Privacy Policy

Who is responsible

Sheida Mohassesy. Contact details are on the Impressum.

To be completed: Postal address and contact details are added together with the Impressum.

What we collect

Account data: email address, display name, optionally an avatar and a timezone. Lawful basis: Art. 6(1)(b) GDPR — performing the contract.

Usage data: focus sessions (start, end, duration), tasks, XP, streaks, badges and crew memberships. This data is the service — without it there is no history and no crew.

No tracking. No analytics, no advertising cookies, no third-party trackers.

Cookies

One cookie: the authentication session. It is strictly necessary to keep you signed in, so it needs no consent and cannot be switched off.

A second, also strictly necessary, records your answer to the notice below it, so we do not ask again. Your theme, your chime preference and any running break are kept in your browser’s own storage and never sent to us.

The notice asks about one thing we do not do yet. There are no analytics and no third-party trackers on FocusCrew today. If we ever add anonymous usage counts, your answer is the gate they have to pass — asked before anything is loaded rather than after. You can change it any time under Settings → Privacy.

Processors

Supabase — database and authentication, EU region (Frankfurt, eu-central-1).

Vercel — hosting and serverless functions, executing in Frankfurt (fra1).

Resend — authentication email, EU region (Ireland, eu-west-1).

All three process data inside the EU, each under an Art. 28 GDPR data processing agreement.

Your rights

Access, rectification, erasure, restriction, portability and objection, plus the right to complain to a supervisory authority.

On erasure: your personal data — name, email, avatar, timezone and quiz answers — is irreversibly overwritten. Aggregate figures that belong to other crew members’ results remain in anonymised form; deleting them would silently change the numbers of people who did not ask for anything.

How long we keep it

Account data is kept while the account exists. After erasure only anonymised aggregates remain, with no link to a person.