zyFOCUS

1. Local-First Design

zyFOCUS is designed to store your tasks, notes, calendar events, and settings locally on your device. We do not collect or store your personal content by default.

2. Information We Process

• Local device data: Tasks, notes, calendar items, and preferences are stored on your device by default.
• Identifiers: The app generates a local userId and device identifiers to support optional features (for example, syncing, friends, referrals, and abuse prevention).
• Optional online features: If you enable online features (e.g., device sync, friends sharing, referrals, push notifications, online AI, or music streaming), we process the minimum identifiers and data needed to deliver that feature.
• Linked-device sync snapshots (optional): If you enable linked-device sync, your device may upload sync snapshots that contain the data you choose to sync, along with a sync group ID, device ID, and timestamps. This data is used to keep your linked devices up to date.
• Friends and sharing (optional): If you use friends features, we may store your display name, friend codes, basic profile stats you choose to sync (such as points/minutes), and share payloads you send to other users.
• Music streaming (optional): When you search or stream music from third-party catalogs, your device may connect directly to those providers, and they may receive technical information like your IP address and user agent.
• Diagnostics: Error logs and performance traces are stored locally. If you export diagnostics or contact support, you may share them voluntarily.
• Optional analytics: If enabled, we may process product usage events (feature usage, session timing) and device/browser metadata to improve stability and UX. Analytics do not include the content of your tasks or notes by default.

We process only what is necessary to operate the app, deliver optional features you enable, and maintain security.

3. Analytics

If analytics are enabled in the app, zyFOCUS may process product usage signals such as feature usage, session timing, and device and browser metadata to improve reliability and user experience. Analytics do not include the content of your tasks, notes, or calendar items by default.

We do not sell analytics data.

4. Email Communications

We use your email address only for ban notices and reminders you explicitly request. We do not use it for marketing or unrelated communications.

5. Push Notifications

If you enable push notifications, your browser may create a push subscription identifier. This identifier is used only to deliver notifications you request. You can disable push anytime in Settings or browser permissions.

6. Sponsored Content and External Links

zyFOCUS may display sponsored cards or optional external offers. If you open an external link, that site may collect data under its own privacy policy. We don’t control third‑party sites or their data practices. Sponsored content does not change your points or rewards unless the app clearly says it does.

External providers may place cookies or similar technologies on their own sites. Please review their privacy policies before sharing information.

7. Captcha and Abuse Prevention

To protect zyFOCUS from abuse and automated attacks, we may use captcha challenges provided by a third-party service (such as Cloudflare Turnstile). These services may process technical data like IP address, device/browser signals, and interaction patterns strictly for security and fraud prevention.

8. Storage and Cookies

zyFOCUS uses local storage and IndexedDB to store your data and preferences on your device. Optional analytics may use cookies or similar storage if you enable them. We do not sell your data.

9. Data Sharing

We do not sell your data. We may share minimal technical data with service providers only when you enable optional features such as captcha challenges, push notifications, online AI, friends, or linked-device sync.

Third-party providers you interact with directly (such as external links or music catalogs) may process data under their own terms and privacy policies.

10. Data Retention

Local data remains on your device until you delete it, clear browser storage, or uninstall the app. Analytics data is retained only as long as necessary to improve the service.

If you enable linked-device sync or friends features, related server-side records (such as sync snapshots, friend codes, or pending share inbox items) are retained to provide the feature and may be removed when you unlink devices, disable the feature, or request deletion through support where applicable.

11. Encryption and Data Protection

zyFOCUS uses industry-standard encryption to protect your data:

• Data Transfer Encryption: QR code sharing and encrypted exports use AES-256-GCM authenticated encryption with PBKDF2 key derivation (100,000 iterations, SHA-256).
• Locked Notes: Password-protected notes are encrypted using AES-256-GCM with unique salt and IV per note.
• Local Storage: Optional XOR obfuscation available for sensitive profile fields (email, phone) stored in localStorage.
• Web Crypto API: All cryptographic operations use the browser's native Web Crypto API (FIPS 140-2 compliant).

You control your encryption keys for exports and transfers. We cannot decrypt your data without your transfer code or password.

12. Security

We implement reasonable safeguards to protect data processed through our services. However, no system is completely secure. Protect your device, transfer codes, and backups.

13. Your Rights

You control your data locally. You may export, delete, or reset data from the app at any time. If you contact support, you can request deletion of support emails by contacting us.

For optional online features, you can typically disable the feature in Settings and unlink devices or stop using friends sharing to reduce or stop server-side processing for that feature.

Where applicable (including in the EU/UK), you may have rights to access, correct, delete, restrict, or object to processing of personal data, and to request data portability. To exercise these rights, contact us at the email listed below.

14. Children

zyFOCUS is not intended for children under the age required by local law to consent to data processing.

15. International Use

zyFOCUS is used globally. Where local data protection laws apply, we aim to comply with mandatory requirements.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised effective date.

17. Legal Bases and Compliance

Where required by law, we process data based on legitimate interests in improving the app, your consent for optional features, and compliance with legal obligations.

We aim to follow applicable platform rules and data protection laws in the regions where the app is used.

18. Processors and Service Providers

We may use service providers for analytics, uptime monitoring, or push delivery. These providers may process limited technical data on our behalf under contract.

We require service providers to follow appropriate safeguards and security practices where available.

19. International Transfers

Service providers may operate in different countries. When required, we apply safeguards to protect data in cross-border transfers.

20. Data Minimization

We collect only the minimum data necessary to operate and improve zyFOCUS. We do not collect the content of your tasks, notes, or calendar items by default.

21. Do Not Track

Some browsers offer a "Do Not Track" signal. We do not respond to DNT signals in a standardized way because no industry standard exists.

22. Contact

Questions about privacy can be sent to zyservicesg@gmail.com.