Last updated 25 July 2026
The short version: your session notes never leave your device and I have no way to read them. Page views and installs are counted, anonymously, so I can see whether the tool is being used at all. Anything beyond that is off unless you turn it on. If you join the mailing list, your address goes to the company that runs the list. That is the whole of it and the detail is below.
EMDR Timer is built and run by Dr P, a practising counselling psychologist and EMDR practitioner in the United Kingdom, who is the data controller for the purposes of UK GDPR. Contact: richard@therapyonthehill.com, which reaches me directly.
On my full details. I have not published my full name and address on this page. I am one clinician working alone rather than a company with business premises and the only address I could publish is a private one.
That is a deliberate choice rather than an oversight. It does not limit anything you are entitled to. If you need my full identifying details, for your own records, an information rights request or a complaint, email the address above and I will give them to you. I will answer within a month, as the law requires.
Bear in mind that the app gives me almost nothing to hold: your session notes never reach me, so the only personal data I could possibly have about you is a mailing list address, if you chose to give one.
Everything you type into the app (session labels, notes, tags, SUD and VoC ratings, timings) is encrypted in your browser with a key derived from your PIN and stored only in that browser's storage on that device.
It is never transmitted. There is no server holding it, no account it belongs to and no backup of it anywhere but your own device. I cannot read it, cannot recover it and have nothing to disclose if somebody asks me for it.
The practical consequences are worth being blunt about:
Because your clients' information may end up in those notes, you remain the data controller for it under your own professional and record-keeping obligations. Keeping identifying details out of labels and notes is sensible practice.
There are two separate things here and the difference matters.
Three things are counted without asking you: visits to each page, that the app was opened (and whether it was running from a home screen icon or in a browser tab) and that the app was added to a home screen. Together they tell me whether the tool is being used at all, which is the difference between building the next thing and abandoning it.
This uses Vercel Web Analytics, which sets no cookies and, as it ships, writes nothing to your device: no cookie, no local storage, nothing read back. There is no persistent identifier, so these counts cannot be linked to you or joined up across days.
Because nothing is stored on or read from your device, this is not the kind of processing that requires consent under PECR. The lawful basis is legitimate interests: knowing whether a free tool is being used at all, balanced against processing that identifies nobody.
The app can also report a few coarse milestones about how often it has been used. This is off by default. It is only ever on because you were asked and said yes. You can change your mind in Settings at any time.
It is opt-in because reporting each milestone once means recording on your device which ones have already been sent and storing information on your device for an analytics purpose does need your consent.
| What is sent | When |
|---|---|
| How many sessions this device has completed, in bands: 1, 2, 3, 5, 10, 25, 50, 100 | Once per band, ever |
| How many weeks since first use, in bands: 2, 4, 8, 12, 26, 52 | Once per band, ever |
Nothing from inside a session is ever measured. No labels, notes, tags, ratings, durations, times or set counts within a session. The bands exist so that even the counts cannot become a fingerprint: the figure sent is "10", never "eleven sessions on a Tuesday".
The bands are why turning it on is a small thing to agree to. Even with consent given, the most anyone could learn is that some device somewhere reached ten sessions.
If you enter your email address in the sign-up form, it is passed to Buttondown, which runs the list and you will be sent a confirmation email. You are only subscribed if you confirm.
Your IP address is used momentarily when you submit the form, to stop the same address flooding it. It is held in memory only and is never written down or stored.
The site and the app are hosted by Vercel, which keeps standard server logs including IP addresses, for security and to keep the service running. This is the ordinary technical record any website keeps and the lawful basis is legitimate interests.
Neither the site nor the app sets any cookies, so there is no cookie banner to click through. The app stores your encrypted sessions and your settings in your own browser, which is what makes it work offline and is not used to track you.
| Who | What they process | Where |
|---|---|---|
| Vercel | Hosting, server logs, the anonymous usage counts | United States |
| Buttondown | Mailing list addresses | United States |
| Resend | The sign-up notification email | United States |
These are the only three. Your data is not sold and it is not shared with anyone for advertising. Because all three are in the United States, personal data handled by them is transferred outside the UK under the safeguards in their own data processing terms.
Under UK GDPR you can ask for a copy of the personal data I hold about you, ask for it to be corrected or deleted, object to it being processed or ask for it in a portable form. In practice the only personal data I hold is a mailing list address, so most requests come down to unsubscribing, which you can do yourself at any time.
Email richard@therapyonthehill.com and I will respond within a month. If you are unhappy with how I have handled it, you can complain to the Information Commissioner's Office.
If this policy changes in a way that affects you, the date at the top changes and, where it matters, I will say so on the mailing list. Previous versions are visible in the public source repository.