SAVE50
Last updated: 28/09/2026
This policy explains what data 20-20-20 Vision (the "App") and this website collect, why, and who we share it with. We've written it to reflect exactly what the App does, not a generic template.
Who we are. 20-20-20 Vision is developed by 20-20-20 Vision LTD, a company registered in England and Wales (company no. 17357658), registered office 66 Paul Street, London EC2A 4NA ("we", "us"). 20-20-20 Vision LTD is the data controller for the processing described in this policy, and is registered with the Information Commissioner's Office under registration number ZC265169. If you have questions about this policy or your data, contact us at help@20-20-20-vision.com.
Free features (timing, breaks, statistics, appearance): none of this ever leaves your computer. Your settings and rest statistics are stored locally on your device and are never transmitted to us or anyone else.
Pro licensing: if you purchase 20-20-20 Vision Pro, the App stores your license key and a device identifier locally, and periodically sends only that key and device identifier to our licensing server to confirm your purchase is still valid. No other data - not your settings, not your usage statistics, not your rest history - is ever included in that check.
Prices and updates: when it starts, and once a day while it is running, the App asks our server for the price of Pro, any offer that is on, and whether a newer version is available. It asks at the same time for the price in your own currency. To choose that price, our server uses the country your connection comes from, which our hosting provider (Vercel) works out from the connection itself, and asks Paddle for that country's price, sending Paddle only a two-letter country code. These requests carry nothing about you or how you use the App, and our server does not store your country or your IP address. The App keeps the last price it received so it can show it offline. This rests on our legitimate interest in showing you the price you will actually be charged, rather than one in a currency you won't be.
No analytics or tracking inside the App. The desktop application itself does not contain any third-party analytics, advertising, or tracking software of any kind.
Our licensing server (hosted on Vercel) issues and checks Pro licence keys. For each licence it holds the key, the email address it was bought with, the payment reference Paddle gave the purchase, and the device identifiers it is activated on, with when each was activated or deactivated. That is what lets it enforce the two-device limit, let you move your licence to a new computer, and send your key again if you lose it. It holds nothing about how you use the App. The email with your key is sent through Resend, our email provider. The server also receives feedback you choose to send from inside the App, which is described in section 4.
When you purchase 20-20-20 Vision Pro, or a Workplaces licence by card, your payment is handled entirely by Paddle (paddle.com), acting as merchant of record. We never see or store your card details. Paddle collects the information necessary to take your payment and account for tax - typically your email address, country, postcode and payment details - and tells us your email address and a payment reference so we can issue your licence. Paddle's handling of that information is governed by their own privacy policy.
Occasionally the App asks whether you're getting on with it. If you answer that you aren't, it offers you a box to say what you'd change. Nothing is sent unless you write something and press Send - the question itself sends nothing either way, and there is no feedback form anywhere on this website.
What's sent: the message you wrote, your email address if you choose to give one, and a small amount of context that makes the message intelligible - the App version, the interface language you're using, how you installed the App, and a random identifier generated on your device. That identifier is not derived from your computer, your licence or you; it exists only so we can rate-limit submissions and stop the endpoint being abused.
What we do with it: your message is emailed to us so we can read it and fix what you've told us about. If you gave an email address, it is used only to reply to you about your message. We do not sell it, share it, add it to a mailing list, or use it to market anything to you. We delete it from our inbox once your issue is resolved, or within 30 days, whichever comes first. Our email provider, Resend, keeps its own copy of each message for 30 days and its backups for 7 more, so every copy is gone within six weeks at most.
Who processes it: the message passes through our server on Vercel and is delivered by Resend (resend.com), our email provider, whose processing is EU-based. Nothing you send is ever published or shown to anyone else.
Why we're allowed to do this: our legitimate interest in understanding and fixing problems people report in our own software, and in replying to someone who has asked us to. You opened the box and pressed Send, so the processing is limited to what you chose to tell us. You can object to it, and ask us to delete what you sent, at help@20-20-20-vision.com.
20-20-20 Vision for Workplaces ("Workplaces") and Enterprise are licensed to an organisation rather than to you, and the data described in this section is separate from everything above. If your employer has deployed the App, your employer is the data controller for these records and we act as their processor under a data processing agreement with them. Ask them for a copy; we will provide one to any organisation that asks.
If you are the person who set up the account, this paragraph is about you, and the roles are the other way round. Everything else in this section describes records an organisation holds about its own staff, where that organisation is the controller and we are its processor. The details you gave us to open the account are not those records: 20-20-20 VISION LTD is the controller for them.
What we hold. Your name, your work email address, the organisation you are buying for, the country it is registered in, and anything you typed into the form. If you go on to buy, the account also holds the billing details you enter yourself: the registered company name and address, and, where you give them, a company registration number and a VAT number. Those are details of a company rather than of you, except the accounts payable address, which may be a person.
Why, and what allows it. To answer you, to set up and run the account, and to invoice you. That is performance of a contract with your organisation, and the steps you asked us to take before entering into one. We do not use any of it for marketing, and we do not sell or share it.
If you ask us for help. A support ticket you raise from the dashboard holds your email address, what you wrote and our replies to it. We are the controller for that, as we are for the rest of your account. What you write may well name people from your organisation's own list, because "this person cannot claim a licence" is the usual shape of a support question; for those names the roles are as they are everywhere else in this section, with your organisation the controller and us its processor. We answer in the dashboard and email you only to say that there is a reply, so that what we say about your people is not left sitting in a mailbox. Tickets are held with the account and deleted with it. We keep no separate support archive.
Screenshots. You can attach images to a ticket, and we can attach them to a reply. A screenshot of your dashboard shows names and machine names plainly, so these are held in the same database as the ticket rather than in any public file store, are served only to your own administrators and to us, and are deleted with the ticket. Please send only what illustrates the question.
How long. An enquiry we never took up, or one that was declined, is deleted within 90 days. An account is kept for as long as it exists, because keeping it is the point of having one; it is deleted, with everything above, within 90 days of your licence ending, and within 7 days if you ask us to close it. You can ask at any time, from the dashboard or by emailing us, and you do not have to give a reason. Closing from the dashboard offers to email you everything we hold first, because closing signs you out and we keep no copy for you afterwards.
Your rights over it. Because we are the controller here, come to us rather than to your organisation: you can ask for a copy, have it corrected, have it deleted, object to what we are doing with it, or ask us to restrict it, at help@20-20-20-vision.com. Section 9 covers those rights in full, including your right to complain to the ICO.
Licence records. So that an organisation can manage the licences it has bought, the administration dashboard holds, for each person on its list: one or more identifiers for them (usually a work email address, and where their machine reports them, their domain account), a label their administrator can edit, whether they currently hold a licence, when it was assigned or unassigned and by which administrator, the machine they most recently used, and a count of how many distinct machines they have used. Administrators at your organisation can see this, because allocating licences is what they are paying for.
A person is on that list for one of two reasons, and it is recorded which: their organisation listed them, or their organisation synced them from a security group. Running the App puts nobody on it. A machine reporting an account the organisation has not listed is told it holds no licence, and we record nothing about it at all - not the account, not the machine, not that the contact happened. Only an administrator adds a person, and only an administrator gives anybody a licence.
If your organisation syncs a security group. An organisation may keep its list in step with one security group it nominates. Where it does, we hold the members of that one group: a display name and account identifiers and, if your organisation turns on manager sync, who each member's manager is. Nothing else. We never read your organisation's wider directory, and we never read any other group. Somebody removed from that group is removed from the list, which means your employer's own offboarding clears our records without anybody having to remember to.
Adherence figures. Where an organisation enables reporting, the App sends one summary per week so the organisation can see how the programme is going overall. That summary is eight numbers and the week they belong to: how many break reminders were shown, how many breaks were completed, how many were snoozed, how long the reminder countdown was running, how long was spent resting, and how long reminders were held back for each of three reasons - nobody at the machine, a call or presentation, or somebody asking for quiet. These are never attributed to a person. Submissions carry no licence, user or device identifier, no time of day, and no application names, so neither your employer nor we can tell whose figures are whose, when in the day anything happened, or what anyone was working on. Each figure is a single total covering a whole week, added into your organisation's running total as it arrives; no record of an individual submission is kept. There is no per-individual view, export or support request that can resolve a figure back to a named person, because the link does not exist to follow.
The three "held back" figures exist because the App deliberately stays quiet when a break would not be wanted, and an organisation reading the other figures should be able to see that rather than mistake it for people ignoring their breaks. Time outside your organisation's working hours is not measured at all.
What is still never sent. Section 1 continues to apply in full. Your settings, custom sounds, rest history and on-device statistics stay on your machine in every version of the App, including Workplaces. No version of 20-20-20 Vision reports on how an individual uses it.
Workstation checks. An organisation can also use 20-20-20 Vision to meet its duties under the Health and Safety (Display Screen Equipment) Regulations 1992. These are off unless we switch them on at the organisation's request. Where your employer uses them, we hold on its behalf: your work email address, site, department, any tags it gives you and who your line manager is; your workstation checks and your answers, each a choice from a list; what needed doing as a result and when it was done; which of its policies you confirmed and which training you completed; and, if you ask for one, the dates of your eye test, whether special glasses for screen work were provided and any payment made. We also record every time somebody opens your record.
Two of those things are health information: if you say you have had discomfort you link to screen work, that you had it and which of four body areas; and your eye-test records. Nothing clinical can be recorded: no description, severity, prescription, result or report, and no free-text answers at all. Your employer's assessor sees your answers. Your line manager sees only whether your check is done. Facilities and IT see your name and what to fix, never anything about your health. No email we send contains health information. Your employer's own privacy notice tells you who does what there.
These records are never joined to anything the App does. Workstation checks are named because the law requires an employer to keep them. Break reminders and adherence figures stay exactly as described above, and no check record is ever linked to them.
How long we keep it. Somebody your organisation listed, or synced from its group, is held until your organisation removes them, and in any case deleted within 90 days of your licence ending. If your organisation closes its account, that is a request to erase and is treated as one: everything we hold about your people is deleted within 7 days, not 90. Workstation-check records are different, because they are evidence that your employer met its duties to you. They are kept while you are on the list, then for the period your employer chooses after you leave (one to six years; three unless it changes it), and then deleted along with the record of who looked at them. They are also deleted when your organisation's licence ends or its account is closed, on the timescales above.
Why we're allowed to do this. Licence records are processed to perform our contract with your organisation. Adherence figures rest on your employer's legitimate interest in knowing whether a health measure it has funded is working - which is precisely why they are unattributable, so that interest is served without monitoring anyone. Workstation checks rest on your employer's legal obligations under the Display Screen Equipment Regulations, and the health information in them on its obligations as your employer (UK GDPR Article 9(2)(b)). Your employer is the controller for all of them, so questions and requests about them go to your employer, and we help it answer them.
Strictly necessary only by default. When you first visit, this website sets no analytics or advertising cookies. We ask for your consent through a cookie banner before any optional cookies are used.
Google Analytics (optional). If you accept, we use Google Analytics 4 (via Google's gtag.js) to understand aggregate visitor traffic - things like which pages are viewed and how people generally find the site. It sets cookies and may process technical data such as your approximate location; GA4 does not log or store your full IP address. We don't use this to identify you personally, and we never combine it with anything from inside the App. Until you accept, Google Analytics stays switched off - we use Google Consent Mode with storage set to "denied".
Changing your mind. You can accept or reject at any time, and withdrawing consent is as easy as giving it - use the Cookie settings link in the footer of any page, or clear this site's cookies in your browser. You can also install the Google Analytics opt-out add-on. See Google's Privacy Policy for how Google handles this data.
Prices in your currency. Pages that show a price load a script from Paddle, which works out from your IP address which country you are probably in and returns the price you would pay there. Paddle receives your IP address to do that, as any website you load a file from does; we don't send it anything else, and we don't receive or keep your IP address or location. Your browser remembers the prices for the rest of your visit, in storage that holds no identifier and is cleared when you close the tab. This rests on our legitimate interest in showing you the price you will actually be charged, rather than one in a currency you won't be.
Beyond Google Analytics, this website uses no other third-party tracking.
Under UK GDPR we process personal data only where we have a lawful basis for it:
Your App settings, custom sounds and rest statistics stay on your device for as long as you keep the App installed - we never receive them, so there is nothing for us to retain or delete. A Pro licence record (key, email address, payment reference and activated devices) is kept for as long as the licence exists, because Pro is bought once and kept, and the record is what lets you reactivate it or have the key sent again years later. A device you deactivate stays in that record as deactivated. If a purchase is refunded, the licence stops working and its record is kept as evidence of the refund. Payment records are held by Paddle as merchant of record under their own retention policy. Google Analytics data is retained by Google in line with our account's retention setting and Google's own limits. Feedback you send from the App is kept until your issue is resolved, or 30 days, whichever comes first - including any email address you gave us for a reply. Our email provider's copy is gone within six weeks at most. A support ticket raised from a Workplaces dashboard is held with that account and deleted with it, on the same clocks as the rest of the account's data; we keep no separate support archive. A Workplaces enquiry we never took up is deleted within 90 days. A Workplaces account, and the billing details in it, are kept while the account exists and deleted within 90 days of the licence ending, or within 7 days of the customer closing it - closing is a request to erase, and we answer it promptly rather than at the outside limit that covers a licence quietly running out. Workplaces licence records are kept for as long as the organisation's licence runs and are deleted within 90 days of it ending; somebody who merely ran the App and was never put on their organisation's list is never recorded in the first place; adherence figures carry no identifier, so there is nothing in them to delete or return to a person. We don't sell your data. We do not sell, rent, or trade your personal information to anyone, and we never share it for third-party advertising. The only data that leaves your device is what's described above: an optional licence-key check with our licensing server, any feedback you deliberately choose to send us, and, if you consent, aggregate Google Analytics. That's it.
If you're in the UK or EU, you have rights under UK/EU data protection law, including the right to access the data we or Paddle hold about you, to have it corrected or deleted, to object to or restrict certain processing, to data portability, and to withdraw consent at any time (for analytics, use the Cookie settings link in the footer). For your licence record, come to us. For payment records, Paddle is the party holding that data as merchant of record - contact them directly, or contact us at help@20-20-20-vision.com and we'll help direct your request.
If you're in the UK and believe we've handled your data improperly, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk - though we'd appreciate the chance to put things right first.
Paddle, Vercel, Resend and Google may process data outside the UK/EEA as part of providing their services. We've configured Resend to process feedback email in its EU region. Each operates under its own compliance framework for international data transfers - see their respective policies for details.
The App and this website are not directed at children, and we don't knowingly collect data from anyone under 16.
We may update this policy from time to time. Material changes will be reflected here with an updated date at the top.
Questions about this policy: help@20-20-20-vision.com