Privacy Policy for ZCL Timer

Who is responsible and how to contact us

The operator of ZCL Timer is responsible for the personal data processed to provide the app. For privacy questions, requests or concerns, contact zcltimer-question@gmail.com.

Account and training information

When you create an account, we collect your name, surname, email address, optional WCA ID and a hashed password when you use password-based login. Google and Apple sign-in provide the account information needed for authentication; you do not provide their passwords to ZCL Timer. We also store account activity timestamps, such as the last-seen time, to operate the service.

Training records can include the scramble, solve time, penalties, DNF status, optional description, favourite status, puzzle, creation and update timestamps, and the user identifier used to associate records with your account. We use this information to provide the timer, history, statistics and synchronisation across devices.

Google AdMob advertising and paid premium purchases are not enabled in this app version.

Guest training data is stored on the device rather than linked to a ZCL Timer account. Network services may still process technical information when used; guest access does not guarantee that no personal data is processed.

Optional WCA statistics

If you enter a WCA ID, we use that identifier to retrieve public competition information originally published by the World Cube Association. We access the unofficial API maintained by Robin Engelbrecht, whose JSON files are hosted on GitHub. The imported information includes the competitor's name, country, WCA ID, number of competitions, personal records, national/continental/world rankings, and competition and round results, including attempts and positions. Competition names and dates are retrieved to display the history and graph.

We use these data to show official statistics and to compare them with your locally available training personal bests for the selected event. The comparison is calculated on your device. Linking an ID does not verify that you are the person identified by the WCA profile.

Requests go through our Cloudflare backend. The external source receives the requested WCA or competition identifier and technical information associated with the server request. We do not send it your ZCL Timer email address, authentication token or training results. Following a link to a WCA page or this privacy website causes your browser to contact that website directly.

Results and rankings are supplied from a public data source that updates daily. They are not live competition results. Removing your linked ID or deleting your ZCL Timer account does not change or delete records held by the WCA, GitHub or the API maintainer.

Purposes and legal basis

We process account and training data to provide the services you request, including authentication, synchronisation, history and statistics. Processing necessary to provide these services is based on Article 6(1)(b) GDPR. Entering a WCA ID requests the optional official-statistics feature; we use the ID and the associated public results to provide that feature. You can stop the association by removing the ID.

This privacy information is not a request for blanket consent. Simply using the app does not constitute consent to every processing activity. Where a particular activity requires consent or another legal basis, it must be addressed separately.

Service providers and processing locations

ZCL Timer uses Cloudflare Workers for API processing and Cloudflare D1 for backend storage, including the WCA cache. GitHub hosts the external API's public data files. Google and Apple are involved when you use their sign-in services.

Our Cloudflare D1 database is restricted to storage within the European Union. Cloudflare Workers use distributed infrastructure, so request processing can take place outside the European Union. The GitHub-hosted source also uses international infrastructure. EU database storage does not imply that all processing is limited to the EU.

Cloudflare describes its international-transfer safeguards, including standard contractual clauses where applicable, in its Customer Data Processing Addendum at https://www.cloudflare.com/cloudflare-customer-dpa/. GitHub describes its transfer safeguards, including standard contractual clauses and applicable adequacy frameworks, at https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement. You may contact us for further information or a copy of applicable safeguards.

Retention and cache

Account and synchronised training records are retained while your account is active, subject to your deletion requests. Device data remains on the device until removed through the app or device controls.

The WCA server cache is shared by public identifier and is not a separate copy of your account. It is refreshed on demand after 24 hours. If the source is unavailable, the last successfully fetched copy can be used for less than seven days after that fetch. Failed refreshes do not extend its age. A daily cleanup removes entries aged seven days or more, so deletion can occur up to one daily cleanup cycle after the seven-day threshold.

The app stores a local copy of the linked profile and associated competition details. On the next access it rejects copies aged seven days or more. It removes the local copy when the linked ID changes or is removed, on logout, or when the account is deleted on that device. Removing an account association does not immediately delete a shared public server-cache entry; that entry follows the retention schedule above.

Security

Passwords for credential-based accounts are stored as bcrypt hashes. We use encrypted HTTPS connections for backend and WCA requests. Hashing reduces password exposure but does not guarantee that a security incident cannot occur.

Your choices and rights

You can leave the WCA ID empty or remove it in Account settings. You can manage individual training records, request a copy of account data, and request account deletion through the app or by contacting us. Account deletion does not delete original public competition results from their independent sources.

Under the GDPR, where applicable, you can request access, rectification, erasure, restriction and portability, and object to processing. Where processing relies on consent you can withdraw it without affecting the lawfulness of earlier processing. You can lodge a complaint with a competent data-protection supervisory authority, including the Italian Garante at https://www.garanteprivacy.it.

Updates

We publish updates at https://privacy.zcltimer.com. The effective date and version identify the published policy. Material changes will be brought to your attention through an appropriate notice in the app.