Privacy Policy

Introduction

Welcome to FocalNest. We are committed to protecting your privacy and the privacy of your family, especially children. This Privacy Policy explains how we collect, use, and protect your information.

Note: FocalNest complies with the Children's Online Privacy Protection Act (COPPA). If you are a parent or guardian, please read the Children's Privacy section carefully.

1. Information We Collect

1.1 Information You Provide

• Account Information: Display name, birthday, optional email
• Family Information: Family name, family member roles
• Task Data: Tasks created, completed, and assigned
• Preferences: Display settings, accessibility options
• Calendar Events: Events you create in your family calendar

1.2 Information Collected Automatically

• Device Identifier: When a device is registered as a family device — a shared kitchen tablet, for example — we store a persistent identifier for it, made from browser characteristics combined with an ID kept in that browser's local storage. It is what lets a shared device remember which family it belongs to and which profile was last active, so nobody has to sign in again every morning.
• Consent Audit Record: The IP address a parent gave consent from, kept as the record COPPA requires us to be able to produce.

A device identifier can be associated with a child's profile, because a shared device remembers who was using it. Under COPPA this is a persistent identifier collected solely to support the internal operations of the service — keeping a device signed in and attributing activity to the right profile. We do not use it for advertising, we do not build behavioral profiles from it, and we never share it.

1.3 Information We Don't Collect

• Full legal names or last names
• Physical addresses or phone numbers
• Location or geolocation data
• Social security numbers or government IDs
• Payment information (handled by third-party processors)
• Photos or images (unless you explicitly upload them)

2. How We Use Your Information

We use your information only to provide and improve FocalNest:

• Display your name and avatar within your family
• Show age-appropriate features based on birthday
• Track task completion and unlock collectible rewards
• Enable family coordination (shared calendar, task assignments)
• Provide accessibility features (ADHD-friendly UI, etc.)
• Send important account notifications (with your consent)

We NEVER: Show ads to children, sell your data to third parties, or use your data for marketing purposes.

3. Children's Privacy (COPPA Compliance)

FocalNest complies with the Children's Online Privacy Protection Act (COPPA). We take additional steps to protect children under 13.

3.1 Parental Consent

We do not knowingly collect personal information from children under 13 without verifiable parental consent. When a child attempts to register:

• We require birthday to calculate age
• If under 13, we block self-registration
• We request parent/guardian email
• We send verification email to parent
• Account activates only after parent verifies consent

3.2 Information Collected from Children

With parental consent, we collect from children:

• First name (for display)
• Birthday (for age-appropriate features)
• Task activity (tasks completed, collectibles unlocked)
• User preferences (accessibility settings)

We do NOT collect from children:

• Email addresses
• Phone numbers
• Location data
• Photos (unless parent uploads)
• Any data shared with third parties

AI-powered features are off for a child account unless a parent turns them on. This is a separate decision from the consent that created the account: a parent grants it per child from the parental dashboard, and can withdraw it at any time, after which every AI feature refuses that child again. Section 10 describes what an AI request contains.

3.3 Parental Rights

Parents have the following rights regarding their child's account:

• Review: View all data collected from your child
• Export: Download all data in machine-readable format (JSON)
• Delete: Request permanent deletion of child's account and data
• Revoke: Withdraw consent at any time (account becomes inactive)
• Refuse: Stop further data collection

To exercise these rights, visit your Parental Controls Dashboard or email us at privacy@focalnest.com.

3.4 Consent Updates

If we update our privacy policy in a way that affects children, we will notify parents and request renewed consent. Children's accounts will be temporarily restricted until parents review and approve the updated policy.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share data only in these limited cases:

• Within Your Family: Family members see shared tasks, calendar, and activity
• Service Providers: Hosting, email (Resend), with strict data protection agreements
• Legal Requirements: If required by law (court orders, subpoenas)
• Safety: To protect against fraud, abuse, or safety threats

We never share children's data with advertisers or marketing companies.

5. Data Security

We protect your data with industry-standard security measures:

• HTTPS/TLS encryption for all data transmission
• Encrypted passwords (bcrypt hashing)
• Role-based access controls
• Regular security updates and audits
• Isolated family data (multi-tenant security)

6. Data Retention

We retain your data as follows:

• Account and Family Data: Retained as long as the account is active
• Notifications: Deleted after 90 days
• Focus, Quick Start, and Body Doubling Sessions: Deleted after 2 years
• Task and Routine Completion History: Deleted after 3 years. This is what the app's pattern insights are built from, which is why it is the longest window — but it is still a window.
• Child Accounts (Consent Revoked): Account disabled immediately, data preserved for 30 days, then deleted
• Account Deletion: 30-day grace period, then permanent deletion
• Backups: Purged from backups within 90 days of deletion

The first four are enforced by a sweep that runs every day, not by request. We do not currently delete accounts for inactivity alone.

7. Your Rights

You have the right to:

• Access: Request a copy of your data
• Correction: Update incorrect information
• Deletion: Request account and data deletion
• Export: Download your data in JSON format
• Objection: Object to certain data processing activities

To exercise these rights, visit Settings or email privacy@focalnest.com.

8. Cookies and Tracking

We use minimal cookies:

• Essential Cookies: Authentication, session management (required)
• Preferences: Remember your settings (optional)

We do NOT use: Advertising cookies, tracking pixels, or third-party analytics

9. Google Calendar Integration

FocalNest uses two separate Google Calendar permissions, requested independently. Both are optional, and neither is requested unless you ask for that specific capability. Signing in with Google requests neither.

• Reading your calendars (calendar.readonly), requested when you connect a calendar in Settings. This is read-only: FocalNest never creates, edits, or deletes anything on a calendar you connect.
• Writing your FocalNest schedule (calendar.app.created), requested only if you turn on writing in Settings. This permission covers only calendars FocalNest itself created — it does not grant access to your existing calendars or their events. FocalNest creates one calendar, named "FocalNest", and writes only there.

9.1 What We Access and Store

From connected calendars, we read and store event titles, descriptions, locations, start/end times, and attendee/organizer email addresses (used only to match an event to the correct family member — attendee emails are not displayed or shared).

9.2 How We Use This Data

Google Calendar data is used solely to:

• Display your events in your family's planner and daily views
• Schedule tasks around your existing commitments, and reschedule a task when a new event lands on top of it
• Optionally warn you a set number of minutes before an event starts

9.3 What We Write

If you turn on writing, FocalNest creates a calendar named "FocalNest" in your Google account and adds events to it for what you've committed to: events you created in FocalNest, and tasks you've given a specific time or confirmed for a particular day. Scheduling suggestions you haven't confirmed are not written. We write nothing anywhere else.

9.4 Retention and Deletion

Synced events are stored only for as long as the calendar connection is active. Disconnecting a calendar (in Settings, or by revoking FocalNest's access from your Google Account) deletes the associated synced events from FocalNest. Turning off writing removes the events FocalNest added to its own calendar and revokes that permission; the empty calendar is left in your account for you to delete if you want to.

9.5 Our Commitment

FocalNest's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We never use Google Calendar data for advertising, never sell it, and never share it with third parties except as necessary to provide the sync feature itself.

10. Third-Party Services

We use these third-party services:

• Hosting: Fly.io / Cloudflare (data encrypted at rest and in transit)
• Email (outbound): Resend (for transactional emails only)
• Email (inbound): Postmark, which receives and parses any email you choose to forward to your family's FocalNest address
• Payments: Stripe (we don't store payment info)
• Calendar (optional): Google, if you connect a Google Calendar or sign in with Google
• AI (Anthropic): When you use an AI feature — drafting a project, generating a first step, or parsing a forwarded email — the text you supplied and a pseudonymized summary of your family structure (member roles and age ranges, no names) are sent to Anthropic's Claude API. Anthropic does not use API requests to train their models. AI features are unavailable on child accounts. Because your own text is sent as written, do not include sensitive personal, health, or financial information in an AI prompt. Anthropic Privacy Policy.
• Asset generation (OpenAI): Used by us to produce collectible card art, narration audio, and ambient backgrounds ahead of time. No customer data is sent to it.

All service providers operate under data processing agreements. A full list, including what each one processes and where it is located, is on our subprocessors page.

11. International Users

FocalNest is based in the United States, and all of our infrastructure and service providers are located there. If you use FocalNest from outside the US, your data is transferred to and processed in the US.

We apply the same protections to everyone regardless of where they live: we collect the minimum we need, we don't sell data, and the access, correction, export, and deletion rights described in Section 7 are available to all users, not only those in a particular jurisdiction.

We are not currently established in the EU and have not appointed an EU representative under GDPR Article 27. If you are in the EU or UK and have a question about how your data is handled, email privacy@focalnest.com and we will respond within the timeframes in Section 13.

12. Changes to This Policy

When we make changes:

• We update the "Last Updated" date at the top
• We increment the version number
• We notify you via email or in-app notification
• For children: We notify parents and request renewed consent

13. Contact Us

If you have questions about this Privacy Policy or our data practices:

For COPPA-related questions or to exercise parental rights, please include "COPPA Request" in your subject line.