Privacy policy

StandCycle is a sit-stand timer that runs in your browser. Your settings and history are kept on your device unless you sign in to back them up. We measure how the app is used, anonymously, to improve it, and you can turn that off at any time. This policy explains all of it.

Who we are

StandCycle is operated by Enric Planas Mulet, the data controller under the General Data Protection Regulation (GDPR). Contact us at hello@standcycle.app.

What stays on your device

StandCycle stores your interval settings, your current timer session, your daily totals and streak, the times your timer changed phase, the record of your climb, and your preferences in your browser's local storage.

Without an account, none of it is stored on our servers. The app is fully usable this way and always will be. Only the anonymous usage statistics described below leave your device. There is no copy of your record on our servers, and if you clear your browser data it is deleted permanently — we cannot restore it.

If you sign in

The timer works without an account. Once you have a streak, StandCycle offers to back your record up with Google, and after a few days of use the Journey asks for it before showing your whole record; the purpose is to keep it safe and let it follow you to another desk.

What we receive. When you sign in with Google, we receive your email address, and the account identifier Google gives us. We do not receive your Google password, your contacts, or anything else in your Google account.

What we then store.A copy of what is already on your device: your daily totals (including each day's longest unbroken sit) and the state of your climb. The times your timer changed phase stay on your device. Your account also keeps the settings that should follow you to another desk: your intervals, workdays and days off, holiday country, daily goal, whether the timer waits until you're up, and display choices such as units. Nothing new is collected because you signed in — the same record, in a second place.

Other climbers. If you join, the peak you are climbing, your altitude on it, how many days you have been climbing it and a name you choose are visible to a small number of other people who have also joined. We suggest the first name on your Google account; you can use any name, change it at any time in Settings, and other people may use the same one. Before a name is shown to anyone it is checked for offensive content, advertising and impersonation, automatically, by the moderation service named below; the check sees only the name. The name stays with your account so you keep it if you come back. Leaving deletes your position. The number of people on a peak is shown to anyone and names no one. It is off unless you join.

To get a copy of your record, or to have your account and everything in it deleted, email us from the address you sign in with (see “Your rights” below). Without an account there is nothing of yours on our servers: clearing your browser's data for this site deletes the record completely.

If you pay

Payments are handled by our merchant of record, who is the seller and takes your payment details directly. We never see or store your card number. We receive confirmation that a payment succeeded, and we store which plan you are on and when it renews. We keep the receipts we are required to keep for tax and accounting.

What we collect

Usage analytics.We record how the app is used, to improve it: which features are opened, when timers are started and completed, and similar product events. Once a day the app also sends an anonymous summary of the day before: the minutes spent sitting, standing and walking, the breaks taken and let pass, the longest stretch of sitting, and whether the day met your goal and counted for your streak. Each event carries technical information from your browser: the page address, approximate location derived from your IP address (country or region), browser, operating system, device type, and referring site. A randomly generated identifier is kept in your browser's local storage (not a cookie) so that repeat visits from the same device count as one visitor. It is never linked to your account or your email, even if you sign in. We do not record your screen, your keystrokes or the contents of anything you type, and the statistics are used for nothing but understanding and improving StandCycle.

Traffic measurement. We measure aggregate traffic to the site: page views, referrer, country, and device type. This is cookieless and sets no identifier on your device.

Server logs. Our hosting provider records standard request logs, including IP addresses, for security and reliability.

What we do not do

• We do not sell, rent, or share your data.
• We do not show advertising or load advertising scripts.
• We do not build advertising profiles or track you across other sites.
• We do not ask for your address, and for a name only if you join other climbers.
• We never see or store your card details — the payment provider handles those.
• We do not require an account to use the app, and we never will.

Our legal basis

We rely on our legitimate interest in understanding how StandCycle is used for the anonymous usage analytics described above, which are limited to measuring and improving this app, and you can object at any time, as described below. We rely on your consent for showing you to other climbers; switching it off withdraws it and deletes what was shared.

We rely on the performance of our contract with you for your account and for the backup of your record, and for anything to do with a payment you have made.

We rely on our legitimate interests for cookieless traffic measurement, server logs, and keeping the service secure and working.

How to turn analytics off

Use the switch under “What we collect” above. The choice is remembered in that browser and takes effect immediately. If your browser sends a Global Privacy Control or Do Not Track signal, analytics never start at all. Content blockers work too. No feature of the app depends on analytics being on.

Who processes data for us

We use PostHog for product analytics, Vercel for hosting and traffic measurement, and — only if you sign in — Supabase for the database and the sign-in itself, and — only if you join other climbers — OpenRouter, which runs TypeSafe AI's moderation model, to check the name you choose. Each processes data only on our instructions. Google is the sign-in provider, and acts as an independent controller for what happens inside your Google account.

Where personal data is transferred outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

How long we keep it

Analytics events are kept for up to 12 months, then deleted or aggregated. Server logs are kept for a short period. Data on your device stays until you delete it.

If you have an account, your record is kept for as long as the account exists, and is deleted when you delete it. Payment records are kept for as long as tax law requires.

Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to receive it in a portable format, and to withdraw consent. Email hello@standcycle.app and we will respond within one month.

You may also complain to your data protection authority. In Spain this is the Agencia Española de Protección de Datos (aepd.es).

Cookies and local storage

StandCycle sets no advertising cookies. The app uses local storage for the settings and history described above, and for the analytics identifier described under “What we collect”, which is replaced with a new one every 12 months. Turning analytics off stops it being used.

Children

StandCycle is not directed at children, and we do not knowingly collect data from anyone under 16.

Changes

If what we collect changes, we will update this page and the date above. Significant changes will be announced in the app.

See also our terms of use and our pledge.