Privacy notice

Effective September 13, 2026 · Version 2026-09-13-v2

Scope

This notice explains how Time Machine Spa handles information collected through this website and its secure service portal. It applies when you browse the public site, create or use a portal account, submit a service request, communicate with us, or arrange service or shipping.

Information we collect

Account and contact information. When you sign in or make a request, we collect your email address and the contact details you provide, such as your name, phone number, and, when needed for a return shipment, mailing address.

Service and watch information. We collect the watch details, requested services, reported issues, supplied-parts information, and other information you include in a request. We also keep service records such as quotes, approvals, payment status, shipment and tracking details, and order activity.

Messages and files. The portal stores messages exchanged about an order and files you or staff share for that order, including photos and PDFs. Staff may also record internal operational notes; those notes are not shown to customers.

Technical and account activity information. We receive information needed to operate and secure the portal, including sign-in and session information, account and order activity, and service logs. The public site does not currently include a public analytics service in this codebase; if that changes, this notice will be updated.

How we use information

We use information to review service requests, create and maintain accounts and order records, prepare and manage quotes, communicate about your watch, coordinate inbound and return shipping, record offline payment status, respond to support requests, and protect the site and portal from misuse. We do not sell personal information.

Service providers and disclosures

We use Supabase to provide portal authentication, database services, realtime updates, and private file storage. We use Cloudflare Workers to host and operate the application. These providers process information only as needed to provide their services to us.

When application email notifications are configured, we use Resend to deliver them. Email notifications may include information needed to identify the related request or order; notification preferences can be managed in the portal where available.

We may disclose information when reasonably necessary to comply with law, respond to a valid legal process, protect people or our service, or address fraud, security, or technical problems. We may also share information with a shipping carrier when required to send a watch to the return address you provide. We do not disclose personal information to unrelated third parties for their own marketing.

Sign-in, cookies, and local drafts

The portal uses authentication cookies or similar browser storage to maintain a signed-in session. These are needed for portal access and cannot be used to serve you a personalized service portal without identifying your session.

To make an unfinished request easier to resume, the request form can save an intake draft in your browser's local storage for up to 24 hours. For signed-in customers, the draft is scoped to that account. You can clear browser storage to remove a local draft; removing it does not remove a request that has already been submitted.

Access and security

Portal records are designed to be available to the customer connected with the order and authorized administrators. Private files are not intended to be publicly listed or shared. We use access controls and service-provider safeguards intended to protect information, but no internet-based system can guarantee absolute security. Please use the portal and contact channels carefully and do not send information you do not want included in your service record.

Retention

We retain account and order information for as long as reasonably needed to provide service, maintain records, resolve questions, and meet legal or financial obligations. Closed orders may be reversibly archived after 12 months and flagged for manual retention review two years after their terminal date. Archiving does not delete records, files, or account access. Permanent deletion is evaluated case by case and may require retaining some information for legitimate operational, legal, or financial reasons.

Your choices and requests

You may use the portal to review information connected with your account and orders. You can manage available email-notification preferences there. To request an export, correction, or deletion review, contact us through the published contact channels. We may need to verify your request and may not be able to fulfill it completely where records must be retained for the reasons described above.

Children's privacy

The website and portal are not directed to children. Please do not submit personal information for a child through the portal without a parent or guardian handling the request.

Changes and contact

We may update this notice as our practices or the service change. We will post the updated version and effective date here. For questions about this notice or how information is handled, use the contact page.