Privacy policy

Last updated May 16, 2026 · v1.0

1. Who we are

Tabata Timer is developed by an independent solo developer based in Tenerife, Canary Islands, Spain. For GDPR purposes, the data controller is that same individual. For contact: [email protected].

There's no head office, no employees, no investors, and no contractual obligation to share anything of yours with anyone. Worth saying out loud.

2. What data we process

The app is built around the principle of data minimization. We only handle what's strictly needed for the timer to work and for your history to still make sense the next time you open the app.

2.1 Data generated on the watch

• Workout presets. Name, phases (work / rest / sets), prep time. You type these in.
• Session history. Date, total duration, average and peak heart rate, estimated kcal.
• Preferences. Sound, vibration, language, haptic intensity, AOD on/off.

2.2 Data we don't process

• Name, email, date of birth, gender, weight, height.
• GPS or network location.
• Contacts.
• Advertising identifiers (Android Advertising ID).
• Any persistent identifier that ties you across sessions.

3. Where it's stored

Everything in section 2.1 is kept in on-device local storage (Room/SQLite on the watch and, optionally, on the paired phone). Watch ↔ phone sync uses Google's Wear OS Data Layer API over local Bluetooth LE — it never touches a server of ours.

If you back up your watch with your Google or Samsung account, those backups may include app data. That's no longer in our hands — it depends on your settings with the manufacturer.

4. Health and heart-rate data

During a session, the app subscribes to Health Services on Wear OS to read your live heart rate. We don't store the full time series — only per-session aggregates: average, peak and zone threshold.

If you revoke the body sensors permission (android.permission.BODY_SENSORS), the app keeps working — the HR indicator is hidden and kcal estimates fall back to a time-based calculation.

5. Android / Wear OS permissions

• BODY_SENSORS — to read heart rate during the session. Optional.
• FOREGROUND_SERVICE + FOREGROUND_SERVICE_HEALTH — to keep the timer running with the screen off. This is the core of the product.
• POST_NOTIFICATIONS — for the persistent notification with the time remaining.
• VIBRATE — for the phase-change haptics.
• WAKE_LOCK — to stop the SoC from sleeping mid-set.

No other permissions are requested. In particular, we never ask for location, camera, microphone, external storage or network access.

6. Third parties and SDKs

6.1 The app (Android / Wear OS)

The binary you download from Google Play is built without analytics, advertising, crashlytics or A/B testing SDKs. The only external dependencies are:

• Google's official AndroidX and Wear OS libraries.
• The Health Services Client from Google, which runs inside the watch OS itself.

We don't share data with Google beyond what the OS itself needs to deliver the persistent notification and manage the sensors.

6.2 This website (letshiit.com)

This website uses Google Analytics 4 to measure traffic in aggregate. GA4 collects data such as pages visited, session duration, device type and country of origin (never city or full IP). IP addresses are anonymised before processing. Data is retained for 14 months and is not used for personalised advertising. The legal basis is legitimate interest (Art. 6(1)(f) GDPR) in analysing website performance to improve it.

You can opt out of GA4 by installing the Google Analytics opt-out browser add-on.

7. Your rights under GDPR

Since we're based in the EU, the full GDPR catalogue applies to you: access, rectification, erasure, objection, restriction and portability. In practice — and because we don't store anything on our own servers:

• Access and portability: export your history from the companion app under Settings → Export (JSON).
• Erasure: Settings → Wipe all data. Uninstalling the app also removes everything from the device.
• Complaints: you can file a complaint with the Spanish Data Protection Agency (AEPD) if you think we're doing something wrong.

8. Changes to this policy

If anything material ever changes — for example, if we add cloud sync — we'll give you at least 30 days' notice inside the app and on this page, and any such feature will always be opt-in. The current version and the full changelog will live forever at github.com/letshiit/policy.

9. Contact

For any question, comment or suggestion about privacy — or about the product in general — write to us at [email protected]. We usually reply within 48 h, normally with a coffee on the desk.