Your data stays on your device.

1. Overview

Desk Wellness Pack is a Chrome extension built to help you take regular stretch breaks and stay hydrated during your workday. It includes two modules: Smart Stretch and Water Reminder.

This policy explains what data the extension collects, where it is stored, and how it is used. The short version: almost everything stays on your device, we do not track you, and we do not sell your data.

2. What data is collected and where it is stored

2.1 Data stored only on your device

The following data never leaves your device and is never sent to any server:

• Stretch timer state — your selected interval, start time, current session type
• Stretch behaviour history — a rolling log of the last 50 stretch completions, snoozes and skips, used to adapt the session type
• Weekly stretch statistics — completed, snoozed and skipped counts for the current and previous week
• Hourly patterns — aggregated stretch behaviour by hour of day, used for smart session selection
• Water timer state — your selected reminder interval, last start time
• Water daily progress — number of glasses logged today, today's date key, your daily goal
• Sound preferences — whether sound is enabled for stretch and water reminders
• Smart Stretch mode — whether adaptive session selection is enabled
• Calendar integration preferences — whether calendar checking is enabled for stretch and/or water reminders
• Pending payment session IDs — temporary Stripe session identifiers stored during checkout, cleared after verification

2.2 Data synced across your devices

The following data is synced via Chrome's built-in sync system, which means it follows you when you are signed into Chrome on another device. This data is subject to Google's Chrome sync privacy policy.

• Installation ID — a randomly generated UUID created on first install, used to identify your license
• Stretch Pro license token — an HMAC-SHA256 token issued after payment, used to verify your Pro status without storing payment details
• Water Pro license token — a separate HMAC-SHA256 token issued after Water Pro payment
• License verification timestamps — the last time each license was verified against the server

3. Google Calendar integration Pro feature

If you enable Skip during meetings (available in both Stretch Pro and Water Pro), the extension requests read-only access to your Google Calendar via OAuth 2.0.

What the extension checks

At the moment a stretch or water reminder is due, the extension calls the Google Calendar FreeBusy API to determine whether you are currently busy. It sends only a time window (the current time and 90 minutes forward) and receives only a binary busy/free signal.

What the extension does NOT access

Event titles, event descriptions, attendee lists, location, meeting links, recurring event details, or any other calendar content. The extension has no ability to read, modify or delete calendar events.

Token storage

The OAuth token is managed entirely by Chrome's identity API and stored by Chrome — not by the extension. The extension never stores, logs or transmits your Google access token.

Revoking access

You can revoke calendar access at any time by going to Google Account → Security → Third-party apps with account access and removing Desk Wellness Pack. You can also simply turn off the Skip during meetings toggle in the extension popup.

4. Payment processing

Pro upgrades are processed by Stripe. When you click Upgrade, you are directed to a Stripe-hosted checkout page. The extension itself never handles, sees or stores your payment card details.

After a successful payment, Stripe notifies our backend server hosted on Vercel. The server issues a license token (an HMAC-SHA256 hash of your installation ID) and stores nothing else. No name, email, card number or transaction history is stored by the extension or its backend.

The only information our backend receives

• Your installation ID (a random UUID, not linked to your identity)
• The Stripe session ID (to verify the payment status)

5. Backend server

The extension communicates with a serverless backend hosted on Vercel (desk-wellness-pack.vercel.app) for three purposes only:

1. Creating a Stripe checkout session when you click Upgrade
2. Verifying a payment and issuing a license token
3. Re-verifying a stored license token (at most once every 24 hours, and only if the locally cached verification has expired)

6. Permissions used

The extension requests the following Chrome permissions:

Host permissions

7. Data sharing

We do not sell, rent, share or transfer your data to any third party, with the following limited exceptions:

• Google — when calendar integration is enabled, a FreeBusy request is sent to Google's Calendar API. This is subject to Google's Privacy Policy.
• Stripe — when you initiate a payment, you interact directly with Stripe's checkout. This is subject to Stripe's Privacy Policy.
• Vercel — the backend is hosted on Vercel's infrastructure. Vercel may log platform-level metadata (IP addresses, request timestamps) per their own privacy policy.

8. Data retention and deletion

All data stored locally on your device is automatically removed when you uninstall the extension from Chrome.

Data stored in Chrome sync storage is removed when you uninstall the extension, or you can clear it manually via Chrome's sync settings.

Our backend server does not store any personal data, so there is nothing to delete on our end.

Clear your license manually

If you wish to clear your license and start fresh without uninstalling, you can run the following in the Chrome extension DevTools console (open via chrome://extensions → Service worker → Console):

9. Children's privacy

This extension is not directed at children under the age of 13 and does not knowingly collect data from children.

10. Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date at the top. Continued use of the extension after changes are posted constitutes acceptance of the updated policy.

11. Contact

If you have any questions about this privacy policy, feel free to reach out.