Privacy policy

Last updated 3 October 2026. This covers the Soapbox app for iPhone and iPad, the web display at soapboxtimer.app/display and this website.

The short version

• Soapbox has no accounts, no ads, no analytics and no tracking.
• Soapbox doesn't collect personal data: what you send is used only to run your session and is deleted with it. Nothing is sold or shared.
• A timer session holds only what it needs to run, and is deleted after 12 hours without use, or straight away when you get a new code on the display.

What a session holds

When you open the display, Soapbox creates a session on our server, which runs on Cloudflare. The session holds:

• the 6-digit code and a random key that only the display keeps;
• the clock: its length, time left, and whether it is running;
• the topic, notes and messages you send, and the profile settings in use (colours, timings, quick messages, clock face);
• the name of each paired phone, as iOS reports it (on current iOS versions this is usually just “iPhone”), so the display can show who is connected.

Anyone with the code can see and change the session, which is how you share control with a colleague. Get a new code on the display to end the session and disconnect everyone.

The session is deleted after 12 hours without use, or as soon as you get a new code on the display. There are no backups of it.

On your devices

• The web display keeps the session's code, its key and the last clock state in your browser's storage, so a reload picks up where it left off. It also stores its own files for offline reloads. Clear the site's data in your browser to remove them.
• The iPhone app keeps your profiles and the last session's code on the phone. Deleting the app removes them.

Permissions the app asks for

• Camera: only to scan the QR code on the display to pair. Images are not saved or sent anywhere.
• Local Network: only to find and connect to the iPad display on your Wi-Fi or hotspot when there is no internet (local mode). In local mode the clock never leaves your network.

Our server and Cloudflare

The server and this website run on Cloudflare, which handles every request as part of delivering it. To stop people guessing codes, the server counts requests from each IP address for one minute, in memory only, and does not store them. Cloudflare keeps short-lived operational logs that we use only to fix problems. We don't combine them with anything else or use them to identify you.

This website

This site sets no cookies and loads nothing from other companies: no analytics, fonts or ads. The live demo runs entirely in your browser and sends nothing.

Children

Soapbox is a general tool for running events and does not knowingly collect information from anyone, including children.

Changes

If this policy changes, the new version will be posted on this page with a new date.

Contact

Questions about privacy: info@soapboxtimer.app.