Privacy

Last updated: October 25, 2026

The short version: your focus data lives on your device. Signing in is optional. If you do, your email and tracker data are stored in the EU so they can sync across your devices, and we may now and then email you one question about how the app is working for you. We count a small set of anonymous, cookieless product events, every one of them named below. Focushours has no ads, cookies or profiles. Its sync and analytics requests go to exactly two remote origins, both named on this page. The app footer also has an optional Support link that opens Ko-fi only if you choose it; no Ko-fi code is embedded in Focushours, and we do not record support-link clicks or send tracker data to Ko-fi. You can delete everything yourself, instantly, from inside the app.

What is stored, and where

On your device (always): everything you put into the tracker (hours, targets, category names, archived weeks), plus small preferences like theme and language. It lives in your browser's local storage and never leaves your device unless you sign in.

Two things worth knowing about that, because "on your device" is not the same as "safe forever". On iPhone and iPad, Safari deletes a site's storage when the site goes unvisited for a while, and adding Focushours to the Home Screen gives it a separate storage box: the installed app opens empty, and the hours you already had are still in Safari rather than gone. Signing in is the only thing that makes both show the same weeks. Clearing your browser data removes local hours everywhere, on every platform, and we cannot recover them for you unless you were signed in.
On our servers (only if you sign in): your email address and the same tracker data, so it can follow you across devices. It is stored in a Supabase database hosted in Frankfurt, Germany (EU). Access is locked to your account by row-level security, so each account can only ever read and write its own rows. For timer sessions that data includes when each one ended and how long it ran, which is what the "When in the day" view draws. When one of your weeks changes or is deleted there, the database keeps its previous version for 30 days, so a sync mistake can be undone; no other account can read it, and after 30 days it is removed.

We may also use that email address, rarely, to ask how Focushours is working for you: one plain question from a focushours.app address, sent through Proton Mail (Switzerland), which only delivers it. Never marketing, never sold or shared for anything else, and replying "stop" is enough to never get another one.

Three features ask your operating system for something, and none sends anything anywhere: a system notification when a session or break ends (off by default, and only after you grant permission), a count on the app icon when the app is installed, and keeping the screen on while a session runs (off by default, a switch in the menu, shown only where your browser supports it). All three are handled by your device from data already in your browser.

Signing in

You can use Focushours forever without an account. If you want sync, you can sign in with Google (Google shares your email address and basic profile with us) or with a magic link sent to your email. We never see or store a password. The magic link is sent through Resend, an email delivery service, from its EU region; it receives your email address and the link only to deliver them.

Optional support

The app footer contains one plain link to Ko-fi. It opens in a new tab only after you choose it, and the link does not send the Focushours page as a referrer. No Ko-fi widget or checkout code loads in the app. We do not record that you clicked the link, share your Focushours account identity with Ko-fi, or send your study hours or categories there. If you visit Ko-fi or leave a tip, Ko-fi and its payment provider handle the visit and payment information under their own privacy terms. Support does not unlock app features.

Analytics, ads, and trackers

We use PostHog, hosted in the EU, in cookieless mode, to answer one question: is the product working? Concretely that means page views, the moment a page is left, and the product events below. Every event is named here with everything the app adds to it in parentheses; if it is not on this list, the app does not send it. The analytics library also attaches a standard set of technical facts to every event: the browser and the operating system with their versions, the device type (desktop, mobile or tablet), the page address and the referring page without any query or fragment, a placeholder identifier that is the same for everyone, timing values, the page title, and the library's own version and settings. It does not send your screen or window size, your timezone or your browser language: the app removes those before anything is sent. It does send the full browser identification string, because PostHog needs it for the one-day identifier described next, and PostHog deletes it once that identifier is made. The one language fact the app itself sends is on the opened-event line below: which language your browser asks for first, only when it is one the app does not have. On its own servers, PostHog replaces the placeholder with an anonymous identifier for one calendar day, worked out from the IP address your connection comes from, the browser identification string, this site's address and a random value that changes every day. The random value is deleted when its day is over, so the identifier cannot be traced back to you or linked to any other day, and it is never linked to your email or account. It lets one visit be counted as one visit, and the front page and the app be followed within that day. PostHog does not keep the IP address your connection comes from, and since October 10, 2026 it derives no location from it either: that lookup is switched off, and every event and page event also carries a flag that tells PostHog to skip it. To send none of it, turn on Send no analytics in the app's menu. It covers this browser, both the app and the front page, from that moment on. The switch itself sends nothing, and it is kept only in this browser.

the app was opened (whether this browser profile is new, already has hours logged, or has sync set up: a yes or no, never which account; whether it runs installed or in a browser tab; the app language; which tab it opened on; which timer style is selected; which language your browser asks for first, as a bare two-letter code and never a country, only when it is one the app does not have, so that the next language added is one people arrive in, and nothing about it when the app has your language; and on how many distinct days this browser profile has logged hours, as one of five bands: none, 1 to 2, 3 to 6, 7 to 20, or more than 20, never the number itself and never the hours),
a signup happened,
a first session was logged,
a focus session finished (countdown or stopwatch, and whether it ran out by itself or was finished by hand),
a session ended without logging anything (countdown or stopwatch, and why: cancelled, too short, its category had been deleted, or the tab had been abandoned too long),
a session was started from a link, like an app shortcut (the minutes in the link, and whether the link was honored),
a rest break was started (the length picked),
a week was completed (by the calendar turning over; older versions also had an End week button),
a completed week was reopened,
a focus session was started (countdown or stopwatch, and for a countdown its length as one of three bands: 25 minutes or less, 26 to 60 minutes, or more than 60, or, when it was started from the timer card, that the length was typed in by hand),
a focus session ended (completed, stopped early, or abandoned: closed with its X, its category deleted, or left running too long),
a day's hours went up (whether by a timer, by setting the number in the hours box, or by adding an amount such as +15 to it; no event states how many hours, and none says which day),
a target was set (by the first-run quick start, by hand, or from the suggested targets; never the amount),
a tab was opened with a click or a key (which tab: Hours, Logs, Trends or History, sent as its internal name focus, logs, trends or history),
a day was marked off, or back on (which of the two; never which day),
the example week was opened,
the example week was left (how many seconds it was open, and whether anything in it was changed). The example week is sample data held in memory only: it is never saved, never synced, and nothing you do inside it is recorded beyond those two facts.
the app was opened for the first time that day, that week or that month by this browser profile (which of the three, and how many such days, weeks or months ago this browser profile was first seen, as one of four bands: this one, the one before, 2 to 3, or 4 or more; never a date, never an identifier). This is how the number of browser profiles using the app in a week or a month is counted without an identifier: the app keeps the last day, week and month it sent this on your device, described below, and sends each once,
hours were logged for the first time that day, that week or that month by this browser profile (the same two facts, kept and sent the same way).

One more thing rides on every app event, and only when you arrived through a link that carries it: the utm_source, utm_medium and utm_campaign tags in that link, so a flyer or a post can be told apart from the rest. They describe the link, never you, and they are the same three the front page keeps. Every other link tag (utm_content, utm_term and advertising click ids) is removed before anything is sent.

Five facts also ride on every app event, page views and page leaves included, and are sent again when one changes during the visit: whether the app runs installed or in a browser tab (installed), the app language (lang), whether you are signed in at that moment (signed_in), whether any target is set this week (has_target), and how many archived weeks this browser profile holds, including weeks synced from your other devices when you are signed in, as one of four bands: none, 1, 2 to 4, or 5 or more, never the number (device_weeks_bucket). Each is a yes or no, the app language, or a band, never which account. signed_in exists only so that the numbers about people who use the app without an account can leave account holders out; it is never used to find anyone.

These events are anonymous: no cookies, no identifier that lasts beyond one day, never linked to your email or account, and your tracker contents (hours, categories) are never sent. Every event does carry the time it was sent, so when a focus session starts and ends during one visit, its length can be worked out from those two times, although no event states it.

Two notes are kept on your device so that three of the events above are sent once and not again: that a first session has been logged, and the last day, week and month this browser profile was counted as opening the app and as logging hours, with the date it was first counted. They are dates, the same for everyone counted that day; they are never sent, they identify nobody, and clearing the site's data removes them. Nothing else is stored on your device for analytics.

The front page at focushours.app (the marketing page, not the tracker) uses the same PostHog setup for two page events of its own: the page was viewed, and a start button was clicked (and which of the two buttons it was). Same guarantees: anonymous, cookieless, the same one-day identifier described above, so arriving here and then opening the app counts as one visit, and nothing about you attached. Each of the two does carry two facts about the link you arrived through, so I can tell which announcement brought people: the origin of the referring site (only the domain, never the page you were on), and any utm_source, utm_medium or utm_campaign tag present in the link itself. Those describe the link, not you.

No ad networks, no cookies, and no data sale. The app's security configuration (its Content-Security-Policy) instructs your browser to refuse app connections to anything except this site itself and exactly two remote request origins, our database and PostHog's EU endpoint, both named on this page. The optional Ko-fi link is a separate, user-chosen navigation described above; the app does not fetch or embed Ko-fi code. You can verify the app connection rules in your browser's developer tools.

Cookies

We set no cookies, not even for analytics. If you sign in, your session is kept in your browser's local storage, on your device.

Service logs

Our infrastructure provider (Supabase) keeps standard, time-limited security logs of authentication events, like sign-in attempts and the IP address they came from. These exist to keep the service safe and expire automatically.

Deleting your data

Inside the app: account menu → Danger zone → Delete account. That removes your account and every piece of your data from our servers immediately, including those 30-day previous versions. It's not a "within 30 days" promise; it's gone the moment the button finishes. The copy on your own device stays yours; you can clear it with the app's Reset button whenever you like.

The one thing that button does not reach is the sign-in security log kept by our authentication provider (Supabase, described under Service logs above): it holds the email address and IP address of your past sign-in events until it expires on its own schedule, and it is not something we can delete by hand.

Want a copy of your data first? In the app, open the Settings menu (the three dots at the top) and choose Download my data: a JSON file of your tracker data (hours, targets, categories and archived weeks), saved straight to your device, signed in or not. The same menu's Daily reminder downloads a calendar file built on your device. It holds the time, the days and the app link, nothing else.

Who runs this

Focushours is built and run by one independent developer based in Norway, who is also the data controller for anything described above. Questions, concerns, or data requests: [email protected].

Changes

If any of this changes (a new destination, a new event, anything), this page will say so, with a new date at the top, before the change applies to you. (July 23, 2026: added the cookieless PostHog analytics described above, in the same release that enabled them. August 8, 2026: the app moved to focushours.app/app behind a new marketing front page, and the three anonymous page events described above were added, in the same release that introduced the page. No new destination: the same EU PostHog endpoint. August 14, 2026: the product events grew from three to the list above (app opened, session finished, session not logged, session started from a link, break started, goal added, week reopened, and a manual-or-rollover source on week completed), in the same release that enabled them. No new destination: the same EU PostHog endpoint, and the same guarantees. September 5, 2026: the three front-page events gained the referring site's origin and the utm tags from the link, described above, so that an announcement can be attributed to the place it was made. Facts about the link, not about you; no new destination. September 6, 2026: the app-opened event gained one fact, the number of distinct days this browser profile has logged hours on, reported as one of five bands (none, 1 to 2, 3 to 6, 7 to 20, more than 20) and never as the number. It shows whether the app is being used on three or more distinct days, without an account and without an identifier. Same guarantees, no new destination. September 7, 2026: no new destination and no new event. Two clarifications only, both about things that were already true: what happens to local storage on iPhone and iPad, and that the notification and the icon count are drawn by your own device. September 10, 2026: no new destination and no new event. One clarification under Deleting your data: the authentication provider's sign-in security log (email address and IP address of past sign-ins) is not removed by the Delete account button and expires on its own schedule. Already true; now said. Also on this date: the copy-of-your-data request moved from email to the app's Settings menu. September 24, 2026: no new event and nothing new in the app. One new use of the email address you sign in with: an occasional question about how Focushours is working for you, described under On our servers. Never marketing; replying "stop" ends it. October 5, 2026: no new destination and no new event. The analytics section now names the technical facts the analytics library has always attached to every event, which this page did not list before, and the app stopped sending the screen and window size, the timezone, the browser language and the full browser identification string. October 9, 2026: no new destination and no new event. Three wording corrections: the list of what the tracker holds no longer names per-day text entries, which the app does not have; the page no longer quotes a number of days for Safari's storage deletion on iPhone and iPad, which it cannot confirm; and the analytics section says no cookies in place of an older line about ad pixels. Also on this date: app events now carry the utm_source, utm_medium and utm_campaign tags of the link you arrived through, described above, which the front page has carried since September 5; every other link tag is removed. Facts about the link, not about you; no new destination. October 10, 2026: six new product events, described above (a session started, a session ended, a day's hours went up, a target was set, a tab or view was opened, a day was marked off or back on), and five facts that ride on every app event (installed, lang, signed_in, has_target, and archived weeks as one of four bands), in the same release that enabled them. The line for a session that logged nothing now also says it carries countdown or stopwatch, which it always did, and the page now names the page-leave event the analytics library has always sent, and says plainly that event times can give away how long a session ran. No new destination: the same EU PostHog endpoint, and the same guarantees. Also on October 10, 2026: until 20:55 UTC that day, PostHog looked up an approximate location from the connection of every analytics event, on the app and on the front page, and stored it with the event: country, region, city, postcode, map coordinates and time zone. The IP address itself was not kept, and nothing tied the location to an account, but this page did not say a location was stored, and it should have. The lookup is now switched off, and every event also tells PostHog to skip it. The location already stored is still on those past events. October 11, 2026: no new destination and no new event. The Hours tab has one view now, so the app-opened event no longer says which view it opened on, and a tab opened by a click or a key is reported as the tab alone. Also on October 11, 2026: the front page has two start buttons instead of three (the bar that followed you down the page on a phone is gone), so its button event names one of those two. October 12, 2026: no new destination and no new event. Every front-page event now tells PostHog not to create a profile. Until this date PostHog could create one anonymous profile per front-page visit, keyed to that visit's random id and holding only that visit's own events and, until October 10, the approximate location described above; this page said there were no profiles, and it should have said this. The app's own events never created one. Profiles created before this date are not removed by this change. October 22, 2026: two new product events, described above (the app was opened for the first time in a day, a week or a month by this browser profile, and hours were logged for the first time in one), so that how many browser profiles use the app in a week or a month can be counted without an identifier. To send each once, the app now keeps on your device the last day, week and month it counted this profile, which the paragraph after the event list describes. This page used to say nothing was stored on your device for analytics; the once-ever note behind the first-session event was already kept that way, so the sentence was imprecise and is now exact. No new destination: the same EU PostHog endpoint, the same guarantees, and still no identifier of any kind leaves your device. Also on October 22, 2026: the opened event now carries which language your browser asks for first, as a bare two-letter code, only when the app does not have that language, and nothing when it does; the library's own browser-language fact stays removed as before. No new destination and no new event. October 23, 2026: no new destination, and one event fewer: the Goals tab is gone, and with it the event for a goal being added. Monthly, quarterly and yearly goals you set before then stay stored with the rest of your tracker, unread by the app but kept, so a device still on an older version does not lose them. October 24, 2026: no new destination for the app and no new event. Two email providers are now named, both already in use: Resend sends the sign-in link, and Proton Mail sends the occasional question described under On our servers, where this page said only "an email delivery provider". The sign-in link's provider was not named before, and it should have been. October 25, 2026: no new destination and no new event. The analytics identifier changed: until this date every page load got a random identifier that was forgotten when the tab closed, so a reload counted as a new visitor and the front page could not be followed into the app. Now PostHog works out an anonymous identifier for one calendar day on its own servers, from the IP address, the browser identification string, this site's address and a random value that is deleted when the day ends, as described above. To make it, the app sends the browser identification string again, which it stopped sending on October 5, 2026; PostHog deletes it once the identifier is made. Still no cookies, nothing kept on your device to make it, no profiles and nothing linked to your email or account.)