Privacy Policy

Superfocus is operated by SuperOS Labs Limited, a company registered in Hong Kong (“Superfocus”, “we”, “us”).

For users in the European Economic Area and the United Kingdom, SuperOS Labs Limited is the data controller of your personal data.

If you have any questions about this policy or your data, contact us at help@superfocus.me.

Account and profile

You can register with your email address and password, or sign in with Google or Apple. When you register, we collect your name, email address, profile image, date joined, and a user ID. If you use Google or Apple sign-in, we receive basic profile information from that provider with your permission.

Payment and billing

If you purchase a subscription, payments are processed by Stripe. Stripe collects your payment card details directly — we never see or store your full card number. We receive and store your billing name, email, the last four digits and card brand, subscription status, and transaction history so we can manage your subscription and comply with tax and accounting law. Stripe's handling of your data is described in Stripe's Privacy Policy.

Content you create

Superfocus is built around your goals, seasons, plans, tasks, notes, and reflections. We store this content so the Service works, and we treat it as private to you. Some of it may reveal personal things about your life — that's inherent to a planning tool — and it is only processed to provide the features described in this policy.

Calendar and task data

If you connect a calendar or task provider (Google Calendar, Google Tasks, Microsoft Outlook, iCloud Calendar, calendar feeds you subscribe to via ICS, or Todoist), we access your calendar list, events (titles, times, organizer, and attendees) and task lists (titles, notes, and due dates) to show your schedule inside Superfocus, keep it in sync, and export blocks you plan in Superfocus back to your calendar. Section 6 describes our handling of Google user data in detail.

Meeting notes integrations

If you connect a meeting-notes tool (such as Fathom or Granola), we access your meeting summaries and notes with your permission so Superfocus can plan around what's really going on in your work. Meeting notes may include information about other people (such as meeting participants). We process this data only to provide Superfocus features to you, and you should only connect these tools where you are permitted to share that content. You can disconnect any integration at any time from within Superfocus.

Slack integration data

If you connect Slack, Superfocus accesses your Slack workspace using a user token (no bot is added to your workspace) and only with the scopes you authorize. With your permission, we access and store:

• Your Slack profile information (such as your display name and current status), so we can set and later restore your status during focus sessions
• Your Do Not Disturb (DND) state, so we can enable DND during a focus session and restore your previous setting afterward

We do not read your Slack messages. You can disconnect Slack or revoke access at any time from your Slack settings or from within Superfocus.

Zoom integration data

If you connect Zoom (provided by Zoom Video Communications, Inc.), Superfocus can create, view, update, and delete the Zoom meetings it creates for meetings you schedule in Superfocus. We only touch meetings created by Superfocus, and we do not read your Zoom recordings, chats, transcripts, or other meetings. We store:

• Your Zoom OAuth tokens, encrypted at rest (AES-256-GCM)
• Your Zoom user and account ID, so we can handle deauthorization requests from Zoom

The Zoom join link is stored on the meeting record in Superfocus, like any other meeting link. You can disconnect Zoom from within Superfocus or remove Superfocus from your Added Apps in the Zoom App Marketplace. When you do, we delete your stored Zoom tokens.

Focus sessions and distraction blocking

When you use focus mode, we store your focus session data (session times, the task you focused on, and any blockers or notes you record). If you enable app and website blocking, your block lists are stored so they can sync across your devices. Blocking is enforced on your device; we do not collect a log of your general browsing history to provide blocking.

Reality Tracking (optional)

If you enable Reality Tracking on macOS, Superfocus periodically captures your screen and active-window information (app names, window titles, and URLs) to build a summary of how you spent your time. This is off by default and requires both your explicit opt-in and macOS screen-recording permission.

Captures are processed on the fly and are never stored: we send them to our AI processing provider (Google) to generate short text summaries of your activity, then the captures are discarded. Only the generated summaries are kept, and they are deleted with your account.

You can exclude any app or website from tracking. Password managers and banking sites are excluded by default and are never captured. You can turn Reality Tracking off at any time.

Device, usage, and analytics data

We collect a device token to enable push notifications, and usage and analytics data via PostHog (such as the features you use, device and browser type, and approximate location derived from IP address) to understand how Superfocus is used, fix problems, and improve the product. PostHog is the only analytics tool we use.

Advertising data

Our marketing website uses Meta advertising tools in two ways: the Meta Pixel, which runs in your browser and collects device identifiers, cookie data, and information about your visit (such as pages viewed and actions taken); and Meta's Conversions API, through which our servers send Meta information about actions you take (such as signing up or purchasing) together with matching identifiers, which may include your IP address, browser information, click identifiers, and hashed contact details such as your email address. Meta uses this data to measure the effectiveness of our ads and reach people likely to be interested in Superfocus. We also use Google Ads conversion measurement: when you purchase a subscription, our servers send Google the purchase event together with matching identifiers, which may include the Google click identifier from the ad you clicked, your IP address, browser information, and your hashed email address. Google uses this data to measure the effectiveness of our ads. We do not run Google's advertising tag in your browser. This applies to our marketing website and sign-up flow, not to the content you create inside the app. See Sections 5, 9, and 12 for how this data is shared and the choices you have.

Support communications

If you contact us, we keep the correspondence and any information you choose to provide so we can help you and improve our support.

We use your data to:

• Provide the Service — operate your account, sync your calendars and integrations, run focus sessions, and store your plans and content (legal basis: performance of our contract with you)
• Power AI features — generate planning suggestions, coaching, and reflections, as described in Section 4 (contract)
• Process payments and manage subscriptions (contract; legal obligation for tax and accounting records)
• Send service communications — such as receipts, security notices, and material changes to the Service (contract; legitimate interests)
• Send product updates and promotional messages — you can opt out at any time via the unsubscribe link or your settings (consent, or legitimate interests where permitted for existing customers)
• Understand usage and improve Superfocus — analytics, debugging, and product development (legitimate interests; consent where required for cookies and similar technologies)
• Advertise Superfocus — measure the performance of our ads and reach relevant audiences using Meta and Google advertising tools on our marketing website (consent, where required; legitimate interests where permitted)
• Keep Superfocus secure — prevent fraud, abuse, and unauthorized access (legitimate interests; legal obligation)
• Comply with the law (legal obligation)

We never use your content, calendar data, meeting notes, or other integration data for advertising, and we do not sell your personal data. Advertising uses only data about your visits to our marketing website, as described above.

Superfocus uses AI to power planning, coaching, and reflection features. To do this, relevant fields of your data (such as your goals, task and event titles, task notes, event times, and meeting summaries) are processed by our AI providers — Anthropic, Google, and OpenAI — strictly through their commercial APIs, routed via Vercel's AI Gateway.

Under the terms of those APIs, these providers do not use your data to train or improve their models, and the data is processed transiently to generate a response for you, not retained by the provider for training or any secondary purpose. We never use your data — including any Google user data — to develop, train, or improve any machine learning or artificial intelligence models, whether ours or a third party's.

We do not sell your personal data. We share it only:

• With service providers who process data on our behalf to run Superfocus — including hosting and infrastructure (DigitalOcean for our backend and database, hosted in Frankfurt, Germany, and Vercel for our web frontend and AI gateway), payment processing (Stripe), AI processing (Anthropic, Google, and OpenAI, routed via Vercel's AI Gateway), analytics (PostHog), email and push communications (Customer.io), and push notification delivery (Apple and Google). These providers are bound by contracts that restrict their use of your data to providing services to us.
• With integration partners you connect — when you export a planned block back to your calendar, for example, that data is sent to your calendar provider under their own privacy policy.
• With advertising partners — when you visit our marketing website or sign up, we share information with Meta via the Meta Pixel (device identifiers and visit information collected in your browser) and Meta's Conversions API (event data and matching identifiers, which may include hashed contact details, sent from our servers). Meta uses this data to measure our ads and build advertising audiences under Meta's Privacy Policy, and processes some of it for its own purposes as an independent or joint controller. When you purchase a subscription, we also share the purchase event and matching identifiers (Google click identifiers, IP address, browser information, and hashed contact details, sent from our servers) with Google for Google Ads conversion measurement under Google's Privacy Policy. You can control this via the cookie and privacy settings on our website and the choices described in Sections 9 and 12; opting out stops both browser-based and server-based sharing.
• When required by law, or to protect the rights, safety, or property of Superfocus, our users, or others.
• In a business transfer — if Superfocus is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any change in ownership or in how your data is handled.

If you connect your Google account, Superfocus accesses Google user data only with the scopes you authorize:

• Google Calendar — your calendar list and events (titles, times, organizer, and attendees), to show your schedule inside Superfocus, keep it in sync, and export blocks you plan in Superfocus back to your calendar
• Google Tasks (read-only) — your task lists and tasks (titles, notes, and due dates), to import them into Superfocus when you choose to

To power planning, coaching, and task-organization features, limited fields from this data (such as event and task titles, task notes, and event times) are processed by our AI providers — Anthropic, Google, and OpenAI — strictly through their commercial APIs. Under the terms of those APIs, these providers do not use your data to train or improve their models, and the data is processed transiently to generate a response for you, not retained by the provider for training or any secondary purpose. We never use Google user data to develop, train, or improve any machine learning or artificial intelligence models, whether ours or a third party's.

We do not sell Google user data, use it for advertising, or allow humans to read it except with your consent, for security purposes, or where required by law. You can disconnect your Google account at any time from within Superfocus or via your Google Account security settings, and we delete the associated Google data with your account.

Superfocus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your account data and content are primarily stored in the European Union (Frankfurt, Germany), and our email and push communications provider also processes data in its EU region. Some of our service providers process data in the United States and other countries — including PostHog (analytics), Stripe (payments), our AI providers, Meta and Google (advertising), and Apple and Google (push notification delivery). Where we transfer personal data of users in the EEA, UK, or Switzerland outside those regions, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK Addendum or International Data Transfer Agreement where applicable) and, where a provider is certified, the EU–US Data Privacy Framework. You can contact us for more information about the safeguards applicable to a specific transfer.

We retain your data for as long as your account is active. When you delete your account (or ask us to delete it), deletion is scheduled 30 days out — during that window you can restore your account and data if you change your mind. After the 30 days, we permanently delete your records from our production systems and instruct our processors to do the same, including your Stripe customer profile and Customer.io profile. Database backups expire within a further 7 days, so your data is fully removed within approximately 37 days of your request.

We may retain limited data for longer where the law requires it (for example, billing records for tax purposes) or where necessary to resolve disputes or enforce our terms. Reality Tracking screen captures are never stored, as described in Section 2.

Depending on where you live, you have some or all of the following rights over your personal data:

• Access the data we hold about you
• Correct inaccurate data
• Delete your account and associated data (also available from within the app)
• Export your data — request a portable copy of the personal data you have provided to us in a structured, machine-readable format
• Object to or restrict certain processing, including direct marketing
• Withdraw consent at any time, where processing is based on consent, without affecting processing before withdrawal

You do not need to log in to the app to exercise these rights. Email us at help@superfocus.me and we will respond within 30 days (or sooner where the law requires). We may need to verify your identity before acting on a request.

EEA and UK users: you also have the right to lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk).

California residents: you have the rights to know, delete, correct, and port your personal information, and the right not to be discriminated against for exercising them, under the CCPA/CPRA. We do not sell your personal information for money. However, our use of Meta and Google advertising tools on our marketing website may constitute “sharing” of personal information (identifiers and internet activity) for cross-context behavioral advertising under California law. You have the right to opt out of this sharing at any time: use the cookie settings on our website, enable a Global Privacy Control (GPC) signal in your browser — which we honor — or email help@superfocus.me.

We implement industry-standard security measures to protect your data, including encryption in transit and at rest, access controls, and secure cloud infrastructure. No system is completely secure, so we encourage you to use a strong, unique password and to contact us immediately at help@superfocus.me if you suspect unauthorized access to your account.

Superfocus is not directed at children and may not be used by anyone under 16 years of age (or the age required to consent to data processing in your country). We do not knowingly collect data from children; if you believe a child has provided us with personal data, contact us and we will delete it.

We use cookies and similar technologies on our websites: essential cookies required for the Service to function (such as authentication), analytics cookies (PostHog) to understand how the site is used, and advertising cookies (Meta Pixel) to measure our ads and build advertising audiences, and an attribution cookie that remembers which campaign, ad, or link brought you to us (for up to 90 days) so we can attribute a later sign-up or purchase to it. Non-essential cookies — including analytics and advertising cookies — are blocked until you consent, and you can change your preferences at any time via the cookie settings link in the footer of our website.

We honor Global Privacy Control (GPC) browser signals as a valid opt-out of cookie-based sharing. We do not respond to legacy “Do Not Track” browser signals.

We may update this Privacy Policy from time to time. We'll notify you via the app or email when significant changes are made, and the “Last updated” date above will always reflect the current version.

Questions about this Privacy Policy or your data:

📧 help@superfocus.me

SuperOS Labs Limited