Privacy Policy

1 Information We Collect

We collect information you provide directly when you create an account, use focus sessions, or contact us for support, along with technical information needed to run the service.

Account information

• Email address
• Display name, if provided
• Account creation date and account status

Focus session & preference information

• Focus session choices and selected channels
• Session timestamps and duration
• Saved preferences such as volume or preferred channel
• Lightweight calibration or focus-preference answers, where saved

Support & feedback

• Messages you send to support or feedback
• Basic context needed to respond to you

Payment & access

• Subscription and access status, and purchase source
• Payment processors handle payment details; we do not store card numbers or security codes

Technical & usage information

• Device, platform, and app version
• Product usage and diagnostics needed to run and improve the service

2 How We Use Your Information

Your data is used to:

• Provide focus-music sessions
• Remember your preferences
• Manage account access and subscriptions
• Provide support and respond to feedback
• Improve reliability and product quality
• Send transactional emails such as password resets, account updates, data-export links, and support replies

3 Data Storage and Security

Your data is stored in Supabase-managed PostgreSQL databases with row-level security (RLS) policies. All data in transit is encrypted via TLS. Passwords are hashed using industry-standard bcrypt.

4 Data Retention

We retain your data for as long as your account is active. You may request a full data export or account deletion at any time through the app settings.

5 Your Rights

You have the right to:

• Access all personal data we hold about you
• Export your data in a structured format
• Request deletion of your account and all associated data

To exercise any of these, use the controls in the app settings or email privacy@focus.music. We will not discriminate against you for exercising your rights.

6 California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you specific rights regarding your personal information. In the past 12 months we have collected the categories of personal information described in Section 1 (identifiers, commercial/subscription information, internet and usage activity, and audio/preference data you create in the app). We collect it for the purposes in Section 2.

As a California resident, you have the right to:

• Know what personal information we collect, use, and disclose, and to request a copy.
• Delete the personal information we hold about you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the "sale" or "sharing" of personal information, and to limit the use of sensitive personal information.
• Non-discrimination for exercising any of these rights.

To exercise these rights, email privacy@focus.music or use the in-app controls. We will verify your request against your account, and you may use an authorized agent to submit a request on your behalf.

7 European Privacy Rights (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, focus.music acts as the data controller for your personal data and processes it under the following legal bases:

• Performance of a contract - to provide your account, sessions, and subscription.
• Legitimate interests - to keep the Service secure, reliable, and improving, balanced against your rights.
• Consent - for optional processing such as non-essential analytics, which you can withdraw at any time.
• Legal obligation - where we must retain records to comply with law.

You have the right to access, rectify, erase, restrict, or object to processing, to data portability, and to withdraw consent at any time. International transfers of your data are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses. You also have the right to lodge a complaint with your local supervisory authority. To exercise any GDPR right, contact privacy@focus.music.

8 Cookies and Tracking

We use essential cookies for authentication and session management. We do not use third-party advertising cookies. Anonymous analytics may be collected to improve the service.

9 Third-Party Services

We use the following third-party services to operate focus.music:

• Supabase - authentication and database hosting
• Vercel - web application hosting
• Customer.io - transactional email delivery
• Apple / Google - mobile app distribution

10 Children's Privacy

focus.music is not intended for children under 13. We do not knowingly collect personal information from children.

11 Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or in-app notification.

12 Contact

For privacy-related questions, contact us at privacy@focus.music.