Open World Clock
Support the creator Download

Privacy policy

Last updated: 21 October 2026

Your cities and settings stay on your device, and the clocks work offline. Windows connects for app updates as described below. Android v4 uses Google Play for optional purchases and reviews. The upcoming Android Premium release adds server purchase verification and optional advertising for eligible adults, including Google advertising measurement. These data flows are described below. The iPhone app in development is covered in its own section. This website uses cookieless analytics and respects Do Not Track and Global Privacy Control. Ko-fi loads only when you choose to support the creator.

Open World Clock is a world clock and time zone converter for Windows and Android. The Android app and its widgets are available through Google Play testing with optional Supporter purchases. An iPhone app with widgets is in development. Each platform has its own section below.

Data the Windows app collects

No telemetry and no usage tracking. Your cities and settings never leave your device, and there is no account and no sign-in. The app's only network requests are update checks and, in a code-signed installer, update downloads; the information they carry is listed under Network access.

Data stored on your device

Your choices are saved in a local settings file inside your Windows user profile:

  • The cities you add and their order, and any custom labels you give them.
  • The working hours and workdays you set per city for the meeting planner.
  • Your layout (strip, compact or vertical) and language, plus theme, 12 or 24-hour clock, seconds, opacity, always on top, launch at login, zoom level, the window's position and the size you gave each view, and your update preference.

This file never leaves your device. Uninstalling the Microsoft Store build removes it. Uninstalling the installer build keeps it (in the Open World Clock folder under AppData\Roaming) so your cities survive a reinstall; delete that folder to remove it.

Network access

Time zone rules are built into the app, and sunrise and sunset are calculated on your PC, so clocks, conversions and day and night all work fully offline.

  • Installer and portable builds from this site (not code-signed today): make no network requests unless you choose Check for updates in Settings, or turn on Automatically check for updates (off by default; then once when the app starts and once a day). A check is one HTTPS request for https://openworldclock.com/api/app.json, the site's public app information. The app reads only the version number from the answer and never downloads or installs anything; Open download page opens the page in your browser. The request carries what a request from the app's built-in browser engine carries: your IP address, its user agent (the app's name and version and its Chromium, Electron and Windows versions) and your language preference. It sends no cookies, cities, settings or identifiers, and it goes directly, not through a system proxy (on a network that requires a proxy the check reports that it could not reach the server).
  • A code-signed installer (when a signed release is published): has Automatic updates, on by default and easy to turn off in Settings. When on, it checks the signed release update feed on download.openworldclock.com over HTTPS (not published yet) every 6 hours and downloads a new version in the background; it installs it only when you choose Restart and install, and only an installer signed by the same publisher. When off, it checks and downloads only when you ask. Its update requests also carry a random identifier for this installation, kept in the app's data folder, that the update software uses for staged rollouts, plus your IP address and standard request headers. It sends no cities or settings.
  • Microsoft Store build: makes no requests of its own; the Store handles updates.
  • Settings has Website and Report a problem links. They only open the page in your browser; the app itself sends nothing. The Report a problem link fills in the app version and build (Installer, Portable or Microsoft Store) on the GitHub form, and you see and can change that before anything is sent.
  • Copy times puts the times on the clipboard as text and as a small table. Save calendar invite writes an .ics file only where you pick in the save dialog. Neither sends anything anywhere.

Third parties

The Windows app has no analytics, crash reporting or advertising SDKs. Android uses Google Play Billing and Play In-App Review. The upcoming Android release also includes Google Mobile Ads and User Messaging Platform for advertising and privacy choices. Their use is limited by purchase status, age choice, consent and the advertising switch described below. The website has its own section.

Android app and widgets

Android and iPhone use separate mobile terms. Windows and the website remain MIT licensed. Mobile app terms.

Published version and upcoming release. Android v4, currently published through Google Play testing, checks purchases on the device using Google Play and the public licensing key. It does not send receipts to a developer server. The server verification described below is for the upcoming Premium release and is not active in v4.

The clocks and widgets work offline without an app account. There is no separate app analytics or crash-reporting service; the upcoming advertising SDK has its own measurement and diagnostics described below. Cities and time calculations stay on your phone. The app does not request location permission: it uses your selected reference city or the phone's time zone.

Your cities and their order, custom labels, working hours and workdays, reference city, language, theme and 12 or 24-hour clock are saved in the app's private storage on your phone (the settings file world_clock.xml). Each widget you place keeps its own setup under that widget's id, and you can save up to 12 widget looks. The app opts out of Android backup and device transfer (allowBackup="false", with extraction rules that exclude everything), so none of this is copied to Google or to a new phone. Uninstalling the app removes it all.

Purchases. Google Play handles checkout and payment. The upcoming “Buy me a coffee” offer is a one-time purchase for lifetime Premium; existing monthly and yearly subscriptions remain supported. Play shows the available product and local price. You can restore eligible purchases on Android using the same Google Play account; they do not unlock purchases on another operating system. The app and our verification service do not receive your card number, payment method, billing address, name or email. Google’s privacy policy covers Google’s processing.

Upcoming server verification. To verify, restore or recheck ownership, the app will send the original signed Play receipt and signature over HTTPS to our verification service hosted on Cloudflare. The receipt contains the order number, product identifier, purchase time and purchase token. Our service checks the signature and asks Google’s Android Publisher API to verify the token and current purchase status. Google handles payment. Google also sends authenticated purchase and refund notifications so the service can recheck access.

What the service retains. Cloudflare D1 stores only a one-way hash of the purchase token, product identifier, entitlement and acknowledgement status, and verification or expiry timestamps. The hash is pseudonymous purchase data, not anonymous usage analytics. We do not persist raw receipts, raw purchase tokens, order numbers or payment details on the server. The raw signed receipt remains in private app storage on your device; sending it for verification does not create a stored server copy. Billing records, including refund records, are retained to restore access and prevent refunded purchases from being restored. Uninstalling removes local data, not those server records; contact us about data requests.

The HTTPS connection exposes your IP address and standard request headers to Cloudflare. The service uses an ephemeral IP hash to limit abusive requests. Application logs contain only the route category, HTTP status and request duration, without receipts, tokens, IP addresses or payment details. This processing verifies purchases and protects the service; it is not app analytics. Cloudflare’s privacy policy describes its processing.

Offline access and refunds. Previously verified lifetime access remains available offline. Legacy subscriptions require a successful verification within 24 hours and, when known, cannot continue beyond Google’s expiry time. A confirmed refund or expiry can remove Premium access. A failed network check does not create new access or immediately erase previously verified access. Saved cities and widget configurations remain on the device.

Upcoming advertising release. Android v4 has no ads. In the upcoming release, a labelled banner may appear on the Clocks screen for free users who choose the adult age band and meet the consent requirements. Premium users, users under 18 and users whose age is unknown are ad-free. Widgets contain no ads. We store only the chosen age band on the device, not a birth date. Ads remain disabled until the release is approved and the server advertising switch is enabled. Requests use non-personalized advertising, which can still involve data collection and consent.

Advertising data. When advertising is active for an eligible user, Google Mobile Ads collects and shares the IP address (which can indicate approximate location), ad and app interactions, performance diagnostics, and device or account identifiers for advertising, measurement and fraud prevention. The Android advertising ID permission and Privacy Sandbox ad permissions are removed; advertising ID access can differ on older Android versions, and other identifiers such as app set ID may still be processed. Publisher first-party ID is disabled. Transport uses encryption. We do not send selected cities, clock settings or purchase receipts to the advertising service. See Google's SDK data disclosure and privacy policy for its processing and retention.

Your advertising choices. Google User Messaging Platform presents applicable privacy messages before eligible ad requests. Required privacy options are available in Settings so you can change or withdraw previous choices, including after buying Premium. Choosing an under-18 or unknown age band prevents new advertising requests. Premium removes advertising but does not itself erase data previously received by Google. The app does not initialize advertising for known Premium, under-18 or unknown-age users on a fresh launch. A failed purchase-status, consent or server-policy check keeps ads off; previously initialized SDK behavior and data retention remain subject to Google's policy.

Store reviewers can enter a reusable review code to access the paid features without an account, payment or trial. The code is checked on the device and stored privately until review access ends or the app is uninstalled. It is separate from purchase receipts. Review access does not change the app's content or data handling.

The app may request Google's in-app review card after a week of use, at most once every six months. Usage counters used to pace that prompt stay on the device. Google handles any rating and review you choose to submit under its own terms; you can manage or delete them through Google Play or your Google Account.

iPhone app and widgets (in development)

The iPhone app and its widgets make no network requests. There is no account, no analytics and no ads, and the app does not ask for location permission: your home city comes from the iPhone's own time zone setting.

Your cities and their order, custom names, working hours, 12 or 24-hour clock, seconds, theme, language and the temporary +1 h shift you set from a widget are saved on your iPhone, in storage shared only between the app and its own widgets (the App Group group.io.joao.worldclock.shared). This data never leaves your iPhone. Deleting the app deletes it.

This website

Everything above is about the apps; this section is only about the website.

This website (not the apps) uses PostHog analytics to count visits and learn which parts of the page are useful. It is set up to be anonymous:

  • No cookies and no analytics identifiers in your browser's storage. PostHog counts visitors with a one-way hash it computes on its servers from your IP address, browser user agent, this site's name and a random value that changes every day and is then deleted, so a visit cannot be linked to you or to your visits on other days.
  • Through our own domain. Your browser only talks to this site. We forward the analytics requests to PostHog and strip any cookies on the way. PostHog uses your IP address for that hash and a rough country, and our PostHog project is set to discard IP addresses instead of storing them (a PostHog project setting, "Discard client IP data").
  • What is recorded: the pages you view and their language (English, Portuguese or Spanish), how far you scroll, which sections come into view, and clicks on a few controls (the download buttons, the converter demo, FAQ questions, the theme button, the language picker, links to GitHub and Support the creator). Never what you type, no session recordings, no time zone, and web addresses are trimmed to the page itself, apart from any utm_ campaign tags in the link you followed.
  • Do Not Track and Global Privacy Control: if your browser sends either signal, the analytics script does not load at all.

Ko-fi. The Support the creator button and links are for tips through Ko-fi. Nothing from Ko-fi loads when you view the page: no script, frame or cookie. Only if you click one of them does your browser load Ko-fi's panel (or open ko-fi.com), and from then on Ko-fi's privacy policy applies to what you do there. We only count that the button was clicked, as described above.

The web app. The web app runs on the home page and the converter, planner, map and city comparison pages. It is the Windows app running in your browser. Your cities and settings are kept in your browser's local storage and never sent anywhere; clearing this site's data in your browser removes them. The app loads no analytics of its own. The surrounding page counts the visit as described above, and which parts of the app you try (adding a city, the converter, the planner, the map, settings, Share and so on), once each. Nothing you type or choose is recorded: no cities, times or settings. A link made with Share carries its cities and time after the # sign, a part of the address that browsers never send to a server, and the analytics drop it too.

Nothing else is loaded from other servers. The live demo reads your time zone inside your browser and never sends it anywhere. If you pick a light or dark theme, or a language, that choice is kept in your browser's local storage.

Contact

Questions about this policy: support@openworldclock.com

Back to Open World Clock