Sharp State

Privacy Policy

Last updated: October 8, 2026

This policy explains what personal data Sharp State (the website at sharpstate.app and the Sharp State Chrome extension) collects, why, who it is shared with, and the rights you have over it.

1. Who is responsible for your data

The data controller is the individual entrepreneur below. For any privacy question or request, write to privacy@sharpstate.app.

2. What we collect and why

Your account

Your name and email address, and your password, which is stored only as a one-way hash. If you sign up with Google, we receive your name, email address and profile picture from Google, plus the identifiers Google returns so you can sign in again. We use this to create and run your account. Legal basis: performance of our contract with you (GDPR art. 6(1)(b)).

Sign-in sessions

When you sign in we record the session's IP address and browser user agent, to keep you signed in and to detect misuse of your account. Sessions expire after 7 days without use. Legal basis: contract, and our legitimate interest in keeping accounts secure (art. 6(1)(f)).

Pomodoro activity and settings

Your focus sessions and intervals (start and end times, planned and actual duration, whether they were completed) and your timer settings. This is what the timer and your dashboard statistics are built from. Legal basis: contract.

Subscription

Your plan (free or Premium), subscription status, billing period dates and the Stripe customer and subscription identifiers that link your account to your payments. We never see or store your card details — Stripe collects them directly. Legal basis: contract.

Chrome extension settings

Your blocking mode and the domains on your block or allow lists, so the extension can block distracting sites during your focus sessions. Legal basis: contract.

Navigation tracking (Premium, off by default)

Only if you are on Premium and switch on “Track navigation” in the extension settings, the extension records, for each day, the domain of the tab you are actively using (for example youtube.com), how many seconds you spent on it and how many times you visited it. While it is on, this covers all your browsing in that Chrome profile, not only focus sessions; it pauses when Chrome is in the background or you are idle. It never records full addresses, page titles, page content or anything you type. Legal basis: your consent (art. 6(1)(a)). You can withdraw it at any time by switching tracking off, and you can delete all tracking data from the extension settings page.

Support access by our administrators

Our administrators can see your account details and, to fix a problem you report or to investigate abuse, temporarily view the service as you would see it. Legal basis: our legitimate interest in supporting users and protecting the service.

Website analytics

We use Vercel Web Analytics to count page views. It sets no cookies and does not track you across sites: visits are told apart by a hash of the request that is discarded after 24 hours, and we only see aggregated figures. Legal basis: our legitimate interest in understanding how the site is used.

When you contact us

If you email us, we use your email address and message to reply. Legal basis: legitimate interest in answering you.

What is required, and automated decisions

Your name, email address and a password (or a Google account) are needed to create an account; without them we cannot provide the service. Everything else is generated as you use it, and navigation tracking is entirely optional. We do not make decisions about you based solely on automated processing, including profiling.

3. The Chrome extension

The extension talks only to sharpstate.app. On your device it keeps:

  • the sign-in token that links it to your account;
  • a copy of your blocking settings and lists;
  • if navigation tracking is on, the per-domain totals not yet uploaded (they are sent to our servers every few minutes);
  • your language preference.

It asks for access to all websites because Chrome only lets an extension redirect a page to the “blocked” screen when it has access to that page's address. It does not read or change page content. The tabs and idle permissions are used only for navigation tracking, to know which domain is active and when you are away.

The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not sell your data, use it for advertising, or use it for anything other than providing the features described here.

4. Who we share data with

We do not sell personal data or share it with advertisers. We use these providers to run the service, each bound by a data processing agreement:

  • Vercel Inc. (United States) — hosting and website analytics.
  • Neon Inc. (database hosted on Amazon Web Services in the United States) — stores the data described above.
  • Google — sign-in with Google, if you choose it, and our business email.

Stripe sells Premium subscriptions to you as merchant of record and processes payments. For the purchase, Stripe acts as an independent controller under its own privacy policy. Stripe tells us your subscription status and identifiers, not your card details.

We may also disclose data where the law requires it, for example to comply with a court order.

5. International transfers

Some of these providers process data in the United States. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.

6. How long we keep it

  • Account, pomodoro, settings and extension data: while your account exists. Deleting your account deletes all of it.
  • Navigation tracking data: until you delete it from the extension settings or delete your account.
  • Sign-in sessions: until they expire or you sign out.
  • Payment records: kept by Stripe for as long as tax and accounting law requires.
  • Emails with us: as long as needed to deal with your request.

7. Your rights

You can ask to access, correct or delete your data, to receive it in a portable format, to restrict or object to its processing, and you can withdraw consent at any time. Account deletion is not self-service yet: email privacy@sharpstate.app from the address on your account and we will delete it, normally within one month. If you think we have handled your data unlawfully, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, or the authority in your own EU country.

8. Minimum age

You must be at least 16 years old to create an account. We do not knowingly collect data from younger children; if you believe we have, contact us and we will delete it.

9. Security

All traffic is encrypted with HTTPS, passwords are stored only as hashes, and access to personal data is limited to what is needed to run and support the service.

10. Cookies

We use only the cookies needed for you to sign in. See the cookie policy.

11. Changes to this policy

If we change this policy, we will update the date at the top. If the change is significant, we will also tell you in the app or by email.