Privacy Policy

1. Who is responsible

Controller: Akram El-Kormany, Ocwirkgasse 11, 1210 Vienna, Austria.

A monitored privacy and support email address must still be added before publication. This policy covers the FocusMind mobile apps and focusmind.cloud.

2. Information we process and where it comes from

For email registration, FocusMind currently requires first and last name, email address, date of birth, gender, password and acknowledgement of the privacy notice. A password hash is stored instead of the readable password. The necessity and legal basis for mandatory date of birth and gender must be resolved before publication.

The service processes the planning content you create, including goals, identities, life areas, habits, tasks, priorities, calendar events, notes, reflections, labels, reminders, completion history and settings. Free text, mood, sickness, health-related habits or pause reasons may reveal sensitive information.

Optional social sign-in can provide an identifier, email address and basic profile information. Connection and authorization data needed for the selected provider may be stored.

• Religion preference, when selected, for quote personalization and relevant calendar features
• Google Calendar, Microsoft Outlook and ICS/webcal identifiers, event data, synchronization metadata and connection tokens when connected
• Installation identifier, platform, push token or subscription, notification content, due time, read/completion state and delivery diagnostics when notifications are used
• Session, language, appearance, time-zone, cache, offline queue and operational information needed to provide and secure the service

3. Location and connected calendars

If you choose Use location for prayer times, the device or browser supplies coordinates. The original coordinates are sent to the OpenStreetMap Foundation public Nominatim service to obtain a place name. Ordinary connection data such as the IP address is also received by that service.

FocusMind creates and stores a Prayer Webcal URL containing coordinates rounded to three decimal places, a place label and a time zone. The server sends that URL to prayerwebcal.dsultan.com to import prayer-time events. Rounded coordinates remain location data.

Turning off prayer-time display or revoking device location permission stops new access but does not by itself erase an already stored feed URL or imported events. Disconnect or account-deletion behavior and a specific erasure path must be verified before publication.

4. Purposes and legal bases

Account creation and the requested planning functions are processed to provide the service contract, limited to objectively necessary data. Optional calendar, location and religion-based features require an applicable consent basis; security, reliability and abuse prevention may rely on legitimate interests after the required balancing.

A privacy acknowledgement is not consent to every processing purpose. Optional consent can be refused without losing unrelated core features and can be withdrawn for future processing.

5. Sensitive information and choices

Religion and information revealing physical or mental health receive additional protection under the GDPR. The current general registration checkbox and religion dropdown do not establish the separate, explicit, purpose-specific consent flow described by the draft.

Before these features are released, FocusMind must implement an explicit consent and withdrawal process or remove/redesign the processing. Ordinary task and calendar use does not require sensitive free-text content.

6. Cookies and device storage

Authentication/session cookies and local browser or app storage keep you signed in, retain preferences, restore onboarding, run the Pomodoro timer, track notification state, cache planning data and queue some actions while offline. The configured authentication session can last up to 30 days and may be renewed through continued use.

Signing out clears the main account-data caches, offline queue and persisted profile/onboarding state on that installation. Some device preferences and notification or Pomodoro state may remain. The audited app contains no integrated advertising or third-party behavioral analytics SDK; production must be checked before that statement is published.

7. Recipients and international transfers

Depending on the features selected, recipients can include hosting, database, backup, email and support providers; Apple, Google, Meta/Facebook and Microsoft; OpenStreetMap Foundation/Nominatim; the Prayer Webcal operator; push-notification providers; and hosts of links, images or calendar feeds selected by the user.

The legal entities, processing locations, subprocessors, contracts and transfer safeguards actually used in production must be confirmed before publication. FocusMind does not sell personal planning data or share it for advertising.

8. Retention

Account, profile and planning content is kept while the account and data are needed for the service unless records are deleted earlier. Calendar connection data is retained while the connection is used; device storage follows the behavior described above.

Maximum periods for expired tokens, server and security logs, notification delivery records, support correspondence, consent evidence and backups still need to be defined and implemented. Expiry or cache freshness is not the same as deletion.

9. Account deletion and provider disconnection

To delete an account, open Profile → Settings → Account → Delete account, type DELETE and choose Delete permanently. Removing the app does not delete the server account, and deleting FocusMind does not delete an Apple, Google, Facebook or Microsoft account or the original provider calendar.

Google/Outlook disconnection removes the connection record and imported provider calendars/events. Revoking the provider grant is separate. Production deletion must still be verified across all records, active sessions, notifications, backups and deployed relationships; Sign in with Apple token revocation is not yet implemented.

10. Your rights

Where applicable, you may request access, correction, erasure, restriction and a portable copy of qualifying data; object to processing based on legitimate interests; and withdraw consent for future processing. Requests require a monitored privacy contact before publication.

You may complain to a competent data-protection authority. In Austria this is the Österreichische Datenschutzbehörde at dsb.gv.at.

11. Automated processing and security

The app calculates progress, streaks, routine points and reminders and personalizes some content using selected settings. It does not use these processes for solely automated decisions with legal or similarly significant effects.

Passwords are hashed, access is authenticated and connections are encrypted. Content is processed by the backend; FocusMind is not an end-to-end encrypted vault.

12. Children and young people

The intended age group, minimum account age and any parental authorization process must be decided and implemented before publication. A required birth-date field and an app-store age rating do not by themselves verify legal capacity or parental consent.

13. Changes to this policy

This policy will be updated when processing changes. Material changes require appropriate notice, and fresh consent is required before new processing that depends on consent. Changes cannot retroactively authorize previously undisclosed processing.