Privacy

The clock

A clock on firmware 1.2.0 or later asks clock.bh for its pictures: a few times a day on battery, more often on USB power. With those requests it sends:

• Its Clock ID. Sixteen characters worked out from the board's chip. It stays the same when the clock is reset or reinstalled, and it says nothing about who you are.
• A key the clock makes once and keeps. We store only a fingerprint of it, to tell your clock from another board that claims the same ID.
• Its status: firmware version; battery level and voltage; whether it is on USB power; Wi-Fi signal strength; the face, city and dark-or-light choice; how long since it started and why it last restarted; a few settings (four greys, faces changing by themselves, updates); how many photos it holds, not the photos; how long since it last set its time; free memory; and the room temperature from its sensor.

We use this to send the right pictures for your city, and to notice a failing battery, a crash, weak Wi-Fi or a bad update before you have to tell us.

The clock never sends your Wi-Fi network's name or password, the password of the clock's own page, your photos, or your location beyond the city you chose.

What we keep: one record per Clock ID (when it was first and last seen, its last status and the key's fingerprint), its visits with their status for 90 days, and the days it was active and notable events (first seen, firmware or city changed, battery low, a crash) for 400 days. We do not keep your IP address with any of this, only a scrambled code for the block of addresses it came from: enough to see that a clock moved to another network, not which one.

Clocks on firmware 1.0 or 1.1 send none of this. We estimate how many there are each day from scrambled codes that are deleted at the end of the day; only the daily count is kept.

The clock also asks our time server for the time, unless you set another one, and when updates are on it checks clock.bh for new firmware.

Your photos

Photos go from your browser straight to the clock, over the USB cable or over your home Wi-Fi to the clock's own page. They never pass through clock.bh.

The studio (e.clock.bh)

The studio runs in your browser and writes the firmware and the settings to the clock over USB. Your Wi-Fi password and the clock page's password go only to the clock: they are never sent to us and never saved in your browser.

So you do not have to start over, the studio keeps a few things in your browser: your settings without the passwords, Basic or Advanced, the step you are on (until you close the tab) and light or dark mode. Clearing this site's data in your browser removes them.

To show the faces, the studio asks clock.bh for pictures of them for the city you chose.

The clock.bh app

The app for iPhone and Android has no account and no sign-in. It collects nothing about you, and it has no ads, no analytics and no crash reporting.

To set up a clock, the app reads the code on the clock's screen with the camera (nothing is recorded or saved), then joins the clock's own Wi-Fi for a moment. It sends the clock its name, its place, your home Wi-Fi's name and password, and a password for the clock's page. These go only to the clock, over the clock's own network. They never reach clock.bh.

After that, the app talks straight to the clock on your home Wi-Fi to change its face and settings. When you update a clock, the clock itself fetches the firmware from clock.bh, as described above.

On your phone, the app keeps the clocks you added: their names, addresses on your network, Clock IDs, places and last status. Each clock's password is kept in the phone's secure storage (the iPhone Keychain, or Android's Keystore). Forgetting a clock in the app deletes both.

On the Internet, the app asks only clock.bh, and only for public things: the lists of faces and places, and pictures of the faces for the place you chose. These requests carry no Clock ID, no name and nothing from your clock. Like every request to this website, they appear in our web server's logs for a few days (see below).

The waitlist

If you sign up to hear when the clock can be ordered, we keep your email address and country, and anything you add: your name, a WhatsApp number, how many clocks, what they are for, and a note. We also keep when you signed up, which page or link brought you, your browser's language and its User-Agent line, and a scrambled code for your network, never your address.

We use it to tell you when you can order, and to plan how many clocks to make. We keep it until you ask us to remove it.

When you sign up we send you one email to confirm your address, with a link to confirm it and a link to remove it. We note whether the confirm link was opened. The email is sent through Cloudflare's email service, which receives your address and the message only to deliver it.

The DHL Bahrain edition

DHL Bahrain's staff can put their own name on a clock's DHL faces, on a private page that asks for a passcode. Whoever does so types a title, a first name and a last name, and may add the name in Arabic. None of this is part of what the clock sends: it is given only by someone who uses that page.

We keep that name and the Clock ID of the clock it was given to, so that the clock's pictures carry it. The pictures are drawn on our server with the name already on them, so the clock needs nothing else. A name that is typed but not given to a clock is deleted after 14 days. A name given to a clock is kept until someone asks us to remove it.

In the browser, a typed name is shown by a code, never in a web address, and the page remembers the passcode only until the tab is closed. Wrong passcode tries are counted against a scrambled code for the network, never its address. Only the owner of clock.bh can see the names.

This website and our servers

Like any website, our web server writes a line for each request it answers: the IP address it came from, the time, the address asked for, the page that linked to it, and the browser's or app's User-Agent line. That includes the clock's and the app's requests. We use these logs only to keep the site working and to stop abuse. They are not combined with anything else or shared, and they are not in our backups. Each line is deleted within 7 days.

clock.bh is also a public time server. It sees the address of every device that asks it for the time, and keeps the addresses seen in the last 24 hours to count how many use it. Older ones are dropped.

There are no ads, no analytics and no tracking cookies. The only cookie is the owner's login to the dashboard.

The faces' data comes from Open-Meteo (weather), AlAdhan (prayer times), OpenSky Network (flights), CelesTrak (the ISS), NOAA (space weather), Cloudflare Radar (Internet pulse) and football-data.org (football). Our server asks them; your clock never does. We send them nothing about you, only a city's coordinates or a league.

Who sees it, and where it is kept

Only the owner of clock.bh, through a password-protected dashboard. Everything is kept on clock.bh's own server, with a nightly backup on the same server. The confirmation email passes through Cloudflare on its way to you.

Your choices

• To have your clock's record deleted, send its Clock ID to admin@clock.bh. The ID is on the clock's own page and in the studio's Find my clock. We delete it within 7 days. If the clock keeps calling in afterwards, it starts a new record. A setting to stop a clock sending its status is planned for a later firmware.
• To be taken off the waitlist, use the "Remove me" link in our confirmation email, or email admin@clock.bh from the address you signed up with.
• To have a name taken off a DHL clock, send its Clock ID to admin@clock.bh. Its DHL faces go back to the sample name.
• For any question about privacy, write to the same address.

Changes

When anything here changes, we update this page and its date.