Privacy Policy

1. Who we are

FocusTribe is a free collaborative focus and Pomodoro workspace at focustribe.in. The controller of the personal data described here is [TODO: legal entity name], registered at [TODO: registered address]. You can reach us about anything in this policy at kalpesh@buildifyapp.in.

2. What we collect, why, and on what basis

We collect only what the product needs in order to run. Everything below is stored in Google Cloud Firestore unless stated otherwise.

Account identity

When you sign in we receive your email address, display name, and profile photo URL from Google. Sign-in is through Google OAuth only. FocusTribe has no email-and-password sign-in, so we never receive or store a password. We use this data to create and authenticate your account and to show who you are to the other member of your workspace. Lawful basis: performance of a contract (Article 6(1)(b) GDPR) — we cannot give you an account without it.

Account activity signals

On your user record we store a login count, the timestamp of your first login and most recent login, the time you last opened a workspace and which workspace it was, the timestamp of your first focus session, flags recording whether you have dismissed the in-app product tour, flags recording which lifecycle reminder emails have already been sent to you, and, if you unsubscribe, an email opt-out flag and the time it was set. These tell us whether the product is actually being used and stop us emailing you the same reminder twice. Lawful basis: our legitimate interests in measuring and improving the service and in re-engaging inactive users (Article 6(1)(f) GDPR). You can object to this at any time — see section 7.

Workspace content

When you create or join a workspace we store the workspace name, its icon, its invite code, and the identity records (user ID, email, display name, photo URL, join date) of its members. A FocusTribe workspace holds a maximum of two members. Lawful basis: performance of a contract (Article 6(1)(b) GDPR).

Tasks

We store the text of every task you write, together with any task notes, subtasks, priority, category, planned duration, scheduled start and end time, timer state, and completion record. Task text and notes are free-text fields, so whatever you type into them is stored as written. Tasks in a workspace are readable by both members of that workspace. Lawful basis: performance of a contract (Article 6(1)(b) GDPR).

Daily reflections

If you use the daily progress journal we store, for each day you fill in: a productive or unproductive marker, a list of achievements, a list of mistakes, what helped you focus, what distracted you, an energy level from 1 to 5, and any free-text notes you add. Reflections are written by you, and the app only ever queries and displays your own entries back to you — your workspace partner is not shown your reflections anywhere in the product. The database rules enforce the same thing rather than relying on the interface: they permit only the author of a reflection to read, create, edit, or delete it, so your workspace partner cannot retrieve your reflections even by querying the database directly. Reflections hold whatever you choose to write, so please do not put anything in them you would not want stored. Lawful basis: performance of a contract (Article 6(1)(b) GDPR).

Break status

While you are on a break we store your break status — your user ID, your name, whether you are on a break, whether it is a short or long break, its duration, when it started, and the time remaining. This is what lets the other member of your workspace see that you are away. It is readable by members of your workspace. Lawful basis: performance of a contract (Article 6(1)(b) GDPR).

Usage analytics

We load Google Tag Manager on the site, which in turn loads Google Analytics, and the Firebase Analytics SDK initialises in browsers that support it. These record events such as page views, sign-ups, and sign-ins, along with the technical data analytics tools normally collect: approximate location derived from IP address, device and browser type, and the referring page. See our Cookie Policy for the detail, including the fact that these tags currently load for every visitor. Lawful basis: our legitimate interests in understanding how the site is used (Article 6(1)(f) GDPR). Where consent is required in your jurisdiction we will rely on consent once the consent mechanism described in the Cookie Policy is live.

What we do not collect

FocusTribe does not read your screen, your keystrokes, your clipboard, or the contents of any other application. It takes no screenshots and uses neither your camera nor your microphone. We do not buy personal data from third parties and we do not sell it.

3. Emails we send

A scheduled job runs once a day and may send you one of three lifecycle emails through Resend: a reminder if you signed up two to four days ago and never created or joined a workspace; a reminder if you signed up two to four days ago, have a workspace, but have never started a focus session; and a re-engagement email if you were active and have then been away for seven to fourteen days. Each is sent at most once per account — once sent, a flag on your user record prevents it being sent again. Resend receives your email address, your first name, and your workspace link for this purpose.

Every one of these emails carries an unsubscribe link, and supports one-click unsubscribe from your mail client. Using either records an opt-out flag and the time it was set on your user record, and that flag is checked before any further email is sent, so you will not receive another. You can also opt out by emailing kalpesh@buildifyapp.in.

4. Who processes your data

We keep the list of processors deliberately short. Each acts on our instructions under a data processing agreement.

• Google (Firebase Authentication, Cloud Firestore, Firebase Analytics) — hosts the authentication system and the database. It receives and stores your identity data, your workspace, your tasks, your reflections, and your break status. Signing in with Google also means Google, as an independent controller of your Google Account, knows that you authenticated to FocusTribe.
• Google Tag Manager and Google Analytics — receive site usage events and the associated technical data described above.
• Vercel — hosts and serves the application. In the course of serving requests it processes connection data including IP addresses and request logs.
• Resend — sends the transactional and lifecycle emails described in section 3. It receives your email address, your first name, and the email content.

5. International transfers

Google, Vercel, and Resend are United States companies operating global infrastructure, so your personal data may be transferred to and processed in countries other than your own, including the United States. Where data leaves the European Economic Area or the United Kingdom, those transfers are covered by the European Commission Standard Contractual Clauses and the UK International Data Transfer Addendum in our agreements with each provider, together with any additional safeguards those providers apply. You may request a copy of the relevant safeguards from kalpesh@buildifyapp.in.

6. How long we keep it

This section is literal rather than aspirational.

• Workspace content (the workspace record, tasks, reflections, and break status) is kept until the workspace is deleted. The person who created the workspace can delete it from inside the app.
• Your account record (identity data and activity signals) is kept for as long as the account exists.
• Self-serve account deletion is not yet available. There is no “delete my account” button in the product today. Until we ship one, email kalpesh@buildifyapp.in from the address on your account and we will delete your account record and the workspace data associated with it. We aim to complete deletion requests within 30 days.
• Analytics data is retained according to the retention setting on the Google Analytics property and to Google’s own policies.
• Email delivery logs are retained by Resend according to its own retention schedule.

7. Your rights

If you are in the European Economic Area or the United Kingdom, the GDPR gives you the rights below. We honour them for everyone, wherever you are.

• Access — ask what personal data we hold about you and receive a copy of it.
• Rectification — have inaccurate data corrected. You can edit your display name, your tasks, and your own reflections directly in the app.
• Erasure — have your personal data deleted. Use the route in section 6 while self-serve deletion is pending.
• Portability — receive the data you provided in a structured, commonly used, machine-readable format, or have it transmitted to another controller where technically feasible.
• Restriction — ask us to pause processing while a dispute about accuracy or legitimate interests is resolved.
• Objection — object to processing we carry out on the basis of legitimate interests, including the lifecycle emails and the usage analytics.
• Withdraw consent — where we rely on consent, withdraw it at any time, without affecting processing already carried out.

To exercise any of these, email kalpesh@buildifyapp.in from the address on your account. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with a supervisory authority, normally the data protection authority of the country where you live or work. In Ireland that is the Data Protection Commission; in the United Kingdom it is the Information Commissioner’s Office. We would appreciate the chance to resolve the issue first, but you are not obliged to come to us before going to them.

8. Cookies and local storage

FocusTribe stores a number of values in your browser to keep timers, settings, and your signed-in state working, and loads Google Tag Manager for analytics. Every cookie and storage key is listed, with its purpose and whether it is strictly necessary, in the Cookie Policy.

9. Security

Traffic to FocusTribe is served over HTTPS. Access to your data is enforced by Firestore security rules: your user record can be read and written only by you, and workspace content can be read and written only by members of that workspace. No system is perfectly secure and we cannot guarantee absolute security, but we will notify you and the relevant supervisory authority as required by law if a breach affecting your personal data occurs.

10. Children

FocusTribe is not directed at children. You must be at least 16 years old to create an account, or at least 13 where local law permits and a parent or guardian consents. If you believe a child has given us personal data, contact kalpesh@buildifyapp.in and we will delete it.

11. Changes to this policy

We will update this page whenever the product changes what it collects or how that data is processed. The “last updated” date at the top always reflects the current version. Where a change materially affects your rights we will tell you by email or in the app before it takes effect.

12. Contact

Questions, requests, or complaints about this policy go to kalpesh@buildifyapp.in, or by post to [TODO: legal entity name], [TODO: registered address].