Privacy Policy

Effective date: May 12, 2026

1. Who we are

Timeless Links ("we," "us," "our") publishes the website at timelesslinks.org (the "Site") and the Score sourdough-baking tracker application (the "Score app"), and may publish additional applications and offer physical goods over time (together with the Site and the Score app, the "Services"). This Privacy Policy describes what personal information we collect when you use the Services, how we use it, who it is shared with, and the choices you have about it.

For questions about this policy, contact us at info@timelesslinks.org.

2. Information We Collect

2.1 Information you provide directly

• Account information. When you create an account in the Score app we collect your email address, display name, and, for email/password sign-up, a hashed password. If you use Sign in with Google or Sign in with Apple, we receive the email address and display name those providers return. We also record the timestamp of your account creation and most recent sign-in.
• Bake records. Anything you enter while tracking a bake in the Score app, including ingredient measurements, stage timestamps, free-text notes, water-temperature settings, and final scores or ratings.
• Photos. Photos you upload to track the appearance and rise of your dough. Photos are stored alongside the bake record they belong to.
• Feedback and support correspondence. If you contact us by email or through an in-app feedback link, we receive whatever you include in your message, including your email address.
• Order information (future). If we offer physical goods for sale and you place an order, we (or our commerce processor) will collect the information needed to fulfill that order, such as your shipping address. This will be described more specifically when the offering goes live.

2.2 Information collected automatically

• Photo metadata (EXIF). When you upload a photo to the Score app, we may read embedded EXIF metadata such as the timestamp the photo was taken and, if your camera writes it, GPS coordinates. This metadata is used to pair the photo with contextual data for that bake. We do not request your device location separately.
• Weather data. When a photo's EXIF includes location, we may send an approximate location and the photo's timestamp to Open-Meteo to retrieve historical weather for that point. The returned weather is stored with your bake.
• Usage analytics. We use Google Firebase Analytics to record app-usage events such as screens viewed, feature use, crashes, and errors, along with a Firebase-assigned anonymous identifier and basic device information (OS version, app version, device model, language). This information is used in aggregate to understand how our applications are used and to find bugs.
• Authentication tokens. When you are signed in to the Score app, Firebase Authentication issues your device a session token used to keep you signed in. The token is stored locally on your device.
• Website server logs. When your browser visits timelesslinks.org, our hosting provider (Netlify) receives standard server-log information including your IP address, user agent, and the request path. We do not use advertising cookies on the Site.

2.3 Information we do not collect

• We do not request access to your device's contacts, calendar, microphone, health data, or precise GPS location.
• We do not collect payment card information directly. Any future paid features will be processed through Apple, Google, or our subscription-management provider; we do not see your card details.
• We do not knowingly collect data from children under 13.

3. How We Use Information

• To create your account and keep you signed in.
• To save your bakes and photos across devices and sessions.
• To attach contextual data (such as weather) to your bakes so you can see patterns over time.
• To diagnose bugs and improve the reliability and design of our applications.
• To respond to feedback, support requests, and order inquiries.
• To detect and prevent abuse of the Services.
• To comply with legal obligations.

We do not use your information for advertising, do not sell or rent your information to third parties, and do not allow third parties to use it to advertise their own products to you.

4. Legal Bases for Processing (EEA / UK Users)

If you are in the European Economic Area or the United Kingdom, we process your personal information on the following legal bases:

• Performance of a contract — to provide the Services you signed up for (account, bake storage, sync, order fulfillment).
• Legitimate interests — to keep the Services secure, to improve them through aggregate analytics, and to respond to your messages.
• Consent — for any processing that requires it, such as sending you optional product communications. You may withdraw consent at any time without affecting prior processing.
• Compliance with legal obligations — when we are required to retain or disclose data by law.

5. Service Providers

We use a small number of service providers to operate the Services. These providers process information on our behalf under their own privacy and security commitments:

• Google Firebase (Authentication, Firestore, Cloud Storage, Analytics) — hosts your Score account, your bake data, and your photos, and provides usage analytics. See Google's privacy policy at policies.google.com/privacy.
• Apple Inc. — when you choose Sign in with Apple, and to process App Store purchases. See apple.com/legal/privacy.
• Google LLC — to process Google Play purchases for the Score app.
• Open-Meteo — receives an approximate location and timestamp to return historical weather for a bake. See open-meteo.com/en/terms.
• Netlify, Inc. — hosts timelesslinks.org and sourdough-score.netlify.app, and receives standard server-log information when your browser fetches the Sites.
• Subscription-management provider — if we introduce paid features for the Score app, a subscription-management provider (such as RevenueCat) will receive limited information needed to validate and administer your subscription. This will be disclosed and effective when the feature goes live.
• Generative AI provider — if we introduce AI-driven features, the queries you submit (together with related context) may be sent to a third-party large language model provider for the sole purpose of generating a response. This will be disclosed and effective when the feature goes live.

We may also disclose information when we are required to do so by law, in response to a valid legal process, or to protect the rights, safety, or property of Timeless Links, our users, or others.

6. International Data Transfers

Timeless Links operates from the United States. The service providers above may process your information in the United States and other countries where they operate. By using the Services, you understand that your information may be transferred to and processed in countries whose data-protection laws may differ from those of your country of residence. Where required, we rely on Standard Contractual Clauses or other safeguards published by our processors.

7. How Long We Keep Your Information

• Account information and bake data are kept for as long as your Score account is active.
• You can delete your Score account at any time from the in-app account menu (Header avatar → Delete account). Deletion immediately removes your account record, your bake history, your stage notes, and your uploaded photos from our active systems. Backups are typically purged within 30 days.
• Aggregate analytics that cannot be linked to an individual account may be retained beyond account deletion.
• Order records associated with physical-goods purchases (when offered) are retained for the period required by applicable tax and consumer-protection law.
• If you contact us by email, we retain your message for as long as needed to handle your request and for a reasonable period afterward for our records.

8. Your Rights and Choices

8.1 All users

• Access your bake history at any time inside the Score app.
• Edit or delete individual bakes from the Score app.
• Delete your entire account from the in-app account menu in the Score app.
• Disable notifications in your browser or device settings at any time.

8.2 EEA / UK residents (GDPR)

You also have the right to:

• Request access to the personal data we hold about you;
• Request correction of inaccurate data;
• Request erasure ("right to be forgotten");
• Request restriction of processing;
• Object to processing based on legitimate interests;
• Request data portability (a copy of your data in a portable format);
• Withdraw consent for any processing based on consent;
• Lodge a complaint with your local data-protection authority.

8.3 California residents (CCPA / CPRA)

California residents have the right to know what personal information is collected, used, shared, or sold; the right to delete personal information; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information; and the right not to be discriminated against for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioral advertising.

To exercise any of these rights, contact us at info@timelesslinks.org. We may need to verify your identity before responding. We will respond within the timeframes required by applicable law.

9. Children's Privacy

The Services are not directed to children under 13 (or under 16 in the EEA / UK), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

10. Cookies and Similar Technologies

We do not use advertising cookies on timelesslinks.org or in the Score app. We use the following local-storage technologies to make the Services work:

• localStorage / IndexedDB — to keep you signed in to the Score app between sessions, to support offline use, and to store the timer state for an in-progress bake.
• Service Worker cache — to allow the Score app to load when you are offline.
• Firebase Analytics may set a Firebase-assigned identifier in local storage so that anonymous usage events from the same browser can be grouped.

You can clear these by clearing your browser's site data for the relevant site, or by uninstalling the Score app on a mobile device.

11. Security

We rely on Google Firebase's infrastructure for storage and access control. Authentication uses industry-standard tokens, data in transit is encrypted with TLS, and data at rest is encrypted by our storage provider. Access to user data inside Firebase is restricted by Firestore and Cloud Storage security rules so that you can only read or write your own data. No system is perfectly secure; if we become aware of a security incident affecting your information, we will notify you as required by applicable law.

12. Future Features

We are planning the following features and offerings that will affect data processing once they ship. We will update this policy before any of them go live:

• AI coaching. An optional paid feature in the Score app that will analyze your bake history to provide personalized suggestions. Bake data sent for analysis would be sent only when you ask for it and may be processed by additional service providers.
• Subscriptions and in-app purchases. Paid features in the Score app will be offered through Apple's App Store and Google Play. Apple, Google, and our subscription-management provider will receive limited information needed to administer your subscription.
• Physical goods. If we offer physical goods for sale through timelesslinks.org, we (or a commerce processor) will collect the information necessary to fulfill orders, such as your shipping address. This policy will be updated to describe the specific data flows when the offering launches.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the Effective date above and, where the changes are material, provide additional notice (for example, a banner inside the Score app or an email to your account address) before the changes take effect.

14. Contact Us