Privacy policy

1. Who is responsible

The controller under the GDPR is:

Write to this address for any question about your data or to use your rights (section 10).

2. Visiting the website

When you open FocusJourney, your browser sends technical data that is needed to deliver the page: IP address, date and time, the page requested, referrer, browser and operating system. Our hosting provider processes this data to deliver the website and to keep it secure, for example to detect attacks, and keeps it in server logs for a short time.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is a working and secure website.

Hosting: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Our server functions run in Frankfurt, Germany. Vercel is certified under the EU-U.S. Data Privacy Framework; in addition, the EU Standard Contractual Clauses apply.

3. Your account

To create an account we store:

• your email address and your password (stored only as a secure hash, we never see it in plain text)
• your first name, if you enter one
• that you confirmed you are at least 16 and accepted our terms, with the version and the time

We send you emails only when they are needed for your account: to confirm your address and to reset your password. No newsletters. Emails are sent by Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany).

Legal basis: Art. 6 (1) (b) GDPR (providing the service you signed up for).

4. What you enter in the app

So FocusJourney can work, we store what you enter and what the app calculates from it:

• your plan: main goal, screen-time and study goals, challenge length, start date, destination, home country
• daily check-ins: minutes in social apps, study minutes, points
• study sessions: start, length, points, and, if you add them, your mood and a short note
• stamps, trips and challenge results

Your notes are private and only visible to you. Please don't write information about your health or other sensitive details into them.

On the home page we show one number: the total study minutes of all users together. It contains no information about any individual person.

Legal basis: Art. 6 (1) (b) GDPR.

5. Where your data is stored

Your account and app data are stored with Supabase, Inc. (USA) in a database located in Frankfurt am Main, Germany (AWS eu-central-1). Supabase is our processor under a data processing agreement (Art. 28 GDPR). Where data may be accessed from outside the EU, the EU Standard Contractual Clauses apply.

Every user can only ever read and change their own data. This is enforced by the database itself (row level security), not only by the app.

6. Cookies and storage in your browser

We use no tracking or advertising cookies and no analytics tools. We only store what is technically necessary:

• a login cookie (sb-…-auth-token) that keeps you logged in, until you log out or for up to 400 days
• a short-lived security cookie (sb-…-auth-token-code-verifier) while you confirm your email or reset your password, so the link only works in the browser where you started
• a marker cookie (focusjourney_recovery) for 15 minutes after you open a password reset link
• in your browser's local storage: a study session that is still running, your preferred study room, and your plan from the start page until your account is confirmed

These are strictly necessary for the service you asked for, so no consent is required (§ 25 (2) no. 2 TDDDG). Our font is stored on our own server; your browser does not contact Google or other font services.

7. Protection against bots

To stop automated sign-ups and login attacks we use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) on the sign-up, login and password reset forms. Turnstile checks technical signals from your browser, such as your IP address, and does not set tracking cookies. Cloudflare is certified under the EU-U.S. Data Privacy Framework.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is protecting accounts and the service from abuse.

8. How long we keep data

We keep your data as long as you have an account. When you delete your account in your passport, your account and everything you entered are removed from our database. Some records are kept by our providers for a limited time: security logs of logins and sign-ups (with email address and IP address) and backups, which are overwritten automatically. Server logs of website visits are kept only briefly.

9. No automated decisions

Points and badges are calculated automatically from what you enter, but nothing about you is decided automatically in a way that has legal or similarly significant effects (Art. 22 GDPR). We don't build profiles for advertising.

10. Your rights

You have the right to:

• access the data we store about you (Art. 15 GDPR)
• have wrong data corrected (Art. 16 GDPR)
• have your data deleted (Art. 17 GDPR)
• restrict processing (Art. 18 GDPR)
• receive your data in a common format (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw a consent you gave, with effect for the future (Art. 7 (3) GDPR)

Two of them you can use yourself at any time in your passport: “Download my data” and “Delete account”. For everything else, write to us.

You can also complain to a data protection supervisory authority, for example the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach).

11. Minimum age

FocusJourney is for people aged 16 and over. If we learn that someone younger has created an account, we delete it.

12. Do you have to provide data?

You need an email address and a password to create an account. Everything else is up to you; without check-ins the app simply can't calculate points.

13. Changes

If we change how we handle data, we update this page. For important changes we tell you in the app or by email before they take effect.