Privacy Policy

Who is responsible

Siavash Ghanbari Hamzehkolaei, sole proprietorship, not entered in the commercial register
Helene-Jacobs-Straße 26, 14199 Berlin, Germany
Email: hello@focus-crew.com · Phone: +49 157 34589750

More in the Impressum.

What this covers

The FocusCrew website at focus-crew.com and the FocusCrew apps for iOS and Android. They are one service with one account, so everything below applies to all three.

Your account

Your email address, display name, password (stored only as a hash by our authentication provider), and optionally a profile picture, a timezone and your answers to the onboarding questions. Lawful basis: Art. 6(1)(b) GDPR — we need it to run your account.

Signing in with Google (optional): if you choose “Continue with Google”, Google tells us your email address, that Google has verified it, and an ID for your Google account — nothing else: no name, no picture, no contacts, no access to your Google data. We use them only to sign you in to the account with that address, or to create one. Google LLC (USA) is certified under the EU-U.S. Data Privacy Framework. You can remove FocusCrew’s access in your Google Account at any time and sign in with your email instead.

ADHD self-check result (only if you choose to save it): the self-check on our ADHD Toolbox runs in your browser and sends nothing. If you are signed in and tick the separate consent box under your result, we store your score, its band (few, some or many signs) and the date — never your answers. This is health information, so the lawful basis is your explicit consent, Art. 9(2)(a) GDPR. Only you can see it, it is not shared with anyone or used for anything else, and you can withdraw your consent at any time by deleting it in Settings → Focus Profile; it is also deleted with your account.

Sign-up check: to stop automated sign-ups, your browser or phone solves a small computing puzzle before the form is sent. It runs on your device; no third-party captcha service is involved and nothing about you is sent for it.

Minimum age: FocusCrew is for people aged 16 and over. It is not directed at children.

What you create, and who sees it

Your focus sessions, to-dos and their steps, notes, due dates and links, habits and their daily check-ins and notes, projects, labels, XP, streaks and badges. This is the service. Lawful basis: Art. 6(1)(b) GDPR.

Private by default. Your to-dos, notes and habits are visible only to you. If you share a project with people or with a private crew, everyone you share it with sees that project’s to-dos and can change them.

In a crew, the other members see that you are online or on a break, when you start a focus session, how many sessions and how much focus time you put in, and the crew’s standings — never the titles of your to-dos, unless they are in a project you shared with them.

Other members can see your display name, picture, level and badges on the leaderboards and on your profile page. If you leave a rating and we publish it, only your first name and the first letter of your last name are shown with it.

Messages, crews and moderation

You can write to the FocusCrew team from the app or the website, and we send announcements the same way. There are no private messages between members. Crew challenges, kudos and the reports you send to moderators about a crew or a member are stored too. Lawful basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR — our legitimate interest in keeping crews safe — for moderation and handling abuse.

Crew chat. Every crew has a chat. What you write there, with your display name and the time, can be read by the crew’s current members only — someone who leaves or is removed loses access straight away. You can delete your own messages, and the crew’s owner and moderators can remove any message in their crew; a deleted message leaves only “Message deleted” behind. There is no editing. To keep the chat calm, you can send up to ten messages a minute. If you report a message, the report keeps a copy of its text for our team, even if it is deleted later. Lawful basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for reports.

Notes. The notes you write in the Notes tool — their titles, text, folders and labels — are stored with your account and only you can read them. If you share a note, anyone with its link can read that note’s title and text, without signing in; not your other notes, its folder or its labels, and links in it to your to-dos show as plain words. Stopping sharing, or deleting the note, ends the link at once. You can also share a note with a FocusCrew member by their email address, or with a private crew you are in, to view or to edit: they then see its title and text and your display name, never its folder or labels, and the member is told in their notifications. Taking them off, their leaving the crew or the crew going public ends their access at once. Filing a note in a project shares it the same way, read-only, with everyone who can open that project, for as long as you can open it too; taking the project off the note ends it at once. A note you delete goes to Recently Deleted, where only you can see it, and is erased for good 30 days later (or at once, if you choose “Delete forever”); deleting it ends its link and its shares. Lawful basis: Art. 6(1)(b) GDPR.

Flashcards. Your decks, the cards you write or import (front, back, extra text, tags, and the note a card was made from), each card’s review schedule and the answers you give while studying are stored with your account. Only you can see them; they are never shared. A file you import is read and kept as cards; the file itself is not stored. They go when you delete a deck or your account.

Pictures

A profile picture (uploaded on the website) and crew pictures (uploaded on the website or in the app) are stored with our database provider in Frankfurt and shown to other members wherever your profile or the crew appears. The app asks for access to your photo library only when you choose a picture, and only reads the picture you pick. It never asks for the camera.

Push notifications

Optional. Your phone or browser asks you first, and you can turn them off any time in your device’s settings or under Settings → Notifications. If you allow them, we store a push token for your phone, or a push subscription for your browser, linked to your account.

They carry the things you would otherwise see in your notifications — kudos, crew activity and challenges, replies from the team — plus the end of a focus session and habit reminders. A break’s end is announced by the app itself, on the device.

Delivery: on phones through Expo’s push service (650 Industries, Inc., USA), which hands them to Apple Push Notification service on iOS and Google Firebase Cloud Messaging on Android; in a browser through the push service of your browser’s maker. Expo stores the push token, not the content of the notification. Lawful basis: Art. 6(1)(a) GDPR (your consent) and Art. 6(1)(b) GDPR.

Lock screen timer (iOS): the running timer on your lock screen is drawn by your phone from data that is already on it. Nothing extra is sent to us or to anyone else for it.

Kept on your device

The app keeps your sign-in in your phone’s secure storage (the iOS Keychain or the Android Keystore). A few preferences — like your board’s sort order or a running break — stay on the phone or in your browser’s own storage and are never sent to us. So does any music you add to the website yourself. When you export your habits as a CSV file, the file is created on your device and goes only where you send it.

Cookies and statistics

One cookie keeps you signed in on the website. It is strictly necessary, needs no consent and cannot be switched off. A second, also strictly necessary, records your answer to our cookie notice so we do not ask again.

Statistics without tracking. The website uses Vercel Web Analytics to count visits and a few events (for example, that a focus session started). It sets no cookie, stores nothing on your device, keeps no profile and cannot recognise you across days or across other websites; what we see are totals. Lawful basis: Art. 6(1)(f) GDPR — our legitimate interest in knowing which parts of the site are used. The apps send no analytics at all.

No advertising, no advertising cookies, no cross-site tracking, and we do not sell or share your data for advertising.

Newsletter

Only if you sign up for it, and only after you confirm your address. You can unsubscribe from any issue. Lawful basis: Art. 6(1)(a) GDPR.

Processors

Supabase — database, sign-in and picture storage, EU region (Frankfurt).

Vercel — website hosting, the server, and the visit statistics above; code runs in Frankfurt.

Resend — sign-in emails and the newsletter, EU region (Ireland).

Expo (650 Industries, Inc., USA) — delivering push notifications to the apps, with Apple and Google as its sub-processors for delivery.

ImprovMX and Google (Gmail) — email you send to hello@focus-crew.com is forwarded by ImprovMX and kept in our Gmail mailbox.

Stripe and its Link service (Stripe Technology Europe, Ltd., Ireland) — Pro and Max are sold through Link, which acts as the reseller and is responsible for the payment data it collects at checkout (name, billing address, payment details). Your card details go to Stripe directly and never reach us; we keep only your Stripe customer number, your plan and when it renews. Legal basis: the contract (Art. 6(1)(b) GDPR) and, for records tax law requires us to keep, Art. 6(1)(c). Stripe, Inc. in the USA may process this data; Stripe is certified under the EU-U.S. Data Privacy Framework and also uses the EU Standard Contractual Clauses. Link’s own privacy policy: link.com/privacy. If you cancel on the Verträge hier kündigen page, we use the name, email and plan you enter only to find and cancel the subscription and to confirm it by email; the confirmation is kept as long as the subscription’s records are.

Each works for us under a data processing agreement (Art. 28 GDPR).

Google Calendar, if you connect it

Connecting Google Calendar is optional, in Settings → Integrations. This section says exactly what FocusCrew does with Google user data — the data it gets from your Google account through Google’s APIs.

What we access

• Your Google account’s email address, to show which account is connected.
• One secondary calendar FocusCrew creates, called “FocusCrew”, and the events on it — FocusCrew can create, change and delete only this calendar and its events.
• The list of your calendars (name, colour and time zone), so you can pick which to show.
• Read-only: the events (title, start and end time, and their Google link) on the calendars you choose to show on the Plan calendar. FocusCrew cannot change or delete anything on your own calendars.

How we use it

• Your to-dos with a due date — title, notes, date, time and a link back to the to-do — are written as events on the FocusCrew calendar, and kept up to date.
• When you move or rename one of those events in Google, the new day, time or title is copied back to the to-do.
• Events from your chosen calendars are drawn on your Plan calendar while you look at it, so you can plan around them. When you choose “Add as to-do” on one, its title and date become a to-do of yours.

That is all. Google user data is not used for advertising, profiling, credit or lending decisions, or to train AI or machine-learning models, and it is never sold.

What we store, and who else handles it

We store which Google address is connected, the access Google gave us (its tokens), the ids of the FocusCrew calendar and of the calendars you chose to show, and for each synced to-do the id of its Google event. Events from your own calendars are read live and not stored; only one you add as a to-do is kept, as that to-do.

Google user data is not shared with anyone except the processors that run FocusCrew for us under data processing agreements: Supabase (our database, EU region, Frankfurt) and Vercel (our servers). No person at FocusCrew reads it, except with your permission to look into a problem you report, or where the law requires it.

How it is protected

Everything travels over HTTPS (TLS). Google’s tokens are encrypted in our database with AES-256-GCM using a key held only by our servers, and are used only by our servers — never sent to your browser or phone. The database is not reachable by other users, and our error logs record error codes, never calendar content.

How long we keep it, and deleting it

We keep the connection only while it is connected. Disconnect at any time in Settings → Integrations: we revoke our access at Google, delete the tokens, the calendar choices and the event ids at once, and — if you tick the box — remove the FocusCrew calendar from your Google account. You can also remove access at myaccount.google.com/permissions; FocusCrew then stops syncing and asks you to reconnect. Deleting your FocusCrew account disconnects and deletes all of this too. Your to-dos stay yours until you delete them.

Legal basis: the contract, because you asked for it (Art. 6(1)(b) GDPR). Your calendar itself is kept by Google (Google Ireland Ltd. and Google LLC, USA) under Google’s own terms.

FocusCrew’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data outside the EU

Push notifications to phones pass through Expo (USA) and then Apple or Google, and email to us is kept by Google. Expo and Google are certified under the EU-U.S. Data Privacy Framework, and their terms also include the EU Standard Contractual Clauses. Apple relies on the Standard Contractual Clauses; its contact in the EU is Apple Distribution International Ltd. in Ireland.

App stores

The apps are distributed through the Apple App Store and Google Play, which handle your download under their own privacy policies. We receive no personal data from them, only aggregated store statistics.

Subscribing in the iPhone app. Apple sells the subscription and charges your Apple ID; your payment details stay with Apple and never reach us. So that your plan works on every device, the app tells RevenueCat (RevenueCat, Inc., USA), our processor for in-app purchases, your FocusCrew account number together with the purchase record Apple gives the app (product, purchase and expiry dates, whether it renews, your store country) and your device’s IP address; RevenueCat checks it with Apple and tells us which plan you have. We keep the plan, the product, when it ends or renews and Apple’s transaction number. Legal basis: the contract (Art. 6(1)(b) GDPR). Transfers to the USA are covered by the EU Standard Contractual Clauses. RevenueCat’s privacy policy: revenuecat.com/privacy.

Deleting your account

In the app or on the website under Settings → Delete account, or by email to hello@focus-crew.com from your account’s address. Step by step on Delete your account.

Deleted: your name, email, picture, timezone and onboarding answers are overwritten for good, and your to-dos, notes (with their folders and share links), flashcard decks (with their cards and review history), habits, projects, labels, messages with the team, crew chat messages, comments on to-dos, favourites, notifications, ratings, bug reports, push tokens, newsletter subscription, a saved ADHD self-check result and anything sent from the contact form with your address are deleted. A Google Calendar connection is disconnected, its FocusCrew calendar removed from Google, and our copy of the access deleted.

Kept, without your name: your focus sessions, XP and crew history stay as part of your crews’ totals and challenges, linked to an anonymous placeholder that nobody can sign in to — deleting them would change the results of people who did not ask for anything. To-dos you added to someone else’s shared project stay in their project, and reports you sent to moderators stay for handling abuse.

Your rights

Access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and to withdraw a consent at any time with effect for the future. Send requests to hello@focus-crew.com. A copy of what you added — to-dos, projects, labels, habits, sessions, progress, crew chat messages and notes — is yours to download any time from Settings → Account → Download your data, as JSON, CSV and Markdown files in one zip.

You can also complain to a supervisory authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

How long we keep it

Your data is kept while your account exists, and handled as described under “Deleting your account” when you delete it.

A phone’s push token is removed when you sign out of the app and when you delete your account. A browser’s push subscription is removed when you turn notifications off there and when you delete your account — signing out of the website alone does not remove it.

An API key you make in Settings → Integrations (Pro and Max) is stored only as a one-way hash with the name you gave it and when it was last used; the key itself is shown to you once and never kept. Revoking it stops it at once, and deleting your account deletes every key. Requests made with a key are counted for rate limiting for a day or two and then discarded; we do not log their content.

When you sign in to FocusCrew from an app such as Claude or ChatGPT (OAuth), we keep a record of that consent: which app (its name and the address it identifies itself with), when you connected and when it last called, and one-way hashes of the tokens it holds — never the tokens themselves. The app acts as you, within your plan. Disconnecting it in Settings → Integrations → Connected apps stops it at once, and deleting your account deletes every such record.