Privacy Policy

Last updated: 16 August 2026

This policy describes how the FocusMe mobile application (the "app", "we", "our") collects, uses, stores and shares information. It applies to the Android application published under the package name uz.focusguardian.app and to the backend services that support it.

If you do not agree with this policy, please do not install or use the app.

1. Who we are

FocusMe is developed and maintained by an independent developer based in Uzbekistan. You can reach us at:

• Email: support@focusguardian.xyz
• Personal-data enquiries: support@focusguardian.xyz

2. The short version

3. What data we collect

3.1. Data you provide yourself

Data	When	Why
Email address	Sign-up, sign-in, password reset	Identifying the account, sending confirmation and recovery messages
Password	Sign-up, sign-in	Authentication. Stored on the server only as a salted hash, never written to logs and never shared with third parties
Display name (optional)	Sign-up, Google sign-in	Personalising the interface
Profile picture link (optional)	Google sign-in	For display only; we do not copy or host the image ourselves
Override reasons, notes	When you write them in the app	Stored locally so that you can review your own patterns. Never uploaded

3.2. Data collected automatically on the device

This data is produced as you use the app and is stored on your device only, in the encrypted database:

• Friction events: which tracked app you opened, which countdown screen or question you saw, whether you continued or stopped
• Focus session records: planned and actual duration, completion status
• Commitment-mode session records: duration, overrides used, the reason you gave, a snapshot of the allowed-apps list
• Daily per-app usage counters: seconds spent in each tracked package for the local date
• The limit and block configurations you create
• Streaks, progress and levels

This data does not leave the device unless you export it yourself (section 7).

3.3. Data collected on our servers

When you use an account, our backend API receives and stores:

• Email address, password hash, display name, profile picture link, email-confirmation timestamp, account creation and update timestamps
• Access and refresh tokens issued to your device (for session management)
• Standard request metadata (IP address, time, user agent) in short-lived server logs used for security and debugging

3.4. Data we do not collect

FocusMe does not collect:

• The contents of the apps you open, the text of your messages or any screen content — beyond the package name of the active app and, when 18+ content blocking is enabled, the page address in your browser
• Your location (neither precise nor approximate location permissions are requested)
• Contacts, photos, microphone, camera
• SMS, call logs, calendar
• Device advertising identifiers

The app contains no third-party analytics, advertising or attribution SDKs and no crash-reporting tools. There are no tracking pixels and no fingerprinting libraries.

4. Android permissions and why they are needed

Any of these permissions can be revoked in Android settings — some features will stop working if you do.

Permission	Why it is needed	What leaves the device
Accessibility (BIND_ACCESSIBILITY_SERVICE)	To detect in real time which app came to the foreground and show the blocking screen in time. The service reads the package name of the active window and basic window events. When 18+ content blocking is enabled it additionally reads the address of the open page in supported browsers in order to check it against the block list. It does not read on-screen text, input fields, passwords or messages.	Nothing. Processing happens entirely on the device.
Usage access (PACKAGE_USAGE_STATS)	To show how much time you spent in apps during the day and to enforce the daily limits you set.	Nothing. Read and stored locally.
Display over other apps (SYSTEM_ALERT_WINDOW)	To draw the blocking screen on top of an app.	Nothing.
Foreground service (FOREGROUND_SERVICE)	So that the tracking service runs reliably during a session. Android shows a persistent notification while it is active.	Nothing.
Notifications (POST_NOTIFICATIONS)	To warn you as you approach a limit and to remind you about sessions.	Nothing.
Ignore battery optimisation	So that the system does not kill the tracking service in the middle of a session.	Nothing.
Start on boot	To restore an active session after the device restarts.	Nothing.
Installed app list (QUERY_ALL_PACKAGES)	To show the list of installed apps during setup so you can choose which ones to restrict. The list is held in memory and never transmitted.	Nothing.
Biometrics (USE_BIOMETRIC)	Optional: fingerprint or face confirmation before overriding a session in commitment mode. The check is performed entirely by the system BiometricPrompt — we never receive biometric data.	Nothing.
Internet	For account sign-in, subscription status sync and update checks.	See section 5.

4.1. A note on the Accessibility service

FocusMe uses the Android Accessibility API solely for its declared purpose: to determine which app came to the foreground so that a mindful-use screen can be shown, and — if you enabled 18+ content blocking — to check the address of the open browser page against the block list. The service is declared with the typeWindowStateChanged and typeWindowContentChanged events. It does not record keystrokes, does not read text off the screen, does not store passwords and does not take screenshots. It transmits nothing over the network. On modern Android versions this is the only reliable way to implement the app's core function.

5. Third-party services that receive data

5.1. Google sign-in

If you choose to sign in with Google, the SDK returns an ID token containing your email address, name, profile picture link and Google account identifier. We send that token to our server in order to create or find your account. Google's use of your data is governed by the Google Privacy Policy.

5.2. RevenueCat (subscription management)

When you purchase a subscription we use RevenueCat, Inc. on top of Google Play Billing. RevenueCat receives a pseudonymous user identifier (not your email address), purchase events from Google Play, the device platform and the app version. RevenueCat does not receive your email, your password, on-device behavioural data or any text you wrote. See the RevenueCat privacy policy.

5.3. Google Play Billing

Payments are processed by Google Play. We never see your card details or billing address — only the purchase token and the subscription status. See the Google Play terms.

5.4. Google Play Core (in-app updates)

The Play Core library is used to offer you an update. It communicates only with Google Play and transmits no personal data.

5.5. Our backend API

Our own backend at api.focusguardian.xyz handles sign-up, authentication, password reset, email confirmation and profile requests. It is the only server of ours that receives your data.

6. How we store and protect data

• On-device database. Behavioural data is stored in an SQLite database encrypted with SQLCipher, inside the app's private storage area.
• Authentication tokens. Access and refresh tokens are kept in EncryptedSharedPreferences, backed by the Android Keystore.
• In transit. All traffic between the app and our server goes over HTTPS (TLS 1.2 or higher).
• On our servers. Passwords are stored only as salted hashes. We apply reasonable organisational and technical safeguards proportionate to the sensitivity of the data.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify affected users as required by applicable law.

7. Your rights and controls

Wherever you live, the following are available under Settings → Privacy:

• Export data. Produces a JSON file with your friction events, sessions, records and progress, saved to the app's documents folder on the device.
• Delete all local data. Erases all behavioural data from the device. The account itself is kept so that you can keep using the app.

To exercise the rights below, write to support@focusguardian.xyz from the email address linked to your account:

• Right of access — request a copy of the server-side data we hold about you.
• Right to rectification — ask us to correct inaccurate data.
• Right to erasure — ask us to delete your account and the associated server-side data. We will do so within 30 days unless retention is required by law.
• Right to object and to restrict processing — where applicable under the GDPR.
• Right to withdraw consent — where processing is based on consent.
• Right to portability — request your server-side data in a machine-readable format.

For users in the EU, the EEA and the UK, the legal bases for processing are (a) performance of a contract (providing the account you created), (b) our legitimate interest in operating the service, and (c) your consent for optional features.

For California residents: we do not "sell" or "share" personal information within the meaning of the CCPA and the CPRA.

If we cannot resolve your concern directly, you have the right to complain to the data protection supervisory authority in your country.

8. Retention periods

• On-device data is kept until you uninstall the app or tap "Delete all data".
• Account data on our servers is kept for as long as the account exists. On a deletion request we delete or anonymise it within 30 days, except where we are required to retain records for legal, tax or anti-fraud reasons.
• Server request logs are kept for up to 90 days, then deleted or aggregated.
• RevenueCat retains subscription records under its own policy.

9. International data transfers

Our backend may be hosted outside your country of residence. Where data is transferred internationally we rely on appropriate safeguards (for example, standard contractual clauses) as required by applicable law.

10. Children

FocusMe is intended for a general audience and is not directed at children under 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with such data, please write to us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. When we do, we change the date at the top of the document. We will notify you of material changes in the app or by email before they take effect. Continuing to use the app after changes take effect means you accept the updated policy.

12. Contact

Questions, requests and complaints about this policy and your data:

Email: support@focusguardian.xyz

We aim to respond within 14 days.