked-app.dev, or write to: