Privacy Policy

Effective 11 September 2026

1. Controller and scope

This policy explains how the Boxing Timer app for iPhone and iPad (the “App”) and its support and legal pages handle information. The data controller is APP BOX EOOD (Bulgarian: “Апп Бокс” ЕООД), UIC 207060361, with registered office at Lazur District, Block 109, Apartment 5, 8000 Burgas, Bulgaria (“APP BOX”, “we”, “us”). Privacy requests may be sent to info@appbox.group.

At a glance: the App has no account, in-App advertising, or cross-app tracking. Workout details stay on your device. Google Analytics for Firebase and Firebase Crashlytics collect pseudonymous usage, purchase, device, and diagnostic information in standard App builds, and Apple Search Ads attribution measures eligible Apple Search Ads acquisition.

2. Information kept on your device

Your timer presets, custom timer names, current workout state, selected language, sound and display preferences, and onboarding status are stored in the App’s private container on your device. APP BOX does not receive these workout details. You can delete custom timers in the App and remove the remaining local data by deleting the App.

3. Purchases

Subscriptions and Lifetime Access are processed by Apple through the App Store and StoreKit. The App receives product identifiers and verified transaction and entitlement status so it can show offers, complete purchases, restore access, and unlock premium features. Google Analytics for Firebase also measures in-app purchase and subscription events, including product ID, name, price, and purchase-flow outcome, associated by default with a pseudonymous App instance ID. APP BOX does not receive your payment-card details or Apple Account password. Apple processes purchase information under its App Store Privacy Notice.

4. Analytics and crash diagnostics

In standard App builds, Google Analytics for Firebase and Firebase Crashlytics are enabled when the App launches. Analytics assigns a pseudonymous App instance identifier and measures App lifecycle events, screen and feature interactions, onboarding progress, timer actions, paywall plan selection, and purchase or restore outcomes. It also receives general App, device, operating-system, language, and coarse geographic information derived from masked IP addresses. Crashlytics sends crash traces and technical state needed to diagnose stability problems, including pseudonymous installation and session identifiers, crash time, App version and bundle identifier, operating-system version, device model and architecture, available memory and storage, and device state.

We do not set a Firebase user ID, include the advertising identifier, enable advertising personalization, or add custom timer names, detailed workout settings, email addresses, payment-card information, or Apple Account credentials to analytics or crash reports. The data is not used for cross-app tracking, advertising, or profiling. These services are not controlled by a separate in-App switch.

We process this information for our legitimate interests in understanding feature use, measuring the purchase funnel, maintaining security and reliability, diagnosing failures, and improving the App. You may object to this processing by contacting us. Google states that Crashlytics retains crash traces and associated identifiers for 90 days before beginning removal from live and backup systems. Analytics event-level data is retained under our configured Google Analytics retention settings; aggregated reporting may be retained longer. Learn more in Privacy and Security in Firebase, Google’s App Store data-disclosure guidance, and the Google Privacy Policy.

5. Apple Search Ads attribution

On an eligible launch, the App may create an app-specific pseudonymous installation link and use Apple App Attest cryptographic proofs when it contacts the APP BOX service. These checks help us reject fraudulent client requests; they do not create an APP BOX account or include workout details.

The App may send a fresh Apple Search Ads AdServices attribution token when Apple makes one available. We use it only to measure Apple Search Ads acquisition. The token is encrypted while it is processed and its bytes are removed after terminal processing, no later than 24 hours after receipt. The resulting app-specific attribution link is retained for up to 180 days. We do not send a Firebase app-instance identifier or use IDFA through this service, and we do not use the information for targeted advertising or to join Boxing Timer activity to our other apps. Apple determines whether the resulting attribution is standard or detailed through its own global and per-app tracking controls. The App does not show an ATT prompt solely for this request, and denying tracking does not prevent use of the App.

6. Notifications and audio

If you grant notification permission, workout alerts are generated and scheduled locally by iOS. The App does not use remote push notifications. Timer sounds are bundled with the App and are played locally.

7. Website access and support messages

These support and legal pages do not use advertising, analytics scripts, or cookies. When you visit them, our hosting infrastructure processes standard access-log information such as IP address, request time, requested path, user agent, and response status to deliver and secure the site. Access logs are rotated and retained for no more than 30 days. This processing is based on our legitimate interest in operating a secure and reliable website.

If you email support, we use your email address, message, and any information you choose to include to answer and administer your request. Please do not send health information or other sensitive personal data. Support correspondence is retained only while needed for support and legitimate legal or business records, normally no longer than 24 months after the request is closed.

8. Purposes and legal bases

On-device settings and StoreKit entitlement status are processed to provide the App and perform the purchase contract you request.
Pseudonymous analytics and diagnostics are processed for our legitimate interests in understanding, securing, supporting, and improving the App.
Apple Search Ads attribution is processed for our legitimate interest in measuring Apple Search Ads acquisition, preventing fraud, and securing the APP BOX service.
Website security logs and support correspondence are processed for our legitimate interests in securing, supporting, and improving the App and website.
Information may be retained or disclosed where necessary to comply with a legal obligation or establish, exercise, or defend legal claims.

9. Sharing and international processing

We do not sell personal information and do not use it for targeted advertising, profiling, or cross-app tracking. Information is shared only as needed with Apple for purchases, App Attest, and Apple Search Ads attribution; Google for analytics and diagnostics; our hosting and technical service providers; professional advisers; or public authorities where legally required. Google and Apple may process information on global infrastructure, including outside the European Economic Area, under their published safeguards and applicable data-transfer mechanisms.

10. Retention and your choices

On-device App data remains until you change or delete it or delete the App.
Apple controls App Store transaction records under its own policies.
Firebase retention is described above.
Apple Search Ads attribution-token bytes are retained for no longer than 24 hours; the resulting app-specific attribution link is retained for up to 180 days.
Website access logs are retained for no more than 30 days.
Support correspondence is normally retained for no more than 24 months after closure, unless law or an active claim requires longer.

11. Your data-protection rights

Subject to applicable law, including the GDPR, you may request access, correction, deletion, restriction, or portability of your personal data and object to processing based on legitimate interests. Because the App has no account and Firebase identifiers are not linked by us to your name or contact details, we may be unable to identify a particular analytics or diagnostic record without additional information. Send requests to info@appbox.group. We may ask for information reasonably necessary to verify your request.

You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection or the supervisory authority where you live or work.

12. Children

The App is a general fitness timing tool and is not designed to solicit personal information from children. It has no account or social feature. A parent or guardian who believes a child has sent information through support may contact us so we can assess and delete it where possible.

13. Security and changes

We use reasonable technical and organisational safeguards appropriate to the limited information processed, but no transmission or storage method is completely secure. We may update this policy when the App, service providers, or legal requirements change. Material changes will be communicated through the App or App Store listing where appropriate, and the effective date above will be updated.