Privacy Policy

Last updated: 26 September 2026  ·  Applies to KUMA Timer for macOS, Windows and Raspberry Pi, and to the KUMA Timer website and purchase flow

1. Who we are

KUMA Timer is developed and maintained by Pawel Lygan / PL TECH Ltd, based in the United Kingdom.
Contact: support@kumatimer.app

2. Data we collect

KUMA Timer collects no personal data by default.

If you choose to enable anonymous usage statistics (opt-in, asked once on first launch), the application periodically sends the following information to our server:

• Anonymised device ID — a one-way hash derived from your network adapter address. It cannot be reversed to identify you or your hardware. It is used only to count unique installations.
• Operating system name and version — e.g. "Windows 11" or "macOS 14.5".
• Application version — e.g. "1.7.2".

We do not collect: names, email addresses, IP addresses (not stored), file names, project content, location data, or any other personally identifiable information.

3. How to opt out

Usage statistics are disabled by default. If you previously opted in, you can disable them at any time:

• Open KUMA Timer → Settings → Connections → Privacy
• Uncheck "Share anonymous usage statistics"
• Click Save

No data will be sent after disabling. No account or request is needed.

4. Data storage and retention

Anonymised ping data is stored on a server operated by PL TECH Ltd (hosted in the EU). Aggregated statistics (install counts per OS/version) are retained indefinitely for product improvement purposes. Raw ping records are purged after 90 days. No data is shared with or sold to third parties.

5. Local configuration

KUMA Timer stores a configuration file on your local device (~/.kumatimer_config.json on macOS, %APPDATA%\kumatimer_config.json on Windows). This file contains your timer settings, presets, and CUE list. It never leaves your device unless you copy it manually.

6. Network connections

KUMA Timer may make the following outbound connections:

• Update check — on launch, checks pl-tech.co.uk/kuma/latest.json to notify you of new versions. No personal data is sent.
• Anonymous ping — only if usage statistics are enabled (see §2).
• OSC / CDEther / Limitimer — local network only, to devices you configure. No data leaves your local network.
• Web Controller / Web Mirror — local network HTTP server you start manually. Not accessible from the internet unless you configure your router to forward the port.
• NDI output — local network multicast only (Vizrt NDI protocol). No data sent to the internet.

7. Third-party SDKs

KUMA Timer bundles the NDI® runtime library by Vizrt NDI AB when NDI output is enabled. The NDI library operates on your local network only and does not send data to Vizrt or any third party. NDI® is a registered trademark of Vizrt NDI AB. Powered by NDI® — ndi.video.

8. Purchase and licensing (Full licence)

If you buy a Full licence of KUMA Timer (macOS, Windows or Raspberry Pi), we process the following data purely to deliver and validate your licence:

• Email address — collected by our payment processor (Stripe Payments UK) during checkout, and stored by us only to send you the license code and respond to support queries tied to your purchase.
• Stripe session and payment identifiers — opaque IDs (e.g. cs_…, pi_…). They let us reconcile refunds and disputes. No card data reaches our servers — Stripe handles payment details end-to-end.
• Your licence code — generated at purchase time and tied to your email.
• Hashed hardware ID (SHA-256) — when you activate a code, the app sends a one-way hash of a per-machine identifier (macOS IOPlatformUUID, Windows MachineGuid, or Linux /etc/machine-id). The raw identifier never leaves your device; the hash cannot be reversed. This is how we enforce one-machine-per-code.
• Operating-system string — e.g. "macOS-14.5-arm64", "Windows-11-10.0.22631", or "Linux-6.6.51-aarch64". Used for support only.
• Timestamps — when the code was created, activated, last verified, and deregistered.

Where it lives. Records are held in Google Cloud Firestore (Firebase) in the europe-west1 region. Google acts as our data processor under their EU Standard Contractual Clauses.

How long. For as long as the licence is active, plus 7 years (UK HMRC record-keeping rule for sales). Refunded/revoked codes are kept, but status is marked.

Your rights. Under UK GDPR you can request access, correction, deletion, or a copy of your data. Email support@kumatimer.app with your order email. Note that deleting your record also revokes your licence — the app won't start after that.

9. Optional cloud features

Some KUMA Timer features send data beyond your local network only when you explicitly enable them:

• KUMA Live (cloud relay) — when enabled in Settings, timer state is mirrored to a Firebase Realtime Database session so remote viewers can see it via a shareable link. Session data is deleted 60 minutes after the relay is turned off.
• Update check — covered in §6 above.

10. Website cookies and analytics

The KUMA Timer website (kumatimer.app) always sets these strictly-necessary items, which do not require consent under UK PECR:

• Cloudflare bot management (__cf_bm) — set automatically by our CDN to distinguish humans from bots and protect the site from abuse. Expires after 30 minutes of inactivity.
• Your cookie choice (kuma_cookie_consent in your browser's localStorage) — remembers whether you accepted or declined analytics cookies.

Google Analytics (only with your consent). We use Google Analytics 4 to understand which pages people find useful. If you click Accept analytics, it sets the _ga and _ga_<ID> cookies (expiry up to 2 years) and records pages viewed, how you arrived (e.g. search engine or referring site), approximate location (country/city), device and browser type, and interactions such as clicks and downloads. Google Analytics does not log or store full IP addresses. Google LLC processes this data on our behalf as a data processor; data may be transferred to the USA under Google's Standard Contractual Clauses. Individual-level data is kept for 2 months; only aggregated reports are kept longer. We do not use Google Analytics for advertising, and advertising features are turned off.

If you decline or make no choice, Google Analytics runs in consent mode: it sets no cookies and stores nothing on your device, sending only anonymous, cookieless signals that Google uses to model aggregate statistics. You can change your choice at any time: cookie settings.

We also use Cloudflare Web Analytics, which is cookieless — it does not use any client-side state, persistent identifier or fingerprinting, and sets no cookies. It reports only aggregate metrics (page views, referrers, approximate country, device type). See Cloudflare's Web Analytics privacy page for details.

11. Children's privacy

KUMA Timer is a professional tool not directed at children under 13. We do not knowingly collect any information from children.

12. Changes to this policy

If we make material changes to this policy, we will update the date at the top of this page and note the change in the application changelog. Continued use of KUMA Timer after changes constitutes acceptance of the updated policy.

13. Contact

Questions about this privacy policy? Contact us at support@kumatimer.app.