PHOCUS

Privacy Policy

Version: 1.10 · Effective date: 12 November 2026

This Privacy Policy explains how PHOCUS ("the app", "we", "us") processes your personal data when you use the PHOCUS mobile app, the PHOCUS Mat, our website and our webshop. If anything is unclear, contact us using the details in section 1.

1. Who is responsible for your data

The data controller is:

Sidar Aydin, sole proprietorship, who offers PHOCUS
August Collonstraat 7, 3600 Genk, Belgium
Enterprise number: BE 1044.330.308
Privacy contact: info@getphocus.eu · +32 485 26 34 76

We have not appointed a Data Protection Officer, because the law does not require us to (Article 37 GDPR). For any privacy question or request, contact info@getphocus.eu.

2. Summary

  • We only collect what the app needs to work: your account, your focus sessions, your points and your focus settings.
  • If you buy a PHOCUS Mat in our webshop, we use your name, e-mail address and delivery address to deliver your order. Your payment is handled by Stripe; we never see your card details.
  • We do not sell your data, show ads, or use analytics, tracking or advertising identifiers.
  • Your NFC mat, motion sensor and Do Not Disturb settings are processed on your device only.
  • You can export or permanently delete your app data at any time from Settings in the app.

3. What data we process

3.1 Account data

  • E-mail address
  • Display name (the username you choose). Tip: you do not need to use your full real name.
  • A unique user ID generated by our authentication provider
  • Your password, which is stored only as a cryptographic hash by our authentication provider. We never see your password.
  • Technical account timestamps (account creation, last sign-in)
  • What you confirmed when you signed up: that you are at least the minimum age the app asked for (13, or 16 in earlier versions of the app), and when you accepted which version of the Terms of Service

3.2 Focus session data

For every focus session of at least 5 minutes we store:

  • The duration in minutes
  • Whether the session was completed or ended early
  • The date and time of the session

When you are online at the start of a session, our server also records when the session started and ended according to its own clock, the outcome (completed, ended early on the mat, stopped without the mat, or not confirmed) and the points it awarded. The server uses this to award points fairly.

3.3 Points and streaks

  • Your focus points balance and every change to it (amount, reason such as "session completed", "streak bonus" or "early stop", and the time)
  • Your streak (the number of consecutive days with a completed session), calculated from the data above
  • Your time zone (for example "Europe/Brussels"), so that a "day" for your streak and the daily points limit matches your local day

Points and streaks are calculated by our server, not by the app.

3.4 Rewards and teams

  • Rewards: which reward you claimed, when, how many points it cost and, for discount or partner rewards, the code you received. Partner codes are created in advance; we do not send your name, e-mail or other personal data to partners or charities.
  • Teams: the team you belong to and when you joined. If you join a team, the other members of that team can see your display name, your role in the team (owner, admin or member), when you joined, your focus time this week (which also sets your place on the team's weekly leaderboard) and your current streak, and the team's total focus time for this week and last week. They never see your e-mail address or your session details. Teams are not ranked against each other: users outside your team do not see your team or its results.

3.5 Focus settings

  • Weekly goal (hours and number of days)
  • Work or study profile (type such as student, full-time or part-time, weekly hours and intensity)
  • Custom focus blocks you create

These settings are stored on your device and copied to your account profile, so they can be restored when you reinstall the app or sign in on a new phone.

3.6 Data that never leaves your device

  • PHOCUS Mat (NFC): when you dock your phone, the app reads the mat's serial number and the text record stored on it, and verifies its digital signature. This happens entirely on your phone. The mat data is not stored and not sent to us.
  • Motion sensor: accelerometer readings are processed in memory to detect whether your phone is resting on the mat. They are never stored or transmitted.
  • Do Not Disturb (Android): only if you give PHOCUS "Do Not Disturb access". PHOCUS then switches Do Not Disturb on during a focus session and off afterwards (how this works is described in section 7 of our Terms of Service). For this it keeps on your phone only the identifier of its Do Not Disturb mode and, on Android 9 and earlier, the mode you had before the session. PHOCUS cannot read your notifications, messages, contacts or who is calling you. You can withdraw this access at any time in your phone's settings.
  • Do Not Disturb (iPhone): PHOCUS cannot see or change your Focus settings. It only remembers, on your phone, that you completed its setup screen.
  • Local app data: the state of an ongoing session, sessions waiting to be uploaded while you are offline, a copy of your session history and claimed reward codes for offline use, your app settings, and whether you completed the onboarding and Focus Shield setup screens.
  • Storage on your device: the app stores and reads information on your phone only where this is strictly necessary to provide the service you ask for: keeping you signed in, saving sessions while you are offline, and remembering app settings and screens you completed. This does not require your consent (article 10/2 of the Belgian Data Protection Act of 30 July 2018). We do not use cookies, advertising identifiers or similar tracking technologies.

3.7 Technical logs

When the app connects to our servers, our hosting provider automatically records technical log data: your IP address, an approximate location derived from it (country and city), the type of request, the app and operating system version (user agent), the time, and for sign-in events your user ID and e-mail address. We use these logs only to keep the service secure and working (for example to detect attacks or abuse and to fix errors), not to track you or to find out where you are.

When you visit our website getphocus.eu, the provider that hosts it processes your IP address to show you the page. When you start a payment in our webshop, send the contact form, use the withdrawal form, write a review or sign up for our newsletter, your IP address is also used to limit how many of these requests can be made from one address in a short time, to protect the website against abuse; it is not stored, except as a hashed (coded) version for newsletter sign-ups (see section 3.11). The website does not use cookies, analytics or tracking.

3.8 Orders in our webshop

When you buy a PHOCUS Mat in our webshop at getphocus.eu/shop, we process:

  • What you ordered: the products, quantities, prices, an order number and the date and time of your order
  • Your name, e-mail address and delivery address, which you enter on the payment page
  • Payment information: the amount paid, the payment status, and the reference numbers Stripe gives to your payment. We never see or store your card or bank account details.
  • A campaign code, if you came to the shop through a link that contains one (for example ?ref=campaign). It tells us which campaign led to an order, not who you are.
  • Delivery information: when we sent your order, and the track-and-trace number of your parcel
  • If you withdraw from your purchase or make a guarantee claim: your request, your order number and our correspondence with you

The payment page is run by our payment provider Stripe on its own website (checkout.stripe.com). What Stripe processes there, and the cookies it uses for security and fraud prevention, are explained in Stripe's privacy policy (https://stripe.com/privacy).

A checkout that you do not complete holds no personal data in our database: your name, e-mail address and delivery address are only stored once Stripe confirms your payment.

3.9 Messages you send us

If you e-mail us or use the contact form on our website, for example with a question, a complaint, a privacy request or a report about content, we process your e-mail address, your name if you give it, the topic and the content of your message, so that we can answer you. Messages from the contact form reach our mailbox by e-mail through our e-mail provider; the website does not store them. To send you a short confirmation and to prevent abuse of the form, we keep a hashed (coded) version of your e-mail address and the time of your message for 2 days.

3.10 Reviews of the PHOCUS Mat

If you bought a PHOCUS Mat in our webshop, you can write a review on our website. We process your rating, the title and text of your review, the name you choose to show (or "Anonymous"), the date, and which order the review belongs to. To check that you bought a mat, you enter your order number and the e-mail address of your order, or you use the personal link from our e-mail; your e-mail address is not stored with the review. We publish a review on our website only with your permission, and after a person on our team has checked it.

About 10 days after we ship your order, we send you one e-mail to ask for a review. You can object to this e-mail at any time, free of charge (see section 4).

3.11 Our newsletter

If you sign up for our newsletter on our website, we process your e-mail address, the language of the page you signed up on, and when you signed up and confirmed. You are only added to the list after you confirm with the link in the e-mail we send you. We use your address only to send you news about PHOCUS, including when the PHOCUS Mat is available. You can unsubscribe at any time with the link in our e-mails or by e-mailing info@getphocus.eu. To prevent abuse of the sign-up form, we keep a hashed (coded) version of your IP address and the time of your sign-up for 2 days.

3.12 Data we do not collect

We do not collect your precise location (GPS), contacts, photos, microphone or camera data, advertising identifiers, or usage analytics. The app contains no third-party tracking or crash-reporting software.

4. Why we process your data and on what legal basis

  • Providing the service (account, sign-in, saving and showing your focus history, syncing your settings): necessary to perform our contract with you (Article 6(1)(b) GDPR).
  • Points, streaks, rewards and teams (timing sessions on our server, awarding points, calculating your streak, handling reward claims and showing your progress to your team): necessary to perform our contract with you (Article 6(1)(b) GDPR). Joining a team is optional, and you can leave at any time.
  • Notifications and Do Not Disturb (optional): when you switch these on, the app shows session notifications on iPhone (a reminder when you leave PHOCUS during a session) and, on Android, switches its own Do Not Disturb mode on and off on your phone. This is part of the service you ask for (Article 6(1)(b) GDPR). It happens entirely on your phone; no notification or Do Not Disturb data is sent to us. Your phone asks your permission first, and you can switch these features off at any time in your phone's settings.
  • Security and fraud prevention (verifying that a genuine PHOCUS Mat is used, protecting accounts, preventing abuse, including point farming, and technical logs): our legitimate interest in keeping accounts and the service secure, in preventing points from being earned without real focus sessions so that rewards and team rankings stay fair, and in finding and fixing technical errors (Article 6(1)(f) GDPR).
  • Service e-mails (confirming your e-mail address, password recovery, important changes to the service or to these documents): necessary to perform our contract with you (Article 6(1)(b) GDPR).
  • Answering your messages: necessary to perform our contract with you when your message is about your account or the app (Article 6(1)(b) GDPR); otherwise our legitimate interest in answering questions and handling reports and complaints (Article 6(1)(f) GDPR).
  • Webshop orders (processing your order and payment, delivering it, sending you the order confirmation and delivery e-mails, and handling a withdrawal, return or guarantee claim): necessary to perform our contract with you, or to take steps at your request before entering into it (Article 6(1)(b) GDPR).
  • Protecting the website against abuse (limiting how many payments can be started, and how many messages, withdrawals, reviews and newsletter sign-ups can be sent, from one IP address): our legitimate interest in keeping the webshop secure and available (Article 6(1)(f) GDPR).
  • Newsletter: your consent, which you give by signing up and confirming (Article 6(1)(a) GDPR). You can withdraw it at any time by unsubscribing; this does not affect the e-mails we sent before.
  • Reviews: the one e-mail asking for a review is based on our legitimate interest in hearing how customers find the mat (Article 6(1)(f) GDPR). Checking your purchase and publishing your review are based on your consent, which you give in the review form (Article 6(1)(a) GDPR). You can withdraw it at any time by asking us to remove your review; this does not affect the review's publication before that.
  • Legal obligations: keeping our accounts and tax records (including the details of your order), answering orders from courts or authorities and keeping a record of how we handled your privacy requests and reports about content (Article 6(1)(c) GDPR).

Our server automatically applies a daily points limit and anti-abuse checks. These have no legal or similarly significant effect on you. We do not use your data for automated decision-making or profiling with legal or similarly significant effects.

Your right to object

Where we process your data on the basis of our legitimate interests (security, fraud prevention, technical logs, protecting the webshop, the review e-mail and answering messages), you can object at any time, for reasons relating to your particular situation, by e-mailing info@getphocus.eu. We will then stop, unless we have compelling legitimate grounds, such as protecting the service against an ongoing attack. You can also ask us how we balanced our interests against yours.

What you must provide. To create an account you must provide an e-mail address, a display name and a password, and confirm that you are at least 13 and accept the Terms of Service. Without this information we cannot create an account and you cannot use PHOCUS. Everything else, such as joining a team or setting a weekly goal, is optional. To order in our webshop you must provide your name, e-mail address, delivery address and payment details; without them we cannot accept and deliver your order. You do not need an app account to order.

5. Who receives your data

We use the following service providers (processors). They may only process your data on our instructions:

  • Supabase (Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513): authentication (including generating account e-mails), database and technical logs. Your account and app data are stored in a data centre of Amazon Web Services in Ireland (European Union). Supabase uses its own sub-processors (for example Amazon Web Services and Cloudflare for hosting and network services); the current list is published at https://supabase.com/legal/subprocessors.
  • E-mail providers: delivery of account e-mails (such as confirming your e-mail address and resetting your password), webshop e-mails (such as your order confirmation and the confirmation of a withdrawal), the confirmation of a contact form message, our newsletter (including the list of subscribers we send it to) and its confirmation e-mail, and our @getphocus.eu mailbox, which receives the e-mails you send us.
  • Domain and website hosting providers: the getphocus.eu domain, our website and the database of our webshop and newsletter, which is stored in the European Union.

Other recipients:

  • Stripe (Stripe Payments Europe, Limited, Ireland): runs the payment page of our webshop and processes your payment. Stripe receives the details you enter on the payment page and what you ordered. For processing payments, preventing fraud and meeting its own legal obligations (such as anti-money-laundering checks), Stripe is an independent controller under its own privacy policy (https://stripe.com/privacy).
  • Delivery companies: the name and delivery address on your order, so that they can deliver your parcel.
  • Our accountant and the tax authorities: the details of your order, as far as accounting and tax law requires.
  • Other PHOCUS users: if you join a team, the members of that team (see section 3.4).
  • Visitors of our website: a review we publish, with the name you chose (see section 3.10).
  • Authorities: courts, police or regulators, only when the law requires us to.
  • Apple and Google: distribution of the app through the App Store and Google Play under their own privacy policies. We do not send your app data to them.

Each of our service providers (processors) is bound by a data processing agreement and must protect your data at least as well as described in this Privacy Policy. We do not sell or rent your personal data, and we do not share it with advertisers.

6. International transfers

Your account and app data are stored in a data centre of Amazon Web Services in Ireland (European Union). Our hosting provider, however, is Supabase Pte. Ltd., a company established in Singapore, and Supabase's support and operations staff and some of its sub-processors (such as its US affiliate Supabase, Inc., Amazon Web Services, Cloudflare and Google) are located outside the European Economic Area (EEA), mainly in the United States. When they access or process your data from outside the EEA, for example for support, security, network traffic or technical logs, your personal data is transferred to a country outside the EEA.

The European Commission has not adopted an adequacy decision for Singapore. We therefore rely on the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914, Module Two: controller to processor), which are part of our data processing agreement with Supabase Pte. Ltd. Supabase must impose data protection obligations on its sub-processors that are no less protective than those in our agreement. Some of these sub-processors in the United States, such as Amazon Web Services and Cloudflare, are certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023.

Stripe may transfer the payment data of webshop orders to its affiliate Stripe, LLC in the United States, which participates in the EU-U.S. Data Privacy Framework; Stripe's privacy policy describes its safeguards.

Where another service provider processes your data outside the EEA, we rely on an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework) or on the Standard Contractual Clauses.

You can request a copy of these safeguards by contacting info@getphocus.eu.

7. How long we keep your data

  • Your account and everything linked to it (account data, settings, focus sessions, points, streaks, time zone, reward claims and team membership): for as long as your account exists. When you delete your account, all of it is deleted. When you leave a team, your membership is deleted immediately. A reward code you claimed is never handed out again, but after your account is deleted it is no longer linked to you.
  • Inactive accounts: we may delete an account that has not been used for 24 months (no sign-in and no synced focus session). We will warn you by e-mail beforehand, so you can keep your account by signing in.
  • Technical logs: for up to 7 days. Logs of sign-in events can remain for this period after your account is deleted.
  • Backups: deleted data can remain in encrypted backups of our hosting provider for up to 7 days, after which it is permanently deleted.
  • Messages you send us: for up to 12 months after we answered your question or closed your request, unless we need them longer to handle a complaint, a legal claim or a request from an authority.
  • Webshop orders (including a withdrawal or guarantee claim about the order): for as long as Belgian accounting and tax law requires us to keep them, currently 10 years after the end of the financial year of the order. Deleting your app account does not delete your orders, because orders are not linked to your app account.
  • Reviews: until you ask us to remove your review, and at the latest when the order it belongs to is deleted (see webshop orders above).
  • Withdrawal statements that do not match an order: for up to 12 months, unless we need them longer to handle a complaint or legal claim.
  • Newsletter: until you unsubscribe; then we delete your address from our list. A sign-up you do not confirm is deleted after 14 days, and the hashed IP address after 2 days.
  • Data on your device: until you sign out, delete your account or uninstall the app. A few settings of the phone itself that are not linked to your account, such as whether you set up Do Not Disturb, stay after you sign out, until you delete your account or uninstall the app.

8. How we protect your data

  • All connections between the app and our servers are encrypted (HTTPS/TLS).
  • Your sign-in tokens are stored in your phone's secure hardware-backed storage (iOS Keychain / Android Keystore) and are never included in device backups.
  • Our database enforces that every user can only access their own records.
  • Local app data is stored inside the app's private storage and is excluded from Android cloud backups.
  • In our webshop, you enter your payment details on Stripe's payment page; they never reach our servers. Only we can access the order database.

No system is perfectly secure. If a data breach affects you, we will inform you and the supervisory authority as required by law.

9. Your rights

Under the GDPR you have the right to:

  • Access your data and receive a copy. Use Settings → Export Phocus Data in the app or contact us. For webshop orders, e-mail us.
  • Rectification of incorrect data. You can change your name, e-mail address and settings in the app.
  • Erasure ("right to be forgotten"). Use Settings → Delete Account to permanently delete your account and all associated cloud data. Webshop orders that we must keep by law (see section 7) are deleted when that period ends.
  • Restriction of processing.
  • Data portability: the in-app export is a machine-readable JSON file.
  • Object to processing based on our legitimate interests (see the box in section 4).
  • Switch off optional features: you can switch off notifications and Do Not Disturb at any time in your phone's settings.
  • Withdraw your consent: we rely on your consent only to publish a review (section 3.10) and to send you our newsletter (section 3.11). Ask us to remove your review at any time, and unsubscribe from the newsletter with the link in our e-mails.

To exercise a right that is not available in the app, e-mail info@getphocus.eu. We answer within one month.

You also have the right to lodge a complaint with a data protection authority. In Belgium this is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, +32 2 274 48 00, www.dataprotectionauthority.be. You can also complain to the authority in the EU country where you live or work, or where you believe the infringement took place.

10. Children

You must be at least 13 to create an account. We ask you to confirm this when you sign up. If we learn that someone under 13 has created an account, we will delete it. Parents can contact info@getphocus.eu.

11. Changes to this policy

We may update this policy, for example when the app or the law changes. We will tell you about material changes in the app or by e-mail before they take effect. The version and effective date at the top show which version applies.

12. Contact

Questions about privacy? Contact info@getphocus.eu, call +32 485 26 34 76, or write to Sidar Aydin, August Collonstraat 7, 3600 Genk, Belgium.