Privacy policy

• DaintyFocus works without an account. Without one, everything stays on your device.
• No ads and no trackers, in the app or on this website.
• If you sign in, we store your email address, your presets and your session history so your devices can share them.
• The app sends usage counts (how often a few things happen, with nothing that identifies you) and crash reports. You can turn either off at any time.
• You can delete your account, and everything we store with it, from the app at any time.

DaintyFocus is made by Daintymindz, the data controller for the personal data described here. We follow the Nigeria Data Protection Act 2023 (NDPA). For anything about your data, write to hello@daintymindz.com.

The app keeps your presets, schedules, session history and settings in a database on your phone. Your sign-in tokens, if you sign in, are kept in the phone's secure storage. None of this leaves the phone unless you sign in. Apart from that, the app sends only usage counts and crash reports, which you can turn off.

The app asks for permission to show notifications, to set alarms on time and, if you choose, to silence the phone during focus. These are used on the phone only.

Deleting the app, or using You › Privacy › Delete everything on this phone, removes it.

Signing in is optional. It backs up your work and lets your other devices use it. We store:

• your email address, and, if you sign in with Google, the account number Google gives us for you (not your Google name or photo);
• a display name, only if you set one. It is shown as the author of presets you publish, and to the people in your study rooms;
• your age band (under 13, 13 to 17, or 18 and over), if you give it;
• your presets, their earlier versions, and your session history (when you ran which preset, and its pauses and skips);
• the devices you signed in on, with their type (Android, iOS or web) and when each was last used;
• sign-in tokens, stored only as hashes, which expire after 60 days without use;
• if you add a passkey, its public key and id, the name we give it, whether your password manager backs it up, and when it was added and last used. The passkey itself, and the fingerprint or face that unlocks it, never leave your device or password manager;
• sign-in links we email you, stored only as hashes, with the address they were sent to and the IP address that asked for them. We use the IP address only to limit how many links one place can request. These records are deleted after a day.
• API tokens and webhooks, only if you make them: a token is stored only as a hash, with its name and when it was last used; a webhook is the address you gave, the events it hears about and its secret. When a webhook is called, we send that address what the event says (for example which period of which preset just started) and keep a record of each delivery for a week.
• if you connect Google Calendar or Outlook: the key it gives us (encrypted), the DaintyFocus calendar we made there and the events we wrote to it, and when you are busy in your own calendar for the next two weeks (when, never what). Disconnecting deletes them.
• if you connect Todoist, Google Tasks or Microsoft To Do: the keys that app gives us (encrypted), which of its lists go with which preset, which task there is which task here, and when we last synced. Disconnecting deletes them.
• the groups you run or joined, and whether, and since when, you count your sessions in each one's totals.

When you delete a preset or a session, we keep a marker for it so that your other devices learn of the delete. Deleting your account removes these too.

If you publish a preset, its name, its contents and your display name (if you set one) appear on a public page that anyone can see and copy, and that search engines may list. Unpublish it, or delete it, to take the page down. A preset shared by link is different: the preset is inside the link itself and is never sent to us.

If you make or join a study room, we store which rooms you are in, when you last had each one open and whether you were focusing then. The others in a room see your display name and whether you are here and focusing, nothing else about you. Rooms have no chat. A room's name and its preset (without its labels) are seen only by the people in it. If you report a room's name or someone's display name, we keep the report and the words reported until we have looked at it; nobody in the room is told. Rooms are for people aged 13 and over, and a room only takes people in its maker's age group, except a group's room, which takes only the group's members and whoever runs it, whatever their age group. A room nobody opens for two weeks is deleted.

If you join a group, such as a class or a team, whoever runs it sees the display name you chose, or none, and never your email address, your own presets, your history or whether you ran the group's presets. The group's presets and schedules reach your devices through sync, and go when you leave the group.

If you turn on Count my sessions in group totals, your sessions and planned times from then on are added up with those of the other members who did, and whoever runs the group sees, week by week, how many ran each preset, the focus time and how many sessions started on time. They never see who counts, or one member's figures, and any figure from fewer than 5 members is hidden. Nothing about the totals is stored: they are worked out when they look. Turning it off takes you out of every week, past ones too.

Our server writes one line for each request: the method, the address on our server (without any query), the result, how long it took and a random request id. We never log request bodies, tokens or email addresses. If the server hits an error, a report of it goes to Sentry (see below), without personal data.

When the app crashes, it sends the error, where in the code it happened, the app version and basic facts about the device (such as its model and system version) to Sentry. It never sends your presets, history, account details, screenshots or what was on screen. Turn this off at any time in You › Privacy › Send crash reports.

To learn which parts of DaintyFocus are used, the app and this website send us counts. You can turn them off at any time: in the app in You › Privacy › Send usage counts, and for this website with the switch below.

When they are on, once a day at most, we receive:

• how many times, on each day, you opened the app or the timer page, started a session, finished one, made a preset, used each template, and used schedules, tasks, exam plans or recaps;
• the app or website version, and whether it is Android, iOS or the web.

That is all. No account, email address, device id, IP address, location, presets, history or anything you typed. Signed in or not, the counts are the same and are not linked to your account. Our server adds them to totals per day, so nobody can tell whose counts they were. It looks at the IP address only to stop one place sending too many requests, in memory and never stored. If sending fails twice, those counts are thrown away; turning counts off throws away any not yet sent.

The website sets one cookie, and only if you pick a language: it remembers which one. It loads no third-party scripts, ads or trackers. It keeps, in your browser only:

• the theme you picked, if you picked one;
• the timer you are running, so a reload does not lose it;
• your sign-in token, if you sign in on this website;
• whether you turned off usage counts, and counts waiting to be sent.

Clearing this site's data in your browser removes them.

We use a few services to run DaintyFocus. Each gets only what it needs to do its job:

• Railway hosts our server and database.
• Resend sends the sign-in emails, so it receives your email address and the link.
• Google, if you choose to sign in with Google, confirms who you are and tells us your email address.
• Sentry receives crash reports from the app, and error reports from our server.
• Anthropic (the Claude AI) answers the optional AI help for signed-in people, and only when you tap its button: it receives the description you typed, the syllabus you pasted with the days to your exam, or your focus numbers for the last few weeks. Never your name or email address.
• Google and Microsoft, only if you connect Google Calendar or Outlook: they receive your planned sessions (the time and the preset's name) in the DaintyFocus calendar, and tell us when you are busy, never what.
• Todoist, Google Tasks and Microsoft To Do, only if you connect one and link a list: they receive the titles of your tasks on the linked presets and whether each is done, and send us the tasks in that list. If you lock your task titles, nothing goes to them.
• Firebase App Distribution (Google) delivers test versions of the app to people who agreed to test them, and so receives testers' email addresses. It is not part of the released app.

Some of these services store data outside Nigeria. Where they do, we rely on the safeguards the NDPA allows for such transfers. We do not sell your data, and we do not share it with anyone else unless the law requires it.

• To provide the account you asked for: backup, sync, sign-in and publishing (the NDPA basis is our contract with you).
• To keep the service safe, for example limiting sign-in requests and keeping logs (our legitimate interest).
• To fix crashes (our legitimate interest in an app that works; you can turn crash reports off).
• To learn which parts of DaintyFocus are used (our legitimate interest in improving it; the counts identify no one, and you can turn them off).
• To show whoever runs a group its totals, only from members who turn it on (your consent, which you can withdraw).

You must be 13 or older to make an account. We refuse sign-up for anyone who says they are under 13, until we have a way for a parent or guardian to give permission. The app works fully without an account at any age. If you believe a child under 13 has an account, write to hello@daintymindz.com and we will delete it.

We keep your account data until you delete your account. Sign-in links go after a day, and sign-in tokens soon after they expire or are ended. Copies may remain in our database backups until those backups expire.

Under the NDPA you can:

• ask for a copy of the personal data we hold about you;
• have it corrected or deleted;
• object to how we use it, or withdraw consent you gave;
• ask for it in a form you can take elsewhere.

To delete everything at once, use Account › Delete my account in the app. Your presets, history, devices, sign-ins and published pages are erased from our database straight away; what is on your phone stays. For anything else, write to hello@daintymindz.com. If you are not happy with our answer, you can complain to the Nigeria Data Protection Commission.

Everything between the app, the website and our server travels encrypted. Sign-in links and tokens are stored only as hashes, and each person's data can be read only with their own sign-in.

When this policy changes, we will update the date at the top, and tell you in the app if the change matters.