Privacy Policy

This policy applies to the Pomy website and the Pomy browser extension, including beta versions distributed through the Chrome Web Store and Microsoft Edge Add-ons. Pomy is operated by Surf Creative Solutions Limited in Malta ("Pomy", "we", "us", or "our").

Pomy's purpose is to help users plan work, focus with timers, work with connected task services, review progress, and use an optional on-page productivity companion.

Pomy does not use the webpage companion to collect page text, form-field contents, keystrokes, browsing history, or screenshots. This version of the extension does not include third-party advertising or behavioral advertising SDKs.

We use information only to provide, secure and maintain Pomy's user-facing functionality. This includes:

• authenticating Microsoft work or school accounts using OAuth and PKCE;
• reading and updating Microsoft To Do data when you use Microsoft To Do features;
• connecting to WorkflowMax through Pomy's bridge when you enable WorkflowMax features;
• running timers, notifications, focus sessions, daily planning, progress and timesheet features;
• showing and controlling the optional webpage companion;
• playing optional chimes, generated ambient audio, third-party audio streams, or a custom audio URL selected by you; and
• preventing abuse, troubleshooting failures, and maintaining the security and reliability of Pomy and its connected services.

We do not sell personal information. We do not use personal information for creditworthiness or lending decisions. We do not use data accessed through the extension for unrelated advertising purposes.

Pomy communicates with third-party services only where needed for a feature you use:

Microsoft Entra ID and Microsoft Graph

For Microsoft account authentication and Microsoft To Do access. Microsoft processes information under its own terms and privacy practices.

WorkflowMax and the Pomy WorkflowMax bridge

For WorkflowMax connection, jobs, tasks and user-requested timesheet or job actions. The bridge acts as the intermediary between the extension and WorkflowMax.

Vercel

Pomy may use Vercel-hosted infrastructure for Pomy services, including the WorkflowMax bridge and this privacy page. Vercel may process ordinary service and network logs as an infrastructure provider.

Optional audio providers

When you choose an internet audio stream, Pomy connects directly to the selected stream provider. If you enter a custom audio URL, Pomy connects to the host you specify. Those providers may receive normal network request information such as your IP address.

Microsoft Edge Add-ons

Microsoft operates the extension store and may process store, installation, update, review and diagnostic information independently of Pomy.

We do not broker or sell user data. We do not disclose user data to third parties for their independent advertising or marketing purposes.

Pomy includes an optional webpage companion that can appear on ordinary HTTP and HTTPS webpages. The extension requests broad webpage access so the companion can be displayed and, when necessary, injected into tabs that were already open when Pomy was installed, updated, or re-enabled.

The companion is designed not to inspect the content of the webpage underneath it. It does not read webpage text, form fields, passwords, keystrokes, browsing history, or screenshots. It uses viewport information to position itself and may use the current hostname only to remember a per-site hide preference chosen by you.

Local browser storage

Much of Pomy's working data is stored locally using Microsoft Edge extension storage, including settings, timer state, productivity history, cached task information, provider connection state and authentication/session data required to keep connected features working.

Local information remains on the device until it is replaced, cleared by a Pomy action, removed during sign-out/disconnection where applicable, cleared through browser/extension controls, or removed when the extension is uninstalled, subject to Microsoft Edge behavior.

Connected services

Microsoft To Do data remains governed by your Microsoft account and Microsoft's retention controls. WorkflowMax data remains governed by your WorkflowMax account and its applicable controls. Pomy service-side information is retained only for as long as reasonably necessary to provide the relevant connection, maintain security and reliability, resolve support issues, or meet legal obligations.

• You can choose whether to sign in to Microsoft and whether to connect WorkflowMax.
• You can disconnect supported integrations from Pomy's settings where that option is available.
• You can enable, disable, hide or reposition the webpage companion and clear saved per-site companion preferences.
• You can control notifications and sound features through Pomy and Microsoft Edge settings.
• You can choose whether to use optional focus-summary syncing, timesheet write-back, internet audio streams, or custom audio URLs.
• You can remove Pomy from Microsoft Edge at any time.

Pomy uses Microsoft OAuth Authorization Code Flow with PKCE for Microsoft sign-in and does not embed a Microsoft client secret in the browser extension. Network connections to Microsoft and production Pomy services are intended to use HTTPS. Authentication credentials and tokens are treated as sensitive information and are used only for the services they authorize.

No method of storage or transmission is completely secure, but we use reasonable technical and organizational safeguards appropriate to the nature of the information handled.

Pomy is a workplace and productivity tool and is not directed to children. We do not knowingly design the extension to collect personal information from children for advertising or profiling.

Some service providers used by Pomy may process information in countries outside Malta or the European Economic Area. Where applicable, such processing is subject to the provider's contractual and legal safeguards and applicable data-protection requirements.

Depending on where you live, you may have rights to request access to, correction of, deletion of, restriction of, objection to, or portability of personal information we control, and to withdraw consent where processing is based on consent. You may also have the right to complain to your local data-protection authority.

Some information is controlled directly by Microsoft, WorkflowMax, Microsoft Edge, an audio provider, or another service you choose to use. Requests relating to data controlled by those providers may need to be made directly to them.

We may update this policy as Pomy changes. We will update the effective date above when we make material revisions. The current version published at this URL applies to the current released extension behavior.

For privacy questions or requests concerning Pomy, contact Surf Creative Solutions Limited using the support contact provided on the Pomy listing in Microsoft Edge Add-ons. Until a dedicated Pomy domain or privacy email is published, that support channel is the official contact route for this policy.

The Pomy website uses essential browser storage to remember whether you have made a privacy choice. This is necessary to avoid repeatedly showing the consent prompt and cannot be disabled through the preference controls.

With your consent, the website may also use optional preference storage to remember your light or dark theme and whether extension download links have been unlocked on that browser. Optional preferences are off by default. If you reject or later withdraw preference consent, those saved preferences are removed and the website continues to work.

With your consent, the website may also load Google Analytics to measure how visitors use the site, such as which pages are viewed. Analytics is off by default and only starts after you accept it in the consent prompt. The website does not use advertising cookies, behavioral tracking pixels, or marketing scripts. You can review or change your choice at any time through Cookie settings in the footer. Consent choices are stored locally in your browser and may be cleared through your browser's site-data controls.