Privacy Policy

Last updated: 2 September 2026

Who we are

Tabatizer (tabatizer.com) is a workout timer app operated by Golf Consult AS (org. no. 922 561 095), a company registered in Norway. Golf Consult AS is the data controller for the personal data described in this policy. For any privacy question or request, contact us at support@tabatizer.com.

The short version

Without an account, your data stays on your device. With an account, we store the minimum needed to sync your workouts across devices: your email address, your app settings, and your workout history. If you share a workout, that workout and your username become visible to anyone who has the link. The app shows no ads and we do not sell data. Analytics and ad-measurement cookies are used only if you say yes to them — declining changes nothing about how the app works.

Data we process without an account

Everything the app needs — your equipment and exercise selections, interval settings, and local workout history — is stored only in your browser's local storage on your own device. It never reaches our servers. Standard technical logs (such as IP addresses in web-server logs) are kept briefly by our hosting provider for security and operations.

Data we process with an account

• Email address — used to sign you in with one-time codes and to deliver service messages.
• Username — a display name you choose yourself, shown publicly on workouts you share.
• App settings — a copy of your equipment, exercise, and interval preferences, so a new device can restore them.
• Workout history — date, workout format, duration, result, and the exercises of completed sessions (Premium sync).
• Saved workouts — the sessions you choose to save (Premium).

We process this data to provide the service you signed up for (GDPR Art. 6(1)(b)) and to keep the service secure (Art. 6(1)(f)).

Shared workouts

Premium users can share a workout as a link (tabatizer.com/w/…). Creating a link publishes a copy of that workout — its name, format, settings, exercises, and your username — in a public record that anyone with the link can view, without signing in. Share links are not listed or searchable anywhere, but treat them as public: you cannot control who a link is forwarded to. Shared workouts are kept until deleted; to have a share link removed, email support@tabatizer.com. Deleting your account also deletes the workouts you have shared.

Payments

Purchases are handled by Paddle, our merchant of record, on their checkout pages. We never see or store card details. We receive only what is needed to activate your purchase: your subscription plan and its status. Paddle's own privacy policy applies to the payment itself.

Where your data lives

Account data is stored with Supabase in the European Union. Our sub-processors are: Supabase (database and authentication), Vercel (hosting), Resend (email delivery of sign-in codes), and Paddle (payments). If you consent to the optional cookies above, Google and Meta also receive the usage data described in that section. Exercise demonstration images are fetched through our own server, so your device does not talk to the image provider directly.

How long we keep it

Account data is kept for as long as your account exists. Delete your account by emailing support@tabatizer.com and we will remove your account and all associated data within 30 days. Local data on your device is yours — clear it any time via your browser or by removing the app.

Your rights

Under the GDPR you can request access to, correction of, deletion of, or a portable copy of your data, and you can object to or restrict processing. Contact us and we will respond within 30 days. You can also complain to your data protection authority — in Norway, Datatilsynet.

Cookies and analytics

The app itself uses your browser's local storage for its own settings and, if you sign in, for your session token. That is strictly necessary, sets no tracking cookies, and never leaves your device except as described above.

Beyond that, we ask before setting anything. On your first visit a banner offers two optional categories, and nothing in them loads until you consent (GDPR Art. 6(1)(a)):

• Analytics — Google Analytics 4 (Google Ireland Ltd), so we can see how the app is used: which features are opened, where sessions are abandoned, roughly where visitors come from. For visitors who consent, Google Signals may add aggregated demographics and interest data (such as age group and gender) from Google accounts that are signed in with ad personalisation enabled; you can review and delete this in your Google account's My Activity.
• Ad measurement — Google Ads conversion tracking (Google Ireland Ltd) and the Meta Pixel (Meta Platforms Ireland Ltd), so we can tell whether our own ads on Google and Meta led you here. We advertise Tabatizer elsewhere; the app itself never shows ads.

Google and Meta may transfer this data to the United States under the EU–U.S. Data Privacy Framework. You can change or withdraw your choice at any time via the Cookies link at the bottom of the app's home screen — withdrawing is as easy as accepting was.

Children

Tabatizer is not directed at children under 13, and we do not knowingly collect data about them.

Changes

If this policy changes materially, we will note it here with a new date. Continued use after a change means the updated policy applies.