How we protect your data

Who runs PV0T

PV0T OÜ, a private limited company registered in Estonia, in the European Union (registry code 17468061, VAT EE102970834), Järvevana tee 9, 11314 Tallinn. Questions about anything on this page: contact@pv0t.com.

Our promises

• Your data is yours. We never sell it or use it for advertising.
• We collect what PV0T needs to work, and nothing to track you across the web.
• You can export everything or delete your account at any time, from your account settings.
• Your time and distraction data is for you: in a shared workspace, everyone still sees their own time and distractions.

Where your data lives

Your account and everything you create in PV0T is stored by Supabase in Frankfurt, Germany, and the app’s servers run in Frankfurt too. Error reports go to Sentry’s EU region in Germany. Some services that only run when you use them (for example Google sign-in or the FLCRUM assistant) may process data outside the EU, with the safeguards described in Section 8 of our Privacy Policy.

How we keep it safe

• Every connection to PV0T is encrypted (HTTPS).
• The database enforces who can read what, row by row, so you only ever see your own data and the workspaces you belong to, within your role there.
• Two-factor sign-in is available, with one-time recovery codes that we store only as one-way hashes.
• Passwords are handled by Supabase’s authentication service, never stored in plain text.
• Access tokens for Todoist and Toggl are encrypted (AES-256-GCM) before they’re stored.
• Card payments are handled entirely by Polar; your card details never reach our servers.
• Sign-in and other sensitive actions are rate-limited to stop abuse, and your account settings list every device signed in to your account, so you can spot and sign out anything you don’t recognize.

Found a vulnerability? Please follow our responsible disclosure policy.

Privacy and the GDPR

• PV0T OÜ is the data controller for your account data, under the EU’s General Data Protection Regulation.
• For shared workspaces and organizations, our Data Processing Addendum applies.
• Analytics cookies run only if you accept them; consent is recorded with iubenda, and you can change it any time.
• Your rights, and how to use them: Your privacy rights.

AI (FLCRUM)

When you send FLCRUM a message, it goes through OpenRouter to an AI model with data collection turned off for that request, so it isn’t used to train models. It receives only what it needs to answer. Details in Section 5 of the Privacy Policy.

Desktop app and browser extension

Both can tell PV0T which app or site pulled you away during a timer, and only then. They read the app’s name and the site’s domain (like youtube.com), never full addresses, page titles, or content, and that stays on your device unless you choose it as the reason for a distraction. The browser extension makes no network requests of its own. Downloads: pv0t.com/download.

Reliability

See whether everything is running right now on our status page.

Who helps us run PV0T

These companies process data on our behalf, only to provide PV0T: