Privacy Policy

• Account details: your email address and, if you give one, your name. Your password is handled by our authentication provider (Neon Auth), which stores only a hash of it; we never see or keep your password ourselves.
• What you track: the names of your tasks, and how many seconds you spent on each task each day. Only you can see them — every request is checked against your account.
• Verification emails: when you sign up we send a one-time code to your email address to confirm it belongs to you.
• Technical data: like any website, our hosting provider processes your IP address and browser details when you visit, in order to serve the site and keep it secure.
• Analytics, only if you allow it: which pages are viewed, plus your rough location (country/region), device type, browser and how you arrived. See “Cookies and storage” below.

To run the service — signing you in, saving your time, showing your history — to confirm your email, to keep the service secure and prevent abuse, and, if you allow analytics, to understand which parts of the site are used. We do not sell your data, and we do not use it for advertising.

Essential — set without asking, because the app can't work without them:

• Sign-in cookies (named __Secure-neon-auth…) keep you signed in. They are HttpOnly (page scripts can't read them), Secure, and SameSite=Lax.
• Running-timer entry (task-timer:running, in your browser's local storage) remembers which task is running so a refresh doesn't lose it.
• Resend timer (task-timer:otp-sent:…, session storage) stops a page reload from re-sending a verification email immediately.
• Your cookie choice (focus-sutra:analytics-consent, local storage) remembers what you picked in the banner.

Analytics — only if you choose “Allow analytics”: we load Vercel Web Analytics. It sets no cookies and stores nothing on your device; visitors are told apart by a hash of the request, discarded after 24 hours, and no personal identifiers are used to track you across sites. If you decline, it is never loaded. You can change your mind any time: in the app, under Profile → Analytics; signed out, with “Cookie settings” in the footer.

• Neon — hosts our database and our sign-in service (including sending the verification emails).
• Vercel — hosts the website and, if you allow it, provides analytics.

These providers process data on our behalf to deliver the service. We don't share your data with anyone else, except where the law requires it.

We keep your account and your tracked time for as long as you have an account. When you remove a task in the app, its recorded time is deliberately kept in your history and daily totals. If you want your account and everything attached to it deleted, ask us (see “Contact”) and we'll do it.

Depending on where you live (for example under the GDPR, UK GDPR or India's Digital Personal Data Protection Act), you may have the right to access the data we hold about you, correct it, have it deleted, get a copy of it, or object to how it's used. To use any of these, contact us.

The site is served over HTTPS, your password is stored only as a hash by our authentication provider, and your tasks are accessible only to your signed-in account. No system is perfectly secure, but we take reasonable steps to protect your data.

Focus Sutra isn't intended for children under 16, and we don't knowingly collect their data.

If we change this policy we'll update the date at the top. If a change is significant we'll tell you in the app.

Contact the person or organisation that operates this site, using the contact details they gave you.