Privacy Policy

Effective: May 14, 2026 · Last updated: August 6, 2026 (v7)

Student Focus ("we", "our", "us", or the "Service") is operated by an individual developer based in Quebec, Canada. This Privacy Policy explains, in plain language, what personal information we collect, why we collect it, how it is used and shared, and the rights you have over it. It is written to comply with Canada's PIPEDA, Quebec's Law 25 (the Act respecting the protection of personal information in the private sector, as amended), California's CCPA/CPRA, and the U.S. federal COPPA.

The short version: We collect your school email for sign-in. The setup choices needed to restore your account, including selected app identifiers, time windows, daily limits, and override mode, are stored in our backend. On Android, a selected identifier is the app's package name. Apple's app-selection tokens stay on the device. If you allow notifications, we store an Expo push token and a random installation identifier so we can deliver Friend Control and account notices. Usage samples, focus history, and block-attempt counters stay on your device. We do not show ads, sell personal information, run analytics, or track you across other apps for advertising.

1. Who We Are & Privacy Officer

The data controller is the developer of Student Focus, based in Quebec, Canada.

Under Quebec Law 25 we are required to designate a person responsible for the protection of personal information. That person is:

Privacy Officer: the developer of Student Focus
Email: livefonam@gmail.com

You can use this address for any privacy-related request, complaint, or question.

2. What Personal Information We Collect

We collect only what is needed for the Service to work. Categories (CCPA §1798.110 framing):

Category	Examples	Where it lives
Identifiers	Your school email address	Supabase (US) + your device
Authentication state	Session token	Encrypted secure storage on your device
Android app and usage information	Package identifiers and display labels for launchable apps, package identifiers selected for blocking, recent foreground-usage totals, and package identifiers reported in window-change events after you grant the relevant permissions. The Accessibility Service is configured not to retrieve window content.	Processed on your device. Selected package identifiers and their configured limits and schedules are also stored in Supabase for account restoration. App labels and usage totals are not uploaded.
iOS app-selection information	Opaque application, category, or web-domain tokens returned by Apple's Family Activity Picker	Native storage on your device and its app extension. The tokens and selected app names are not available to our server. A generic selection marker may be stored with your server setup.
Setup preferences	Selected app identifiers, daily limits, time windows, override method, enforcement mode, and setup-completion time	Supabase (US) and your device, so supported setup choices can be restored after sign-in
Friend Control pairing data	A SHA-256 hash of a random 10-character invite code, the Supabase user IDs of the two participants, and creation, approval, revocation, and expiry timestamps. The raw invite code is sent over HTTPS to server functions for registration or matching but is not stored in the database.	Supabase (US). Raw invite codes you generate or accept are kept in encrypted secure storage on the participating devices.
Notification delivery information	An Expo push token, a random per-installation identifier, platform, Expo project identifier, app version, notification event type, delivery status, and limited provider error details. Friend Control events may reference the related pairing and participating account IDs.	Supabase (US), Expo's push service, and the operating-system push service after you allow notifications. A cached copy of your token and installation identifier is kept in encrypted secure storage on your device.
Local activity and safety state	Focus sessions, daily focus totals, any locally retained usage baseline, block-attempt counters, override grace time, and failed Friend Control code lockout state	Your device only

3. Sources of Information

Directly from you (email, settings, and Friend Control actions).
From Android system services, only after you grant Usage Access or enable the Accessibility Service.
From Apple's Family Activity Picker and Screen Time frameworks after you authorize Family Controls. The current iOS build does not import raw daily Screen Time totals into the main app.
We do not purchase or receive personal data from data brokers or third parties.

The age entered during onboarding is used in memory for the eligibility check and is not stored in your profile or uploaded.

4. Why We Collect It (Purposes & Legal Bases)

Data	Purpose	Legal basis
School email	Verify your identity, create your account, sign you back in	Necessary to perform our contract with you
Setup preferences	Restore supported setup choices after sign-in and configure blocking	Necessary to perform our contract with you
Android app and usage information	Populate the on-device app picker, show an onboarding usage comparison, and enforce the limits and schedules you set	Your explicit OS-level permission and our legitimate interest in delivering the feature
iOS app-selection tokens	Apply Apple's shields and activity schedules to the apps or categories you select	Your explicit OS-level authorization and our legitimate interest in delivering the feature
Friend Control pairing data	Require explicit approval, validate current access, revoke access, enforce expiry, and limit repeated invite-claim attempts	Your choice to enable the feature and our legitimate interest in preventing unauthorized overrides
Notification delivery information	Deliver the Friend Control and account updates you choose to receive, prevent duplicate sends, rate-limit abuse, and troubleshoot delivery failures	Your notification permission and our legitimate interest in reliable, secure delivery

If you ever gave consent that you want to withdraw, email the Privacy Officer. Withdrawing consent will end your ability to use parts of the Service that depend on that data.

5. Who Else Sees Your Data (Third-Party Service Providers)

Student Focus relies on the following third-party services. Each receives only what is necessary for its narrow job:

Service	What it receives	Where it processes
Supabase	Your email, authentication records, session handling, setup profile, selected Android package identifiers or generic iOS selection marker, configured limits and schedules, Friend Control rows, and notification registration and delivery records. Friend Control server functions receive raw invite codes over HTTPS to hash or compare them, but the database stores only the hash. Usage totals, focus history, block-attempt counters, Apple selection tokens, and Android app labels are not uploaded.	United States. See privacy policy
Expo	Used for the app's build toolchain, notification library, and push-delivery service. Over-the-air updates are disabled in this version. After you allow notifications, Expo receives an Expo push token and the fixed notification content and routing data needed to deliver relevant Friend Control or account notices.	United States. privacy policy
Apple Push Notification service or Firebase Cloud Messaging	The operating-system notification service receives the delivery token and notification content needed to show a notification on your iOS or Android device.	Handled under Apple's privacy policy or Google's privacy policy, depending on your device.

We do not work with any analytics SDKs, trackers, or advertising networks, and the App contains no advertising SDK. The Self Control override includes a fixed waiting period before a block can be lifted; this is a timer only, not an advertisement.

6. What We Do Not Do

We do not sell your personal information.
We do not share your personal information for cross-context behavioral advertising.
We do not show advertisements. The App contains no advertising SDK; the Self Control override is a plain timed waiting period.
We do not use analytics SDKs (no Firebase Analytics, no Mixpanel, no Amplitude, etc.).
We do not use crash-reporting SDKs that send data off-device.
We do not request Apple's IDFA (advertising identifier) or show the App Tracking Transparency prompt.
We do not access your contacts, photos, camera, microphone, or precise location.

7. Cross-Border Transfer of Personal Information

Supabase and Expo operate in the United States. Supabase processes the account, setup, and notification-delivery information listed above, while Expo processes build and push-delivery data. Apple or Google may process push delivery for the operating system. School-email eligibility is checked against a domain list bundled into the App, so that check does not make a separate request to a public list provider.

Under Quebec Law 25 §17, we assess cross-border handling of personal information, including:

Necessity and proportionality: We limit server data to authentication, supported setup restoration, and optional Friend Control operation.
Security: Network requests use HTTPS. Authentication sessions and raw Friend Control secrets are stored on your device using OS-level encrypted storage such as iOS Keychain or Android Keystore.
Legal risk: U.S. law (including the CLOUD Act) may allow lawful-access requests by U.S. authorities. We will challenge any overbroad request to the extent legally possible.

Using account features involves the cross-border processing described above.

8. Your Rights. Canada & Quebec

If you live in Canada, including Quebec, you have these rights:

Access: Ask us what personal information we have about you.
Rectification: Ask us to correct inaccurate information.
Deletion / Cessation of dissemination: Ask us to delete your account and the personal data we hold for you.
Data portability (Quebec Law 25 §27): Ask us for a copy of your data in a structured, commonly used technical format.
Withdraw consent: At any time.
Complaint: If you are not satisfied with how we handled your request, you may complain to:
- Commission d'accès à l'information du Québec. cai.gouv.qc.ca
- Office of the Privacy Commissioner of Canada. priv.gc.ca

We will respond within 30 days of receiving a verified request.

9. Your Rights. California (CCPA / CPRA)

If you live in California you have:

Right to know what personal information we collect and how it is used.
Right to delete personal information we hold about you.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing. We do not sell or share for cross-context behavioral advertising. There is nothing to opt out of, but you have the right anyway.
Right to limit use of sensitive personal information. We do not use sensitive PI for inferring characteristics, so this right is effectively already honored.
Right to non-discrimination: we will not deny you the Service or charge a different price for exercising any of these rights.

To exercise any of these rights, email livefonam@gmail.com. We will verify your request (typically by confirming control of the email on file) and respond within 45 days as required by CCPA. An authorized agent may submit a request on your behalf with your written permission.

10. Data Retention

Your email, authentication record, setup profile, block settings, and Friend Control rows remain at Supabase while your account is active. Friend Control invitations and approvals stop authorizing access when they expire, but their status rows may remain as history until account deletion.
Enabled push tokens remain tied to your account until they are replaced, unregistered, disabled after a delivery failure, or removed with account deletion. Push event and delivery records are designed to be pruned after 30 days when subsequent notification requests run.
Successful in-app account deletion removes the authentication record and the application rows associated with your Supabase user ID immediately through a server function. A verified email request is handled within 30 days.
Reset local data resets the main local profile, block targets, focus sessions, charts, counters, schedules, and active-session state. It stops manual and automatic native blocking, clears the private Apple app selection or Android package selection, and cancels the pending local session reminder. It does not delete your account, server setup, Friend Control pairing rows or encrypted Friend Control secrets, and it does not revoke operating-system permissions.
Enforcement-loosening edits and setup replay use the configured Self Control or Friend Control gate. Resetting local data and deleting the account remain available after their own explicit destructive confirmations, without completing that override gate.
Uninstalling normally removes sandboxed app storage. iOS may retain Keychain items after uninstall according to operating-system behavior. Use in-app account deletion before uninstalling if you want the account and known secure-storage values removed.
Authentication logs at Supabase (sign-in attempts, IP addresses they may record) are retained per Supabase's policy.

11. Children (COPPA & Quebec Law 25 §14)

Student Focus is intended for students aged 13 or older with a valid school email. Onboarding asks for age to enforce that threshold, but the entered age is not stored or uploaded. We do not collect a date of birth. If we learn that an account belongs to a child under 13, we will delete it. Quebec residents aged 14 to 17 may provide consent on their own behalf where Quebec law permits.

We do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and you believe your child under 13 has created an account, please email us and we will delete it.

12. Security

We take security seriously, but no system is perfect.

All network traffic is over HTTPS / TLS.
Focus history, settings, usage baseline, counters, and override timing state use the app's sandboxed storage. We do not add a separate encryption layer to that general local storage.
Authentication sessions and raw Friend Control invite codes use iOS Keychain or Android Keystore through Expo SecureStore.
Server access is restricted with Row Level Security, narrow grants, and authenticated server functions. RLS remains enabled.

If a security incident presents a risk that requires notification, we will notify the Commission d'accès à l'information du Québec and affected people as required by applicable law.

13. iOS Screen Time & Android Usage Access

The two platforms provide different information and enforcement tools. Student Focus uses them only after you grant the relevant operating-system permission:

iOS: Apple's FamilyControls, ManagedSettings, and DeviceActivity frameworks. You will see Apple's permission prompt when authorization is requested. During setup, Apple's report extension can display today's total for the current device inside a private report before the Reality Check. The report does not export that number to the main app, local storage, or our server. Apps and categories are selected through Apple's FamilyActivityPicker, which returns opaque tokens that the native app and extension use to apply shields and schedules. We do not receive the selected app names or bundle identifiers. A setup estimate or baseline is not presented as measured Screen Time history. You can revoke Family Controls access in iOS Settings.
Android: Usage Access and an Accessibility Service. The app queries launchable apps locally to show package identifiers and display labels in its picker. Usage Access can provide recent per-app foreground totals for the onboarding comparison and daily-limit enforcement. While enabled, the Accessibility Service continuously receives a package identifier when the foreground window changes. It redirects only a selected app while a focus session or configured automatic schedule or limit applies. The redirect first sends the device to the Android Home screen and falls back to reopening Student Focus if that action fails. The service is configured with canRetrieveWindowContent="false", so it does not read on-screen text, controls, or other window content. You can revoke Usage Access or disable the Accessibility Service in Android Settings.

Apple selection tokens, Android app labels, raw usage totals, focus history, and block-attempt counters stay on the device. Selected Android package identifiers and configured limits or schedules are stored with your server setup as described above.

14. Friend Control (Optional Feature)

If you enable Friend Control, you can ask one trusted friend to be your accountability partner. When you do:

Registration and claim: A random 10-character invite code is sent over HTTPS to authenticated server functions when it is registered or claimed. The database stores a SHA-256 hash, not the raw invite code. Once claimed, the row links the two participants' Supabase user IDs.
Approval: Claiming an invite creates a pending request. Your friend cannot view a rotating override code until you explicitly approve the request. Approval records a timestamp and extends the pairing expiry to 30 days after approval.
What the friend sees: After approval and a live server-status check, the friend's device computes and displays a rotating 6-digit code from the shared invite code. The friend does not receive your blocked-app list, stats, email, or usage information.
What you see: Pending and historical pairing requests in your "Incoming requests" inbox, including the last four characters of the friend's Supabase user ID and the request timestamp. You do not see the friend's email or any other personal data about them.
How rotating codes work: The 6-digit codes are calculated locally from the shared invite code and the current hour. The displayed code rotates hourly, while codes from the current, immediately previous, and immediately next hour buckets are accepted to allow for clock differences. A correct code still requires a live server check confirming that the pairing is approved, unrevoked, and unexpired.
Attempt limits: Invite claims are limited to 10 attempts in a 15-minute server window. On the controlled device, five consecutive wrong 6-digit codes trigger a 30-second local lockout. Further consecutive failures double that lockout up to 30 minutes. A successful authorized code clears the local failure count.
Updates: Supabase's real-time channel can refresh the in-app inbox while Student Focus is open. If you allowed notifications, fixed remote push messages may also tell you when a Friend Control request is created, approved, rejected, or revoked. The push sender derives the recipient from the authenticated pairing and does not accept arbitrary message text from the app.
Revoking and expiry: Either participant can revoke the pairing from the available Friend Control controls. The owner can reject a pending request or revoke an approved friend. Revoked or expired pairings cannot authorize an override. Pairings expire after 30 days and require a new approved pairing to resume access.
Deleting: When you delete your account, all rows where you are user_id or friend_user_id are deleted, regardless of approval state.

Friend Control is optional. Self Control uses a 10-second hold and a 2-minute in-app waiting period. Completing either authorized path grants a 45-minute local override grace period. Friend-granted grace is revalidated against the server and fails closed if approval cannot be confirmed.

15. Push Notifications

If you allow notifications, the App requests an Expo push token and stores it in Supabase with a random installation identifier, platform, Expo project identifier, and app version. We use it for fixed Friend Control and account notices; the sender does not accept arbitrary titles, messages, or recipients from the client. Delivery events and limited provider responses are recorded to prevent duplicate sends, enforce rate limits, and diagnose failures. The App may also schedule a local iOS "Focus session complete" reminder. You can revoke notification permission in device settings. On sign-out or account deletion the App attempts to unregister the current token, and deleting the account removes server rows linked to that account.

16. Account Deletion

You may delete your account and all associated data at any time:

In-app: Settings > "Delete my account". The app first calls an authenticated server function that removes your authentication record, profile, block settings, block and override records, and Friend Control rows in which you are either participant. After that succeeds, it stops native blocking, clears the private Apple app selection or Android package selection, clears known secure-storage values and general app storage, signs out locally, and restarts setup. If server deletion fails, the app reports the error and does not claim that deletion succeeded. If local native cleanup fails after server deletion, the app reports that separately and directs you to the relevant operating-system settings.
By email: If you cannot access the in-app option, email livefonam@gmail.com from the account address and we will perform the same deletion within 30 days.

Account deletion is irreversible. Operating-system permission choices are controlled in iOS or Android Settings and may need to be revoked there separately. Supabase may retain provider security and authentication logs under its own retention policy.

17. Changes to This Policy

We may update this Policy from time to time. When we do, we will update the "Last updated" date at the top and provide any additional notice required by applicable law.

18. Contact

Questions, complaints, or requests about your data: livefonam@gmail.com

Back