This policy explains what Look20 collects, why we collect it, who helps us process it, how long we keep it, and the choices you have. We keep it short where we can, because Look20 needs very little about you to work.
1. Who we are
Look20 (“we”, “us”) provides the Look20 apps for iPhone, Android, Mac, Windows and Linux, the Look20 web app, the Chrome and Firefox extension, and this website. Look20 is the controller of your personal data under the EU and UK General Data Protection Regulation (GDPR) and the data fiduciary under India’s Digital Personal Data Protection Act, 2023 (DPDP Act). You can reach us at support@look20.com.
2. The short version
- We keep what the app needs to work: your email address, your devices, your settings, and 40 days of break history.
- No ads, no third-party analytics, no tracking cookies, and we never sell your personal data.
- Custom sounds you add stay on your device. We never receive them.
- You can see, correct, export or delete your data by emailing support@look20.com.
3. What we collect
| Data | What it is | Why we need it |
|---|---|---|
| Email address | The address you sign in with. | To send your one-time sign-in codes, keep your devices under one account, and contact you about your account or purchases. |
| Sign-in records | Short-lived sign-in codes, the tokens that keep a device signed in, and counts of code requests. | To sign you in securely and limit abuse. Codes expire within minutes and are deleted soon after. |
| Devices | For each device you sign in on: a random device identifier, the label you see (for example “Work laptop”), its kind (iPhone, Android, desktop, web or extension), whether breaks are on for that device, and when it was last seen. | To sync one schedule across your devices, show your device list, and let you turn breaks on or off per device. |
| Schedule settings | How often breaks come, how long they last, whether your schedule is running or stopped, and when the next break is due. | To run the shared schedule on every device. |
| Break history | When each break happened and whether you finished, snoozed or skipped it. | To show your week of suns and history. |
| Purchase status | Whether you have Plus or a trial, which plan, renewal or expiry dates, and a reference from the payment provider or app store. | To unlock Plus on all your devices and handle renewals, cancellations and refunds. We never receive your full card number. |
| Support messages | What you write to us and our replies. | To help you and keep a record of the conversation. |
| Technical data | IP address, browser or app version and request times, in our providers' short-lived service logs. | To deliver the service, keep it secure and fix problems. |
We do not collect your name, phone number, location, contacts, photos, microphone or camera input, advertising identifiers or browsing history.
Data that stays on your device
Some things never leave the device they are on. Your custom sound is trimmed and stored on that device only and is never uploaded. Display preferences (such as appearance and the breathing guide), sound choices and the reminders your phone queues ahead of time are stored locally by the app or extension. On this website, the currency and sound choices you make are kept in your browser’s local storage. We do not use cookies on this website, and we do not track you across apps or websites.
4. How we use your data, and on what basis
We use personal data only to provide, secure and improve Look20 and to meet our legal duties. We do not use it for advertising or profiling.
Under the GDPR
- Contract: to provide the service you asked for, such as your account, sign-in, sync, reminders, history and Plus.
- Legitimate interests: to keep Look20 secure, prevent abuse (for example, rate limits on sign-in codes), fix problems, and answer support messages. You can object to processing based on legitimate interests.
- Legal obligation: to keep purchase and tax records and respond to lawful requests.
- Consent: where we ask for it. Notification permissions are asked for by your device’s operating system and you can turn them off in its settings.
Under India’s DPDP Act
We process your personal data on the basis of the consent you give when you create an account and use Look20, for the purposes described in this policy, and for legitimate uses the Act allows, such as when you voluntarily provide data for a specific purpose and have not said you do not consent, and to comply with law. You can withdraw your consent at any time by emailing us. Withdrawal does not affect processing that happened before it. Once you withdraw, we stop processing and delete your data unless the law requires us to keep it, and we will no longer be able to provide the synced service.
5. Who processes your data for us
We use a small number of service providers. They process personal data only on our instructions, or, for payment providers acting as merchant of record, under their own privacy policies for the payment itself.
| Provider | What they do | Where |
|---|---|---|
| Convex | Hosts our database and backend: your account, devices, settings and history. | United States |
| ZeptoMail by Zoho | Sends sign-in code emails. Receives your email address and the email it delivers. | Zoho data centres, depending on our account region |
| Dodo Payments | Merchant of record for purchases on the web: takes payment, handles billing, invoices and sales tax. Shares purchase status with us. | See Dodo Payments' privacy policy |
| Apple and Google | Handle in-app purchases and subscriptions in the App Store and Google Play, and deliver notifications through your device’s operating system. | See Apple’s and Google’s privacy policies |
| Cloudflare | Hosts and protects this website. Processes IP addresses and request data to deliver pages and block abuse. | Global network |
We do not sell, rent or share your personal data with anyone for advertising. We may disclose data if the law requires it, to protect the rights, safety or property of our users or Look20, or as part of a merger, acquisition or sale of assets, in which case we will tell you before your data becomes subject to a different privacy policy.
6. International transfers
Our backend is hosted in the United States, so your data is transferred there from wherever you use Look20. When the GDPR applies, we rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses or an adequacy decision. Under the DPDP Act, we transfer data outside India only to countries not restricted by the Government of India.
7. How long we keep it
- Break history: 40 days, then deleted automatically.
- Devices: removed automatically once a device has not connected for 60 days, or when you remove it.
- Account, settings and email address: until you delete your account or ask us to.
- Sign-in codes and code-request counts: deleted automatically within hours.
- Purchase records: as long as tax and accounting law requires.
- Support messages: as long as needed to help you and keep a record of the conversation.
- Service logs: short periods set by our providers.
When you delete your account, we delete your account data within 30 days, except records we must keep by law.
8. Security
Data travels over encrypted connections (HTTPS/TLS). There are no passwords to leak: you sign in with codes that expire within minutes, and code requests are rate-limited. Access to production data is limited to the people who run Look20. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
9. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you, and get a summary of how it is processed;
- correct data that is inaccurate or incomplete;
- delete your account and personal data;
- receive your data in a portable format;
- object to or restrict certain processing;
- withdraw your consent at any time;
- nominate someone to exercise your rights if you die or become unable to (India);
- complain to us, and then to a data protection authority, such as your local supervisory authority in the EU or UK or the Data Protection Board of India.
To use any of these rights, email support@look20.com from the address you sign in with, so we can confirm the account is yours. We respond within 30 days, and it is free.
10. Children
Look20 is not meant for children under 13, or under 16 where local law sets a higher age, and we do not knowingly collect their data. In India, people under 18 may use Look20 only with the verifiable consent of a parent or lawful guardian. If you believe a child has given us personal data without the consent the law requires, email us and we will delete it.
11. Grievance Officer (India)
Grievance Officer, Look20 — support@look20.com. We acknowledge grievances within 48 hours and resolve them within 30 days.
12. Changes to this policy
When we change this policy, we update the date at the top. If a change is significant, we tell you by email or in the app before it takes effect.
13. Contact
Questions or requests about privacy: support@look20.com.