Privacy Policy

Fokuzen is operated by Paul Pérez, an individual established in Uruguay, acting as the data controller. You can reach the controller at support@fokuzen.com for any question or request concerning your personal data. Processing is governed by Uruguayan Law No. 18.331 on the Protection of Personal Data, and — where you are located in the European Economic Area or the United Kingdom — by the GDPR and UK GDPR.

This policy covers the Fokuzen app (app.fokuzen.com), our website (www.fokuzen.com) and the beta survey (beta.fokuzen.com). Where something applies to only one of them, the text says so.

Fokuzen is currently in closed beta, available by invitation only and free of charge. Features, data structures, and this policy will change as the product develops. We will not silently reduce your privacy protections: material changes are announced by email before they take effect.

Account and identity

Your email address, display name, and profile photo, taken from your sign-in provider when you create an account. If you joined through the waitlist or answered the beta survey before signing up, we also hold the email address you gave us there, the answers you submitted and, for the survey, your browser's user-agent string. To rate-limit abuse of those public forms we also keep a hash of your IP address — not the address itself — for 24 hours.

Content you create

Everything you put into the product: tasks and their content, due dates, priority, subtasks, tags and projects; notes; calendar events; and the notifications pulled in from the integrations you connect. We also generate and store vector embeddings of your task content so the AI engine can find related work. Notifications from GitHub, Slack, and Gmail carry the name and avatar of whoever triggered the event, because that is what makes a notification legible at a glance. Those people are not our users: we store what the provider sends and nothing more, never enrich it, and build no profile of them. Jira is the exception and carries no identity at all — we record the integration itself as the author, keep no avatar, and strip Atlassian account references out of the text, so a change of assignee reads as "Issue assignee changed" rather than as a name.

How you use the product

Focus session events (duration, task worked on, outcome), in-app usage events (task created, focus started, notification dismissed, and similar), the daily and weekly metrics our engine derives from them (focus score, completion rate), and the attention profile the engine builds to model when and how you work best.

Notification signals and blocked senders

Two optional notification features keep a small record about Gmail senders. If you turn on "Learn from dismissals", we keep for each sender how many of their notifications you dismissed and how many you turned into a task, plus when the latest one happened. The sender is identified by a one-way digest of their email address, never by the address itself. The record covers a limited number of senders: a sender's counters are pruned 90 days after its latest activity, and when the limit is reached the least recently active sender is dropped first. When the AI judges a new email from a sender with such a record, we may include how many of their notifications you dismissed and how many you turned into a task. These counters describe your own behavior, not the sender, and are not a profile of that person. If you block a sender, we keep the email address you chose to block so that their emails stop reaching your notifications, until you unblock it or delete your account.

Technical and diagnostic data

Error and crash reports including stack traces, the route you were on, a per-tab session identifier, and a correlation identifier. Authorization headers are stripped before an error report leaves your browser. We also keep audit log entries for sensitive operations — account deletion, connecting or disconnecting an integration, entitlement changes, resetting your AI memory — recording your user identifier and what happened, not the content involved.

Integration credentials

OAuth access and refresh tokens for each service you connect (GitHub, Gmail, Google Calendar, Slack, Jira). These are encrypted with Google Cloud KMS before being written to the database and are never exposed to the browser. Stored alongside each token, unencrypted, are the identifiers each provider needs us to keep in order to sync: your GitHub login, the Google address of the connected mailbox, your Slack user and workspace identifiers, and the cloud ID and URL of your Jira site. We also keep a record of the webhooks we register on your behalf so we can remove them again. Your Atlassian account ID is deliberately not among them — we look it up when an event arrives and hold it only in memory, so that nothing identifying you inside Jira is written to our database. Disconnecting an integration deletes its tokens and these identifiers together. We never ask for, receive, or store the password of any connected service.

What we do not collect

We do not collect payment or card data — there is no paid plan during the beta and no payment processor is connected. We do not record your screen or session, we do not use advertising or cross-site tracking technologies, and we do not buy data about you from third parties. From Jira specifically we collect no identities at all: no Atlassian account identifier, name, or avatar — neither yours nor that of any colleague appearing in your issues — is written to our database.

If you are in the EEA or the UK, the GDPR requires us to have a legal basis for each purpose. This is ours:

Retention periods marked "until account deletion" mean the data is removed when you delete your account, as described under "Deleting your data" below. Periods that end in automatic deletion are enforced by database time-to-live (TTL) policies, which run in the background and usually complete within a day of the stated period.

We do not sell your personal data, and we do not use it for advertising. We share it only with the service providers needed to run Fokuzen, each acting as a processor under contract with us:

Beyond the processors above, the integration providers you choose to connect — GitHub, Gmail, Google Calendar, Slack, and Jira — receive requests from us only after you have explicitly authorized that integration, and only within the OAuth scopes it needs. Each of them handles your data under its own privacy policy, not this one.

When you use an AI feature — task breakdown, rewriting, prioritization, daily briefs, notification triage, suggestions — the relevant task or notification content is sent from our servers to the Google Gemini API (models gemini-2.5-flash and gemini-2.5-flash-lite) to produce the output. Task content is also sent to Google's text-embedding-004 model to generate embeddings. Under Google's Gemini API terms, this content is not used to train Google's models. Requests are made server-side; your browser never talks to the AI provider directly.

AI-generated suggestions are deleted automatically after 14 days. Only your current daily brief is kept: generating a new one deletes the previous ones, and the current one expires at the end of the following day. You can disable AI features entirely under Settings → Daily brief & AI, and you can reset the profile the engine has built about you under Settings → Account & billing: resetting deletes that profile, and the engine disregards everything it observed before the reset.

Google is our only AI provider today. Our system is built so that a different provider could be configured in the future; if we ever route your content to a provider outside the Google Cloud stack, we will update this policy and notify you by email before doing so.

Fokuzen's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely: data obtained from Gmail and Google Calendar is used only to provide and improve the user-facing features you connected them for; it is never transferred to others except as needed to provide those features, for security purposes, or to comply with applicable law; it is never used for advertising; and no human reads it except with your explicit consent, to resolve a specific support issue you raised, or where required by law. Gmail and Google Calendar data is never used to train generalized AI or machine-learning models.

We use two categories of browser storage. Strictly necessary storage keeps you signed in, remembers your theme, accent color, language, and sidebar state, and holds the per-tab session identifier used to correlate error reports. This category cannot be switched off, because without it the product does not work; it does not require your consent.

Strictly necessary storage also includes a cookie that is not ours. app.fokuzen.com, our website and the beta survey are served through Cloudflare, which may set a bot-management cookie called __cf_bm in your browser to tell people from automated traffic and protect the service from abuse. It is a security cookie: it expires after 30 minutes of inactivity, its contents are encrypted and only Cloudflare can read them, and Cloudflare does not use it to track you from site to site or for advertising. Like the rest of this category, it does not require your consent. If Cloudflare asks you to complete a verification challenge, it may set a similar security cookie to remember that you passed.

Analytics storage is set by PostHog to recognise your browser across visits. This category is optional and is off until you accept it. Nothing is written and no analytics request is sent before you consent. In the app, you can accept or refuse from the banner shown on your first visit, and change your mind at any time under Settings → Privacy — withdrawing consent is exactly as easy as giving it, and it takes effect right away: PostHog stops capturing and clears the identifiers it keeps in your browser.

In the app, analytics requests are routed through app.fokuzen.com/ingest rather than going to PostHog's domain directly. This is a reverse proxy: it improves reliability, but it does not change who ultimately receives the data, which is stated in the processors table above. It does mean that, in the app, PostHog never receives your IP address: the proxy forwards only the analytics payload, not the connection details or cookies of your request, so the sender PostHog sees is our server, not you.

Our website (www.fokuzen.com) asks for analytics consent separately, with its own banner, and follows the same rules: nothing is written and no analytics request is sent until you accept, the "Cookie preferences" link at the bottom of every page lets you change your mind at any time, and its only strictly necessary storage remembers that choice. There, PostHog receives only page views — the page address (URL) and title, the page you came from, how long you stayed and how far you scrolled — with your browser's user-agent string, screen size, language and time zone, and the identifiers it keeps in your browser. There is no account identifier, and the features our code switches off in the app are switched off on the website too. Unlike the app, the website sends these requests directly to PostHog, so PostHog receives your IP address with each request; our PostHog project is set to discard it, so it is not stored. The beta survey (beta.fokuzen.com) uses no analytics; its form is protected by reCAPTCHA (see the processors table).

Fonts are served from our own domain. They are downloaded when we build the product and delivered with the rest of its files, so opening Fokuzen sends no request to Google Fonts or to any other font provider.

We want to be exact about identifiers, because "anonymous analytics" is a claim that is almost never true. Product analytics events are linked to your Firebase user identifier, which is a pseudonym: it is not your name or email, but we can link it back to you, so under the GDPR it is personal data. We also attach your subscription tier and the names of the integrations you have connected. We do not send your email address, your task content, or your notes to any analytics provider.

Exactly what PostHog receives once you have accepted analytics storage: your pseudonymous account identifier, plus an identifier PostHog keeps in your browser and a session identifier; your subscription tier and the names of the integrations you have connected; the events the app reports — for example creating or completing a task, starting a focus session, dismissing a notification or connecting an integration — each carrying only the kind of action, a count or a category and, when you complete a task, that task's opaque identifier, never its content; a page view for every page you open, with its address (URL) and title, the page you came from, how long you stayed and how far you scrolled; on every event, your browser's user-agent string (which reveals browser, operating system and device type), screen size, language and time zone; and uncaught browser errors, with the error message and technical stack trace.

What PostHog does not receive, because our code switches it off rather than leaving it to the provider's settings: session recordings or screenshots (session recording is disabled); the text and links of what you click (automatic click capture is disabled, and so are heatmaps, dead-click detection, in-app surveys and performance metrics); anything you type; your email address; the content of your tasks, notes and messages; and your IP address, which in the app our proxy does not pass on (on our website PostHog receives it with each request and discards it).

Error monitoring runs through Sentry. Error reports carry the same pseudonymous user identifier, the route you were on, and the stack trace; in production we also sample 10% of page loads for performance tracing. We rely on our legitimate interest in keeping the service secure and working for this, rather than consent, because it is not tracking and cannot be used to profile you — but you can object at any time by writing to us. In the app, PostHog additionally captures uncaught browser exceptions, and that part only runs if you accepted analytics storage.

All traffic is encrypted in transit with TLS, and data is encrypted at rest by Google Cloud. Integration OAuth tokens are additionally encrypted with Google Cloud KMS before being stored, so a database read alone does not expose them. Database access rules scope every read and write to the owning account. Requests to our backend are attested with Firebase App Check, and public forms are protected by reCAPTCHA and rate limiting. No system is perfectly secure; if a breach affects your personal data and is likely to result in a risk to your rights, we will notify you and the competent authority within the deadlines the law sets.

A small number of administrator accounts can, using administrative tooling, list users by email address and inspect the AI-generated profile and preferences the engine has built for a user. This exists to diagnose whether the engine is modelling people correctly and to answer support requests. It is read-only, it is restricted to accounts holding an administrator claim, and it does not extend to reading the content of your tasks, notes, or emails.

Fokuzen's infrastructure runs on Google Cloud in the United States, and the processors listed above are established in the United States unless stated otherwise. If you are in the EEA or the UK, this means your personal data is transferred outside your region. Those transfers rely on the Standard Contractual Clauses adopted by the European Commission, which are part of our agreements with each processor. The controller itself is established in Uruguay, a country the European Commission has recognised as providing an adequate level of protection, so transfers to us require no additional safeguard.

We are working on appointing a representative in the European Union under Article 27 GDPR. Until that is in place, EEA and UK users can exercise every right described below by writing to support@fokuzen.com, and we will respond within the statutory deadline.

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider in a portable format. Where we rely on your consent — analytics storage, the waitlist, the beta survey — you can withdraw it at any time, without affecting what we did lawfully before you withdrew it. Some of these you can do yourself, immediately: download a copy of your data under Settings → Account & billing → Export my data, delete your account under Settings → Account & billing, disconnect an integration on the Integrations page, turn AI features off under Settings → Daily brief & AI, object to your decisions on notifications being added to the anonymous filter dataset, with "Use my decisions to improve the filter" under Settings → Privacy, and accept or refuse analytics under Settings → Privacy.

You can download a copy of your data yourself, at any time, as a machine-readable JSON file: Settings → Account & billing → Export my data. It contains everything we store about you except credentials: for each integration it says that it is connected and since when, never its access tokens. It does not contain the anonymous notification-relevance labels, because nothing in them says they are yours. For anything else — a correction, an objection — or if the export does not work for you, write to support@fokuzen.com and we will send you the copy. Every right described above applies on every plan, free or paid, and we answer within 30 days without charging for it. We do not make automated decisions that produce legal effects about you: the AI ranks and suggests, it does not decide anything binding.

If you think we have handled your data badly, we would rather you told us first — but you have the right to go straight to a supervisory authority. In Uruguay that is the Unidad Reguladora y de Control de Datos Personales (URCDP). In the EEA or the UK it is the authority for your country of residence.

Deleting your account under Settings → Account & billing triggers an immediate cascade. It removes your profile and every subcollection under it — tasks, notes, projects, calendar events, notifications, focus and usage events, aggregates, attention profile, AI suggestions and briefs, embeddings, entitlements and credits — plus your encrypted OAuth tokens, the feedback you submitted, and any waitlist, invite, or survey record keyed to your sign-in email. Where a Google integration is connected, we also ask Google to revoke our refresh token. Your Firebase authentication record is deleted last. This normally completes in seconds.

What deletion does not reach

We would rather state the limits than overpromise. Deletion runs step by step and tolerates a partial failure so that one stuck step cannot leave your account half-deleted — if any step fails it is logged and we finish the rest, and you can write to us to have the remainder removed by hand. Copies already held by our processors follow their own retention: analytics and error-monitoring records expire on the schedule in the retention table, and we will pass on a deletion request to them if you ask. Audit log entries containing your user identifier persist in Google Cloud Logging for 30 days, because we need them to investigate security incidents. Our database backups also still hold what you deleted until they expire, which takes up to 98 days; they are used only to recover from a disaster, and a restore is never put into live use without your deletion being applied again. Anonymous notification-relevance records carry no identifier and cannot be linked to your account, so they are not deleted with it; they expire automatically after 18 months. Aggregated beta-funnel snapshots contain only counts, hold no identifier of any kind, and cannot be linked back to you, so they are not deleted.

Fokuzen is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has created an account, write to support@fokuzen.com and we will delete it.

We will update this policy as the product grows — in particular when paid plans launch, which will add a payment processor and billing records with their own retention. Material changes are announced by email and by updating the date at the top of this page. If a change requires your consent, we will ask for it before it takes effect rather than assume it.

Questions or requests about your data go to support@fokuzen.com. Fokuzen is operated by Paul Pérez, Uruguay.