Pillow Math

PRIVACY POLICY

Last updated: October 28, 2026

INTRODUCTION

Pillow Math ("we", "us", or "our") operates the Pillow Math website at https://pillowmath.com (the "Service"): free sleep calculators, an alarm tool and articles. There is no account to make and nothing to buy.

This page explains what personal data we collect when you use the Service, why, how long we keep it, who receives it, and the choices you have.

Use of the Service is subject to this Privacy Policy. The privacy page on the site, https://pillowmath.com/privacy, gives the same facts in short form.

WHO WE ARE

  • Controller: Lunera AS (organisation number 936863590), which runs Pillow Math
  • Address: Sigurd Hoels Vei 8, 0655 Oslo, Norway
  • Location: Norway
  • Contact: https://pillowmath.com/contact

INFORMATION COLLECTION AND USE

Types of Data Collected

Personal Data

We collect personal data only when you choose to use one of the two forms on the Service:

  • UP beta waitlist (optional): your email address, the time you signed up, an optional source page path, and a hash of your IP address.
  • Contact form: your email address, your message as you wrote it, and the time it arrived.

The Service never asks for your name or payment details. It has no checkout, no comment system and no accounts.

Data Your Browser Sends

When your browser loads a page or sends a form, the servers that receive the request see your IP address and browser details, as any web server does. This applies to Cloudflare, which serves the site and runs the two form handlers, and to TermsBox, which serves the cookie consent banner.

Cookies and Similar Technologies

The TermsBox consent banner sets two cookies on pillowmath.com, termsbox_consent (your cookie choice) and termsbox_visitor (a random visitor ID), each kept for 365 days. It also keeps two local storage items, termsbox_geo (your approximate country and region and whether the site honors Global Privacy Control) and termsbox_config_cmu4qt4ea09xb32rsdl7b1o77 (a copy of the banner's settings, with no personal data). Our Cookies Policy lists each item with its purpose and retention.

When you make a choice in the banner, it sends TermsBox a record of that choice: your visitor ID, the cookie categories you allowed, whether your browser sends a Global Privacy Control signal, and your approximate country and region.

The tools also keep these items in your browser. They never leave your device, and clearing your browser data removes them:

  • pillowmath:hour12 (local storage): your choice between a 12-hour and a 24-hour clock.
  • pillowmath:alarm (local storage): the alarm you set, with its time, label, whether sums stop it, the snooze length and when it rings next. It is removed when you stop or cancel the alarm.
  • pillowmath-alarm-v1 (browser cache): the alarm pages and the site's script, style and icon files, kept by a small service worker so the alarm opens without a connection. The service worker sends nothing anywhere and has no push messages.

Setting an alarm also asks your browser for permission to show a notification when it rings. Your browser shows that notification itself.

The Service runs no analytics and no advertising scripts, and uses no analytics, marketing, social media or functionality cookies.

Special Categories of Personal Data

We do not ask for health data or any other special category of personal data. The contact form asks you to leave out health or medical details. The Service does not give medical advice.

Sources of Personal Data

  • You: the email address and message you type into a form.
  • Your browser: the IP address and browser details sent with each request, and the consent choice recorded by the banner.

PURPOSES AND LEGAL BASES (EU/EEA/UK)

Purpose Data Legal basis
Send you one notification when the UP beta opens Waitlist email address, signup time, source page path Consent (GDPR Art. 6(1)(a)). You can withdraw it at any time through the contact page.
Answer your message Contact email address, message, arrival time Legitimate interests (GDPR Art. 6(1)(f)) in answering the person who wrote to us
Limit form abuse (signup and message attempts per hour) Unsalted SHA-256 hash of your IP address Legitimate interests (GDPR Art. 6(1)(f)) in keeping the forms secure and free of abuse
Show the consent banner and keep your choice The TermsBox items and consent record above Legal obligation (GDPR Art. 6(1)(c)) to obtain cookie consent and be able to show it

USE OF DATA

  • Waitlist: we use your email address only to send you one notification when the UP beta opens.
  • Contact form: we use your email address only to answer you.
  • IP address hashes: the form handlers count attempts under an unsalted SHA-256 hash of your IP address to limit signups and messages (messages to three an hour). A hash of this kind is not anonymous data.
  • Consent record: to show which cookie choice you made and to apply it on every page.

We do not sell personal data, and we do not use it for advertising or profiling.

RETENTION

  • Waitlist signup records: the record holds your email address (with spaces trimmed and letters made lowercase), the signup time, the IP address hash and the optional source page path. It does not hold your raw IP address or the hidden spam-check field. Signup records have no automatic expiry or deletion job. They remain indefinitely unless manually deleted, and you can ask for deletion at any time through the contact page.
  • Contact messages: the record holds your email address (with spaces trimmed and letters made lowercase), your message and the time it arrived, and no IP address, IP hash or page path. Messages are deleted automatically after 90 days.
  • Attempt counters for both forms: they expire one hour after their last write. That expiry does not remove the hash stored in a signup record.
  • Cookie banner items: the two cookies last 365 days; the two local storage items stay until you clear them.
  • Items the tools keep in your browser stay on your device until you clear them (the alarm item is removed when you stop or cancel the alarm).

Service providers

  • Cloudflare: hosts the site, and runs the waitlist and contact form handlers on Cloudflare Workers, which store the records above in Cloudflare KV.
  • TermsBox (termsbox.com): provides the cookie consent banner and receives the consent record described above.

Transfers outside the EEA: where Cloudflare or TermsBox process personal data outside the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses in their data processing terms.

ADVERTISING

The Service shows no advertising and runs no advertising scripts.

Amazon links

There are no Amazon links on the site today. If pages later link to Amazon through the Amazon Associates program, those pages will say so. Amazon sets its own cookies on its own site, under its own privacy policy.

YOUR PRIVACY RIGHTS

Depending on where you live, data protection law gives you rights over your personal data. You can exercise any right available to you through the contact page, https://pillowmath.com/contact. We answer by email.

If you are in the EEA or the UK, you have the right to request access to the personal data we hold about you; rectification of inaccurate or incomplete data; erasure; restriction of processing; and portability of data you provided to us. You also have the right to object to processing based on our legitimate interests and to object to direct marketing at any time, and to withdraw your consent at any time where we rely on consent. You have the right to lodge a complaint with your local data protection supervisory authority.

If the CCPA/CPRA applies to us and you are a California resident, you may have rights to know what personal information we collect, use, disclose, sell, or share; to request deletion of your personal information; to correct inaccurate personal information; to opt out of the sale or sharing of your personal information; to limit certain uses and disclosures of sensitive personal information; and not to receive discriminatory treatment for exercising protected rights, subject to the statute's scope and exceptions. We do not sell or share personal information.

GENERAL DATA PROTECTION REGULATION (EU/UK GDPR)

Potential rights under applicable law include:

  • Access to the personal data we hold about you.
  • Rectification of inaccurate or incomplete data.
  • Erasure ("right to be forgotten") in certain circumstances.
  • Restriction of processing in certain circumstances.
  • Portability of data you provided to us in a structured, commonly used and machine-readable format.
  • Objection to certain processing and direct marketing.
  • Withdrawal of consent where processing relies on consent.
  • Not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, unless permitted by law and subject to safeguards.

We make no decisions based solely on automated processing and do no profiling.

CALIFORNIA ONLINE PRIVACY PROTECTION ACT (CalOPPA)

The Service does not track you over time or across other websites. Because there is no such tracking, it does not change its behavior when your browser sends a Do Not Track signal. The consent banner records whether your browser sends a Global Privacy Control signal.

CHANGES TO THIS PRIVACY POLICY

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

We will update the "Last updated" date when this Privacy Policy changes.

CONTACT US

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us: