Privacy Policy

1. Who We Are

FocusXP ("we", "our", or "us") is an iOS productivity application developed and operated as an independent project. Our support email is support@focusxp.site and our website is focusxp.site.

2. Information We Collect

2.1 Information You Provide

• Account creation (optional): If you create an account, we collect your email address and display name. Account creation is completely optional — the app works fully offline without an account.
• Display name: A name you choose to personalise your profile. Defaults to "Focus Hero".

2.2 Information Collected Automatically

• Focus session data: Duration of work sessions, break sessions, timestamps, project tags, and XP earned. Stored locally on your device first, synced to the cloud only if you have a Pro account.
• Productivity statistics: Daily minutes, weekly totals, category breakdowns, intensity levels, and session history. These are used to power your Stats and AI Coach features.
• Level and XP: Your current level (1–10) and total XP accumulated.
• App preferences: Timer settings, audio preferences, selected theme, and notification settings. Stored locally in UserDefaults.

2.3 Information We Do NOT Collect

• We do not collect your location
• We do not access your contacts, calendar, camera, or microphone
• We do not track you across other apps or websites
• We do not use advertising identifiers (IDFA)
• We do not collect health or fitness data

3. How We Use Your Information

• To provide the service: Displaying your timer, tracking XP, calculating stats, and powering the AI Focus Coach.
• Cloud sync (Pro): If you subscribe to FocusXP Pro, your session data and profile are synced to our Supabase cloud database so you can access them across devices.
• Account management: To authenticate you, manage your subscription status, and handle account-related requests.
• Support: If you contact us at support@focusxp.site, we use the information you provide to respond to your inquiry.

4. Data Storage & Third-Party Services

4.1 Local Storage

All timer data, session history, and preferences are stored locally on your device using iOS UserDefaults and the app's local storage. Authentication tokens are stored securely in the iOS Keychain.

4.2 Supabase (Cloud Backend)

If you create an account and/or subscribe to Pro, your profile data is stored in a Supabase PostgreSQL database hosted on AWS EU West 1 (Ireland). Supabase is GDPR-compliant and processes data according to its own Privacy Policy. Data stored includes: display name, email, XP, level, session statistics, and subscription status.

4.3 Apple Sign-In

If you sign in with Apple, Apple may share a name and email address (real or anonymised relay address) with us. We store only what is needed to identify your account. Apple's privacy practices are governed by Apple's Privacy Policy.

4.4 Google OAuth

If you sign in with Google, we receive your Google email address and display name via OAuth 2.0. We do not receive access to your Google Drive, Gmail, or other Google services. Google's practices are governed by Google's Privacy Policy.

4.5 Apple App Store & StoreKit

In-app purchases and subscriptions are processed entirely by Apple through StoreKit 2. We do not receive or store your payment card details. Subscription status is verified server-side via Apple's receipt validation API and reflected in your FocusXP profile. Apple's payment practices are governed by Apple's Privacy Policy.

5. Data Retention

• Local data: Retained until you delete the app or clear app data from iOS Settings.
• Cloud data (account holders): Retained for as long as your account is active. You may request deletion at any time (see Section 7).
• Support emails: Retained for up to 2 years to help resolve recurring issues.

6. Data Security

We take reasonable measures to protect your data:

• Authentication tokens are stored in the iOS Keychain (hardware-backed secure enclave on supported devices)
• All communication with our backend uses HTTPS/TLS encryption
• Supabase database access is protected by Row-Level Security (RLS) — each user can only read and write their own data
• We use an anonymous publishable key for client-side Supabase access — the service role key is never embedded in the app

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Your Rights & Choices

7.1 Access & Portability

You can export all of your session data at any time from the app: Settings → Data Export. This produces a JSON file containing your full history, XP, and statistics.

7.2 Correction

You can update your display name at any time from Settings → Profile.

7.3 Deletion

You can delete your account and all associated cloud data from within the app: Settings → Profile → Delete Account. This requires typing "DELETE" to confirm and permanently removes your profile from our database. Alternatively, email support@focusxp.site and we will complete deletion within 30 days.

7.4 Opt-Out of Cloud Sync

Cloud sync is Pro-only and can be disabled at any time from Settings → Sync. Free users' data never leaves their device.

7.5 Guest Mode

FocusXP fully supports guest mode — you can use the entire free tier without creating an account. No email, no sign-up, no cloud data.

8. Children's Privacy

FocusXP is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at support@focusxp.site and we will delete it promptly.

9. International Users

FocusXP is operated from the EU. If you are located outside the EU, please be aware that your information may be transferred to and processed in the EU (Ireland/AWS EU West 1). By using FocusXP, you consent to this transfer. We handle data in accordance with GDPR principles regardless of your location.

10. Notifications

FocusXP uses local notifications generated on-device to alert you when focus sessions and breaks end. These include optional actionable buttons (e.g. "Start Break", "Extend Break") that are handled entirely on-device. No personal data is transmitted to send these alerts.

The app requests the remote-notification background mode solely to enable background data refresh (cloud sync for Pro users) — we do not send marketing or server-initiated push notifications to your device.

You can disable all notifications at any time in iOS Settings → FocusXP → Notifications.

10a. Widgets & Live Activities

FocusXP Pro includes iOS Home Screen Widgets and Live Activities (Dynamic Island / Lock Screen). These features display your current timer state and session data directly on your home screen or lock screen. This data is shared between the main app and the widget extension via an iOS App Group container (group.iko.FocusXP) — it never leaves your device for this purpose and is not transmitted to any server.

11. Analytics

FocusXP does not use any third-party analytics SDKs (no Firebase, no Mixpanel, no Amplitude). All usage statistics displayed in the app are computed locally from your own data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify you via the app or email (if you have an account). Continued use of FocusXP after changes constitutes acceptance of the revised policy.

13. Contact Us

If you have questions, concerns, or requests about your privacy, please contact us:

• Email: support@focusxp.site
• Website: focusxp.site

We aim to respond to all privacy-related inquiries within 5 business days.