Legal & support

Privacy Policy

Last updated: 28 October 2026

This policy explains how FocusLatch processes personal data on the website, in the iPhone app, and in the optional Friends features. The controller is Stefan Sammer at the address listed below. FocusLatch does not sell personal data, use cross-site advertising trackers, or use personal data to train generative-AI models.

Account and sign-in data

To create and operate an account, FocusLatch processes your internal user ID, email address, authentication provider, username/handle, account timestamps, security events, account preferences, and the public profile fields you choose. Email/password sign-up is handled by Supabase Auth, which also creates the account emails, such as the address confirmation or a sign-in link; Resend sends them on our behalf from [email protected]. If you use an Apple private relay address, Apple forwards these emails to your own address. If you use Sign in with Apple or Google Sign-In, FocusLatch receives the provider identifier and the email address or private relay address released by that provider. Apple may also release your name once, on first authorization; it is used only as an editable profile suggestion and never automatically becomes your unique handle.

The account data is required to authenticate you, keep account-owned Keys and settings associated with the correct user, and prevent abuse. Without the required account fields, those account features cannot be provided. Optional profile, Friends, notification, marketing, and backup fields remain optional.

What stays on your device

Your selected Screen Time items and their opaque Apple tokens, app-list contents, schedules, local Focus Key records, and private session reflections stay on your iPhone. Optional Friends sharing separately processes the app-created session information and app-list names described below; it does not expose the apps inside an app list. FocusLatch never uploads app or website identities, Screen Time selections, Family Controls tokens, Device Activity usage data, private reflections, notes, the tag UID, or unrelated NFC tag data. On first activation, the app sends the signed 68-byte FLK1 activation payload in base64url form to the backend so it can be matched to the Factory digest and checked for a permitted account registration; this static match is not a fresh anti-replay proof. That proof is processed transiently and is not retained as raw payload; the backend retains its SHA-256 digest and the limited factory-ledger and account-ownership records described below.

Emergency unlock

When you are signed in and currently latched, you may use up to five emergency unlock credits over the lifetime of that account. Each one requires five arithmetic questions solved in one run. To provide the challenge, protect the five-credit limit, and safely reconcile a retry after an interrupted connection, FocusLatch processes your account ID, a random installation ID used as a pseudonymous device/security identifier, the exact latch generation and session token, the generated arithmetic question and current progress, the integer answer you submit, its outcome, and a random idempotency ID.

This feature does not process or upload your selected apps, Screen Time selections or tokens, or Screen Time usage data. Up to eight unfinished challenges may coexist across the account's devices and exact latch sessions. Each unfinished challenge expires after 15 minutes; expired rows are removed by an automated cleanup that runs every five minutes or opportunistically when a new challenge starts. Receipts for an active unfinished challenge remain available for that challenge's full lifetime. Once a challenge is no longer active, its non-final answer receipts become eligible for deletion 24 hours after creation; the five-minute cleanup normally removes them shortly after that point and also limits inactive non-final receipts to the newest 256 per account. The allowance record, up to five completed challenge records, and up to five successful debit receipts remain for the account lifetime so credits cannot be reset through retries and a completed same-session unlock can be recovered after an interrupted response. All account-linked emergency-unlock records are deleted when the authentication account is deleted. They are used for service integrity and abuse prevention, never for advertising or tracking.

Private Activity sync

Your daily focus goal is stored with your account so it can follow you between signed-in devices. Private Activity backup is optional and switched off by default. If you enable it, FocusLatch stores only the minimum session information needed to restore your Activity history: session start and end, and any time goal you chose for that session. These records are available only to your signed-in account and are never shown to friends or used for advertising.

You can turn Private Activity backup off at any time in Settings → Account and backup → Private Activity backup. Turning it off stops future backup and removes the backed-up session records from the server; if your iPhone is offline, the deletion is queued and completes when the connection returns. Your local Activity history remains on your iPhone. Account deletion also removes the backed-up records.

Optional Friends sharing

Friends sharing is off until you choose to enable it. The first confirmation can enable Session sharing and League together. Afterwards, Settings → Privacy lets you change Session sharing and Show me in the league independently. Private Activity backup and notification permission are separate choices. Enabling Friends does not automatically accept a friendship or group invitation.

For enabled Friends features, the backend processes your profile, friendship and block state, app-created session identifiers, a random installation identifier, session start and end times, confirmation timestamps, time zone, app-list identifier and name, and the sharing and scoring boundaries needed to honour your choices. This is focus-session timing created by FocusLatch, not Apple's Screen Time usage data. Your selected apps, categories, websites, Family Controls tokens, private notes and reflections are not included. Session sharing lets permitted friends see your live focus, app-list name, focus times and shared Highlights. League uses eligible session time to calculate weekly points and rankings from your league start date. Activity can show personal points that do not qualify for League.

Friends also processes your handle, display name, biography, private profile-photo object, goals and bounded daily focus aggregates, reactions, comments, invitation state, group membership and shared phases, activity notifications, hidden-content choices and reports. A shared group Highlight records the participants and the overlapping period they shared. Joining or inviting people uses the in-app confirmation flow; invitations are tied to the relevant sessions and stop being usable when those sessions or their visibility no longer qualify. Profile photos use short-lived signed links and the same viewer and block checks as other Friends content.

Friends-of-friends discovery is off unless separately enabled. If enabled, your name, photo and new shared group Highlights can be visible to your focus partners' friends; new reactions and comments on those Highlights are visible to that Highlight's permitted audience. Your live status, history and weekly ranking remain restricted to friends. Blocking restricts mutual profile, live-session, Highlight, comment, reaction and group visibility. A missing live status does not reveal whether someone is physically latched.

Share and invite links

When you create a Friend or League invitation, the backend stores a one-way digest of a random capability token, its owner, purpose, status, and expiry. Links expire after 30 days and do not expose a profile, roster, or score on the website. A recipient's browser still sends the raw token in the invitation URL to the website host when the fallback page is opened. Treat an invitation link like a private invitation and revoke it in the app if it was shared with the wrong person.

Notifications

Schedule alerts, Session Goal alerts, daily focus reminders, weekly progress reviews, and optional Focus Key reminders are scheduled locally on your iPhone. A Focus Key product reminder is off by default, requires a separate explicit opt-in, starts no earlier than seven days after that choice, and is sent at most once a week. You can turn every notification type off in the app at any time.

If iOS notification access and your Friends privacy choices allow Social notifications, FocusLatch sends Apple Push Notification service (APNs) a device token through our protected backend. The backend stores the notification-registration fields—the APNs device token, APNs environment, locale, time zone, app version, and build number—solely to deliver and operate the notifications you selected. It associates that registration with the signed-in account and a random app-installation identifier so delivery reaches the correct installation. Notification data is not used for advertising or tracking and is removed with account deletion. Signing out or removing iOS notification access causes the app to unregister the current installation; invalid APNs tokens are disabled automatically.

Remote lock-screen payloads use generic localized event text and opaque routing identifiers. They never contain session titles, selected apps, concrete app usage, comments, focus totals, notes, or private reflections. Tapping a notification opens the relevant FocusLatch screen, where normal account, friendship, membership, and block rules still apply.

Why we process this data

• Contract and requested steps (Article 6(1)(b) GDPR): account creation, authentication, Key registration and release, an emergency unlock you request, private account settings, support you request, and—once paid sales open—order fulfilment.
• Consent (Article 6(1)(a) GDPR): optional Friends visibility and sharing, optional Private Activity backup, remote Social notifications, Focus Key product reminders, and marketing messages. You can withdraw consent in the relevant app setting or by contacting us. Withdrawal does not affect earlier lawful processing.
• Legitimate interests (Article 6(1)(f) GDPR): service security, fraud and abuse prevention, reliable delivery, diagnostics, moderation, protection of members, and establishment or defence of legal claims. We balance those interests against member rights and keep access restricted.
• Legal obligations (Article 6(1)(c) GDPR): responding to lawful requests, product-safety and consumer-law duties, and—after sales open—accounting and tax records.

Safety and moderation

You can hide content locally, block another account, and report a profile, profile photo, name or bio, Highlight, or comment. Reports contain the selected reason, optional details, the referenced content, timestamps, and the reporting account. They are accessible only to authorized safety roles when assigned, and the reported member is not shown who submitted the report. A reported profile photo may be temporarily replaced with initials while the private original is restricted for safety handling. Moderator actions and moderator-role changes are recorded in restricted audit logs. Reports, quarantined evidence, and audit records may be retained for a limited period after other social data is deleted where necessary to prevent abuse, document decisions, handle an appeal, or comply with law; the retention schedule is reviewed and documented internally.

See the Community Guidelines for the Friends rules and available safety actions.

Website and contact

Cloudflare hosts and protects the website and therefore processes network and request information such as IP address, requested URL (including an invitation token if it is placed in the query string), time, browser/HTTP metadata, and security signals. The website does not run advertising analytics. It stores only two first-party browser preferences—focuslatch.locale and focuslatch.locale-suggestion-dismissed—so it can remember your language choice and whether the language suggestion was dismissed. These preferences stay in your browser until you remove site data. For the current browser tab only, it also keeps whether you chose the simple view (focuslatch.lite) and where you were on the page (focuslatch.story.scroll, focuslatch.lite.scroll); the browser deletes these when you close the tab. None of this is sent to FocusLatch.

The mailbox [email protected] is hosted by Apple (iCloud Mail), which receives and stores the messages. Replies to [email protected] are forwarded to this mailbox by Cloudflare Email Routing. The support and feedback links in the app open an email to this mailbox. We use your address and message only to answer you. There is no launch list or newsletter. If one is offered later, it will need your separate consent, and every message will include a simple way to unsubscribe.

Online withdrawal

If you withdraw from a purchase with Withdraw from contract here, we store your name, address, email address, order number, order and delivery dates, the goods you name, and the date and time it arrived, with Supabase. Resend sends you the acknowledgement of receipt with these details, and a copy to [email protected]. Against misuse, the server function counts requests per IP address and per email address; for that it stores only short-lived, non-reversible check values, not the addresses themselves. Legal bases: performing the contract and the legal duty to confirm receipt (Art. 6(1)(b) and (c) GDPR), and legitimate interest for the misuse limit (Art. 6(1)(f) GDPR).

Beta via TestFlight

The app is currently available as a beta through Apple’s TestFlight. Apple provides us with crash reports and the feedback you choose to send through TestFlight, along with other tester information described in Apple’s TestFlight terms. We use this only to find and fix problems in the app.

Providers and recipients

Access is limited to people and providers that need the data for the purposes above:

• Supabase for authentication, database, private storage, and server functions;
• Resend for sending the account emails and the acknowledgement of an online withdrawal (recipient address, content, and delivery status);
• Cloudflare for website hosting, delivery, and security, and for forwarding email sent to [email protected];
• Apple for Sign in with Apple, App Store/TestFlight distribution, Screen Time frameworks, APNs when enabled, and iCloud Mail for the [email protected] mailbox;
• Google for optional Google Sign-In;
• Stripe only after paid checkout opens, for checkout and payment processing. FocusLatch will receive order and payment-status information but not full card numbers;
• Österreichische Post AG only after sales open, which receives your name, delivery address and the parcel details to deliver an order;
• professional advisers, authorities, courts, or safety bodies only where necessary or legally required.

Some providers are based in, or may use subprocessors in, countries outside the EEA. The transfer mechanism depends on the provider, processing location, and current arrangement; it may be an EU adequacy decision or another safeguard permitted by Chapter V GDPR. FocusLatch reviews these arrangements and will provide information about the mechanism applicable to a particular transfer on request. This policy does not claim that one transfer mechanism applies to every provider.

App selections

Apple's Family Controls framework provides app selections as privacy-preserving opaque tokens. FocusLatch never learns the names or identities of the apps you block.

Your FocusLatch Key

The factory ledger keeps the Key's serial and batch, a SHA-256 digest used to match the signed activation payload, its signing public key, production/status records, and limited lifecycle events needed for authenticity checks, ownership-conflict checks, traceability, product safety, and counterfeit investigation. The raw signed proof is not retained. The current V1 digest match is static and does not create a fresh cryptographic proof of physical possession. This ledger describes the physical product and is not deleted merely because an account is deleted.

A separate private activation record links that Key's serial and digest to each account that registers it. The same physical Key can be registered by more than one account after each account supplies the required physical proof. The normal in-app V1 release flow asks for a Key scan, but the backend release decision is bound to stored hash/digest records and does not independently prove fresh physical possession. Releasing a Key through that flow or deleting the account removes that account’s registration, while the non-account factory ledger remains. The consumer app reads and verifies the Key but does not provision it; the production signature is written before the Key reaches a user.

How long data is kept

• Account and account-owned records are kept while the account exists and removed through account deletion, subject to the limited exceptions below.
• Optional backed-up Activity records are removed when backup is disabled or the account is deleted. Turning a Friends sharing option off stops that sharing and restricts visibility; it does not by itself erase all stored Friends records. Use the separate shared-data deletion action or account deletion to remove the associated data, subject to the limited exceptions below.
• Invite capability links expire after 30 days. Push-delivery events expire no later than seven days; invalid device tokens are disabled.
• Up to eight unfinished emergency-unlock challenges may coexist and each expires after 15 minutes; an automated cleanup runs every five minutes, and a later challenge start also removes expired rows opportunistically. Receipts remain protected while their unfinished challenge is active. Once inactive, non-final receipts become eligible for deletion at 24 hours and are normally removed shortly afterward by that cleanup, which also limits them to the newest 256 per account. The lifetime allowance, up to five completed challenge records, and up to five successful debit receipts remain until account deletion.
• Reports, quarantined evidence, security logs, and moderation audit records are kept only as long as reasonably needed to investigate, handle an appeal, prevent repeated abuse, preserve audit integrity, or establish and defend legal claims.
• Support messages are kept until the request is complete, unless a longer period is needed for legal claims.
• After paid sales open, order, withdrawal, invoice, and payment-status records will be retained for the statutory accounting, tax, warranty, product-safety, and legal-claim periods. Full card data remains with Stripe.

Removing your data

You can change Session sharing and League separately under Settings → Privacy. If either remains enabled, the session information required for that feature can still synchronize. Settings → Privacy → Safety and shared data → Delete shared focus data removes your released focus data, including shared daily aggregates, session intervals and associated Highlights, and turns the related focus sharing off. You may edit or remove your profile photo, comments, reactions, friendships, challenge participation, and local hides through the relevant controls.

You can permanently delete your account in Settings → Account and backup → Delete account. This removes your authentication account, private Activity backup and account preferences, Key ownership claims, server-side profile, friendships, and shared daily focus totals, session intervals, group participation and associated social content, subject to the limited safety and legal retention described above. It does not erase the account-independent factory ledger for a physical Key. FocusLatch also removes that account's replaceable local history and preferences from the current iPhone. Deleting the app only removes locally stored data; it does not by itself delete the account. Screen Time authorization can be revoked at any time in iOS Settings.

Your choices and rights

Under the GDPR, you may request access, correction, deletion, restriction, and portability of your data; object to processing based on legitimate interests; and withdraw consent at any time. You may also complain to a supervisory authority. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria, [email protected]. Contact the controller below to exercise a right. We may need to verify that the request concerns your account.

Children and automated decisions

You must be at least 14 to use FocusLatch Friends; in Austria that is the age from which you can consent to the processing of your data yourself. FocusLatch does not make decisions that produce legal or similarly significant effects solely by automated means. Apple Sensitive Content Analysis may perform an optional on-device safety check before a selected profile photo is uploaded; a flagged photo is not uploaded, and account sanctions are not decided by that check.

Changes to this policy

The effective date above changes when this policy is updated. Material changes that affect an existing account will also be communicated in the app or by another appropriate direct notice before they take effect where required.