Legal
Privacy Policy
Written in plain language, and written against what the app actually does rather than copied from a template. If anything here does not match what you observe, that is a bug and I want to hear about it.
Last updated 12 October 2026
The short version
Focus in Motion holds what you put into it — your tasks, notes, focus sessions and money entries — so it is there when you come back. It is not sold, not rented, and not used to build an advertising profile. There are no advertising trackers on this site.
Three things are worth knowing before you read further, because they are the parts people are usually surprised by:
- The AI features send your text to Anthropic. When you photograph a syllabus, dump your thoughts into Clarity, ask the assistant a question, or use a note action, that content goes to Anthropic’s API to be processed. Nothing is sent unless you use one of those features.
- Your data is stored in the United States unless noted otherwise below, because that is where the hosting and database providers run.
- Deleting your account really deletes it. There is no soft delete, no thirty-day grace period and no backup copy kept for our benefit. If you delete it, it is gone, and we cannot get it back for you either.
Who is responsible for your data
Focus in Motion is operated by an individual sole proprietor based in Ontario, Canada. There is no company behind it and no staff — one person builds and runs it.
Privacy questions and requests: getfocusinmotion@gmail.com
What is collected, and why
Only what the product needs. There is no sign-up questionnaire, no date of birth, no phone number, no address and no payment details — because none of those are required to run a planner, and collecting data you do not need is how you end up losing data you did not need.
| What | Why | On what basis | How long |
|---|---|---|---|
| Your email address and password | To create your account and let you sign back in. | Necessary to provide the service you asked for. | Until you delete your account, at which point it is removed immediately. |
| Your display name, if you set one | To greet you by name. | Optional. You can leave it blank or change it at any time. | Until you change or delete it, or delete your account. |
| Everything you put into the app: tasks, notes, focus sessions, planning rules, projects, and money entries | This is the product. It is stored so it is there when you come back. | Necessary to provide the service. | Until you delete it, or delete your account. We do not archive a copy after deletion. |
| Content you send to an AI feature | To produce the result you asked for — extracting tasks from a syllabus, summarising a note, answering a question about your day. | Your action. Nothing is sent to an AI provider unless you use one of those features. | We do not store a separate copy beyond the result saved into your account. Anthropic’s own retention is governed by their commercial terms, under which API inputs are not used to train their models. |
| Technical information: IP address, browser and device type | Unavoidable in serving a web page, and used to keep the service working and to spot abuse. | Legitimate interest in operating and securing the service. | Held in server logs by our host for a short period. We do not keep our own copy. |
| Anonymous page-view and performance measurement | To know which pages are used and whether the app is fast enough. | Legitimate interest. This does not use cookies and does not build a profile of you or follow you to other sites. | Aggregated by Vercel; we never see individual visitors. |
| Feedback you choose to send | So we can read it and reply. | Your action — nothing is sent unless you submit the form. | Kept while we work through it, and deleted when you delete your account. |
Your theme, text size, sidebar state and in-app preferences are kept in your browser’s local storage, not on our servers. They never leave your device, and clearing your browser data resets them. A focus timer in progress is also kept there so it survives a refresh.
Who else can see it
Running a web app means using other companies for hosting, storage and the AI features. Each of these can see some part of your data in the course of doing that job. None of them is permitted to use it for anything else, and none of them is paid for your data or pays for it.
| Service | What it does | What it can see | Where |
|---|---|---|---|
| Supabase | Database and sign-in. This is where your account and everything in it is stored. | Your email address, your password (stored only as a salted hash — nobody can read it back, including us), and all content you create: tasks, notes, focus sessions, planning rules, and anything you record in the money section. | Stored on Supabase infrastructure. Depending on the region the project runs in, this may be outside Canada — PIPEDA permits that, provided you are told, which is what this line does. Wherever it sits, it is subject to the laws of that country, including lawful access requests made there. |
| Anthropic | The AI features: reading a photographed syllabus, turning a brain dump into tasks, summarising a note, and the assistant you can talk to. | Only the text or image you submit to that specific feature, plus — for the assistant — a summary of your current tasks, planning rules, upcoming bills and recent transactions, so it can answer about your day. Your email address and password are never sent. | United States |
| Vercel | Hosting, plus anonymous traffic and performance measurement. | Your IP address and browser details, as part of serving any web page. Vercel Analytics records page views without cookies and without a cross-site identifier. | Global edge network, with processing in the United States |
| Resend | Sending email — the weekly review, if you turn it on. | Your email address and the contents of that message. | United States |
| Your browser vendor (Apple, Google or Mozilla) | Delivering push notifications, if you turn them on. | A push endpoint your browser creates, and the notification text. This only exists if you grant notification permission. | Depends on the vendor |
What is never done with it
- It is not sold, rented, or traded. There is no business model here that involves that.
- There are no advertising trackers, no ad pixels, no third-party cookies, and no cross-site identifiers.
- Your content is not read for product research or used to train anything.
- It is not disclosed to anyone else except as described above, or where the law actually requires it.
Your rights
Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), and under the GDPR if you are in the UK or EU, you can ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, and complain to a regulator if you are unhappy with how a request was handled.
Most of these you can do yourself, immediately, without asking:
- Correct anything — all of your content is editable in the app, and your name and preferences are in Settings.
- Delete everything — Settings → Account → Delete account. It asks for your password and makes you type DELETE, then removes your rows from every table and deletes your login. It is immediate and irreversible.
- Stop the weekly email — the one-click link at the bottom of it, or the toggle in Settings → Notifications. It is off unless you turn it on.
If you are not satisfied with how a request is handled you can complain to the Office of the Privacy Commissioner of Canada. If you are in the UK or EU, to your own national data protection authority.
Security
What is actually in place, stated precisely rather than reassuringly: the site is served over HTTPS only; passwords are stored as salted hashes by the authentication provider and are never visible to anyone, including me; the database enforces row-level security so one account’s queries cannot reach another account’s rows; the server keys that could bypass that are never sent to the browser.
What is not in place: there is no independent security certification, no SOC 2 report and no third-party penetration test. Those cost money this project does not have yet, and claiming otherwise would be a lie. You should weigh that when deciding what to put into it. I would not put anything in here I could not afford to lose.
International transfers
Data is processed in the United States by the providers listed above. If you are in the UK or EU, that is a transfer outside your region; those providers rely on the European Commission’s Standard Contractual Clauses for it. If that is not acceptable to you, the honest advice is not to use the service.
Children
Focus in Motion is not intended for children under 13 and accounts are not knowingly created for them. If you are between 13 and the age of majority where you live, please get a parent or guardian to agree to the Terms before using it. If you believe a child under 13 has an account, email getfocusinmotion@gmail.com and it will be deleted.
Breaches
If data is lost or exposed in a way that creates a real risk of significant harm to you, you will be told, and the Privacy Commissioner will be notified, as PIPEDA requires. You will be told what happened, what was affected, and what to do about it — not a vague note about an “incident”.
Changes
If this policy changes in a way that materially affects you, you will be told in the app before the change takes effect, not quietly on a page you were never going to revisit. The date at the top always reflects the current version.
Contact
getfocusinmotion@gmail.com. It is one person reading it, so give it a couple of days.