Privacy Policy

Last updated: 2026-05-04

1. Who we are

Score is a sourdough-baking tracker app published by Timeless Links ("we," "us," "our"). This Privacy Policy explains what personal information we collect when you use Score (the "Service"), how we use it, who it is shared with, and the choices you have about it.

If you have questions about this policy, contact us at mytimelesslinks@gmail.com.

2. Information we collect

2.1 Information you provide directly

• Account information. When you create an account we collect your email address, display name, and a hashed password (if you sign up with email/password). If you sign in with Google or Apple, we receive the email address and display name those providers return. We also record the timestamp of your account creation and most recent sign-in.
• Bake records. Anything you enter while tracking a bake, including ingredient measurements, timestamps for each stage, free-text notes, water-temperature settings, and final scores or ratings.
• Photos. Photos you upload to track the appearance and rise of your dough. Photos are stored alongside the bake record they belong to.
• Feedback. If you contact us using the in-app feedback link, we receive whatever you include in your message, including your email address.

2.2 Information collected automatically

• Photo metadata (EXIF). When you upload a photo, we may read embedded EXIF metadata such as the timestamp the photo was taken and, if your camera writes it, GPS coordinates. This metadata is used to pair the photo with contextual data for that bake. We do not request your device location separately.
• Weather data. When a photo's EXIF includes location or you allow it, we send an approximate location and the photo's timestamp to Open-Meteo to retrieve historical weather for that point. The returned weather is stored with your bake.
• Usage analytics. We use Google Firebase Analytics to record app-usage events such as screens viewed, feature use, crashes, and errors, along with a Firebase-assigned anonymous identifier and basic device information (OS version, app version, device model, language). This information is used in aggregate to understand how the app is used and to find bugs.
• Authentication tokens. When you are signed in, Firebase Authentication issues your device a session token used to keep you signed in. The token is stored locally on your device.

2.3 Information we do not collect

• We do not request access to your device's contacts, calendar, microphone, health data, or precise GPS location.
• We do not collect financial information through the app itself. If we offer paid features in the future, payments are processed by Apple, Google, or another platform's payment system; we do not see your card details.
• We do not knowingly collect data from children under 13.

3. How we use information

• To create your account and keep you signed in.
• To save your bakes and photos across devices and sessions.
• To attach contextual data (such as weather) to your bakes so you can see patterns over time.
• To diagnose bugs and improve the app's reliability and design.
• To respond to feedback and support requests.
• To detect and prevent abuse of the Service.
• To comply with legal obligations.

We do not use your information for advertising, do not sell or rent your information to third parties, and do not allow third parties to use it to advertise their own products to you.

4. Legal bases for processing (EEA / UK users)

If you are in the European Economic Area or the United Kingdom, we process your personal information on the following legal bases:

• Performance of a contract — to provide the Service you signed up for (account, bake storage, sync).
• Legitimate interests — to keep the Service secure, to improve it through aggregate analytics, and to respond to your messages.
• Consent — for any processing that requires it, such as sending you optional product communications. You may withdraw consent at any time without affecting prior processing.
• Compliance with legal obligations — when we are required to retain or disclose data by law.

5. Who has access to your information

We use a small number of service providers to run the app. These providers process information on our behalf under their own privacy and security commitments:

• Google Firebase (Authentication, Firestore, Cloud Storage, Analytics) — hosts your account, your bake data, and your photos, and provides usage analytics. See Google's privacy policy at policies.google.com/privacy.
• Apple Sign in with Apple — used only when you choose Sign in with Apple. See apple.com/legal/privacy.
• Open-Meteo — receives an approximate location and timestamp to return historical weather. See open-meteo.com/en/terms.
• Hosting / CDN — the Score web app is delivered through Netlify, which receives standard server-log information (IP address, user agent, request path) when your browser fetches the app's files.

We may also disclose information when we are required to do so by law, in response to a valid legal process, or to protect the rights, safety, or property of Timeless Links, our users, or others.

6. International data transfers

Score is operated from the United States. The service providers above may process your information in the United States and other countries where they operate. By using Score, you understand that your information may be transferred to and processed in countries whose data-protection laws may differ from those of your country of residence. Where required, we rely on Standard Contractual Clauses or other safeguards published by our processors.

7. How long we keep your information

• Account information and bake data are kept for as long as your account is active.
• You can delete your account at any time from the in-app account menu. Deletion immediately removes your account record, your bake history, your stage notes, and your uploaded photos from our active systems. Backups are typically purged within 30 days.
• Aggregate analytics that cannot be linked to an individual account may be retained beyond account deletion.
• If you contact us by email, we retain your message for as long as needed to handle your request and for a reasonable period afterward for our records.

8. Your rights and choices

8.1 All users

• Access and download your bake history at any time inside the app.
• Edit or delete individual bakes from the app.
• Delete your entire account from the in-app account menu.
• Disable notifications in your browser or device settings at any time.

8.2 EEA / UK residents (GDPR)

You also have the right to:

• Request access to the personal data we hold about you;
• Request correction of inaccurate data;
• Request erasure ("right to be forgotten");
• Request restriction of processing;
• Object to processing based on legitimate interests;
• Request data portability (a copy of your data in a portable format);
• Withdraw consent for any processing based on consent;
• Lodge a complaint with your local data-protection authority.

8.3 California residents (CCPA / CPRA)

California residents have the right to know what personal information is collected, used, shared, or sold; the right to delete personal information; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information; and the right not to be discriminated against for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioral advertising.

To exercise any of these rights, contact us at mytimelesslinks@gmail.com. We may need to verify your identity before responding. We will respond within the timeframes required by applicable law.

9. Children's privacy

Score is not directed to children under 13 (or under 16 in the EEA / UK), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

10. Cookies and similar technologies

The Score web app does not use advertising cookies. We use the following local-storage technologies to make the app work:

• localStorage / IndexedDB — to keep you signed in between sessions, to support offline use, and to store the timer state for an in-progress bake.
• Service Worker cache — to allow the app to load when you are offline.
• Firebase Analytics may set a Firebase-assigned identifier in local storage so that anonymous usage events from the same browser can be grouped.

You can clear these by clearing your browser's site data for Score, or by uninstalling the app on a mobile device.

11. Security

We rely on Google Firebase's infrastructure for storage and access control. Authentication uses industry-standard tokens, data in transit is encrypted with TLS, and data at rest is encrypted by our storage provider. Access to user data inside Firebase is restricted by Firestore and Storage security rules so that you can only read or write your own data. No system is perfectly secure; if we become aware of a security incident affecting your information, we will notify you as required by applicable law.

12. Future features

We are planning the following features that will affect data processing once they ship. We will update this policy before any of them go live:

• AI coaching. An optional paid feature that will analyze your bake history to provide personalized suggestions. Bake data sent for analysis would be sent only when you ask for it and may be processed by additional service providers.
• Subscriptions. Paid features will be offered through Apple's App Store and Google Play. Apple, Google, and our subscription-management provider receive limited information needed to administer your subscription.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If the changes are material, we will provide additional notice (for example, a banner inside the app or an email to your account address) before the changes take effect.

14. Contact

Privacy questions, rights requests, and complaints: mytimelesslinks@gmail.com.