1. Security principle
Pomy starts from a simple principle: a focus tool should not become surveillance. The product is designed to handle only the information needed for the features a person chooses to use.
2. Authentication and connected services
Pomy uses Microsoft OAuth Authorization Code Flow with PKCE for Microsoft sign-in. A Microsoft client secret is not embedded in the browser extension.
Microsoft Graph access uses delegated permissions. WorkflowMax credentials are handled away from normal browser code through Pomy's bridge. Authentication credentials and tokens are treated as sensitive and used only for the services they authorize.
3. Network protection
Connections to Microsoft and production Pomy services are intended to use HTTPS. Connected providers also apply their own security controls and terms to information they process.
4. Local information
Settings, timer state, productivity history, cached task information, provider connection state and required session information may be stored using browser-extension storage. People can clear information through available Pomy actions, browser controls, sign-out or disconnection, and by uninstalling the extension, subject to browser behaviour.
5. No-surveillance boundaries
The webpage companion is designed not to inspect the content underneath it. Pomy is not designed to collect:
- screenshots;
- keystrokes or form-field contents;
- browsing history;
- attendance information;
- productivity scores; or
- utilisation rankings.
6. User control
Integration, appearance, rhythm, behaviour, sound, alert and companion controls remain visible to the person using Pomy. Pomy does not automatically report activity. WorkflowMax duration information is sent only after the person explicitly chooses to record it.
7. Reliability and limitations
Integration failures can be retried, and product packages are validated as part of release handling. No storage or transmission method can be guaranteed completely secure.
We use reasonable technical and organisational safeguards appropriate to the information handled. Pomy does not currently claim a formal security certification.
8. Security questions and reporting
For security questions or to report a suspected issue, contact support@getpomy.com. Please avoid including passwords, access tokens or unnecessary personal information in a report.