Privacy Policy

1. The Pomodoro timer

Timer sessions, statistics, and timer settings are stored only on your device. They are not sent to Airbok. Clearing history in the App deletes them.

2. Account data

If you use the private messaging area, you create an account. We store:

• your email address, used to sign you in with a one-time code and contact you about your account;
• a display name you choose, shown to the people you invite;
• your public encryption keys, needed so contacts can encrypt messages to you;
• the date your account was created and last updated.

We never store a password. Sign-in codes are sent by email and expire after a short time.

3. Messages and media

• Every message, photo, video, and voice note is encrypted on your device with keys that exist only on your device and your contact's device. Airbok stores only the encrypted form and cannot decrypt it.
• Encrypted messages are kept on our servers only until they are delivered and until the disappearing timer chosen by the sender has run out, after which they are deleted.
• Encrypted media files are stored in a private bucket and deleted when the message they belong to is deleted.
• Metadata we can see: which accounts are members of a room, when a message was sent, delivered, or viewed, and its size. We use this only to deliver messages and enforce room limits.
• Contact names you give to people stay on your phone only.

4. Invites and room hosting

When you create an invite, we store a hash of the invite code, your public keys, a signature, and an expiry date. We also record which account hosts each room so plan limits can be applied. The invite message you share, containing the download links and code, is sent by whichever app you choose and is not seen by Airbok.

5. Notifications

If you allow notifications, we store a push token for your device. When a new message arrives, we send a generic reminder notification. It never contains the sender's name or message content. Reminder wording is either our default set or lines you write yourself, which are stored with your account.

6. Subscriptions

Purchases are processed by Apple or Google. We receive from RevenueCat, our subscription processor, the product you bought, its status and renewal date, and a transaction identifier. We do not receive your payment card details. This data is used to unlock features and handle support requests.

7. Reports and blocks

If you block someone, we store the block so neither account can message the other. If you report someone, we receive the report reason and any message text you chose to include from your device, together with the accounts involved. Reports are kept for up to 12 months for safety and legal purposes.

8. Diagnostics

Crash reports and anonymous usage analytics are optional and off unless you turn them on in settings. When enabled, they include device model, OS version, app version, and the technical details of a crash. They never include message content.

9. Service providers

We use the following processors, all bound by data processing agreements:

• Supabase: database, authentication, storage, and functions, hosted in the European Union;
• Amazon Web Services: email delivery for sign-in codes;
• RevenueCat: subscription status;
• Apple and Google: push notification delivery and payments;
• Expo: push notification relay.

We do not sell personal data and do not use it for advertising.

10. Retention and deletion

• Account data is kept while your account exists.
• Encrypted messages are deleted on delivery and expiry as described above.
• You can delete your account at any time from the App. This removes your account, rooms, push tokens, reminders, and any encrypted data still stored. Reports and billing records required by law may be kept for the periods the law requires.
• Timer data is deleted when you clear history or uninstall the App.

11. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict its processing, and to complain to a supervisory authority. Most of these rights can be exercised directly in the App. For anything else, email privacy@airbok.com. We answer within 30 days.

12. International transfers

Our servers are hosted in the European Union. Where a provider processes data elsewhere, we rely on standard contractual clauses or an equivalent safeguard where required by applicable law.

13. Children

Omeu is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

14. Changes

We may update this policy. Material changes will be announced in the App before they take effect.