Privacy Policy

Effective and last updated: 21 October 2026

This policy explains what information Focus Action collects, how we use it, who can see it, and the choices you have. It covers the website focusaction.arimailabs.com, the installable web app, the Focus Action Guard browser extension and the Focus Action Android app (together, "Focus Action"). Focus Action is made by Arimai Labs, the trading name of MD. AKAID AHMED ARSHAD, a sole proprietor in Bangladesh ("we", "us").

1. Information we collect

Information you give us

• Account: your email address (to sign in with a link or code), your first name, and your age if you choose to add it.
• Profile picture (only if you add one): cut to a 256-pixel square on your device and stored in our picture storage (Cloudflare R2) in a folder only your account can open; shown in the app header and Account. Remove it in Account any time. If you signed in with Google and add none, the app shows your Google picture.
• Continue with Google (if you use it): Google tells us your Google account's email address, name and account id (and the link to your profile picture), and we save your first name from it if you have not set one. We ask for nothing else from your Google account at sign-in, and we never post or change anything there. In the Android app, the account is picked in Android's own Google sign-in sheet; the same details reach us.
• Your content: Cloud Notes (their text, formatting and pictures — Cloud Notes are only open to Focus Action's own admin account; other accounts keep only notes made before October 2026, which they can read and delete), tasks, timer and app settings, your block list of sites, and YouTube links you play in Sounds.
• Google account (only if you press Connect Google Calendar): the email of the Google account you pick, a Google access key (refresh token, stored encrypted, readable only by our server) and the permissions you granted: read your calendar events (calendar.events.readonly) and your tasks (tasks.readonly). Each time your app updates, our server reads that day's events (title, start, end) and open tasks due that day or earlier (title, due date), passes them to your app and does not keep them; your app saves them as tasks. Disconnect deletes the key and withdraws it at Google.
• Google Calendar address (only if you paste one instead): the secret iCal address you paste (saved with your settings), and tasks made from today's events (title, time, an event id). The calendar itself is fetched by our server when your app asks and passed straight to your device — we do not store it; your device picks out today's events. Anyone who has that address can read your calendar, so keep it private; you can reset it in Google Calendar at any time.
• Accountability partners: the email address and optional name of each partner you add.
• Unlock requests: the reason you type and the minutes you ask for when you request an unlock code.
• AI partner (only if you press Ask AI): your reason, the site or app, the minutes asked, the AI's answer (yes/no, minutes, its short reply) and when — kept for 30 days to count the daily limits. The same when you ask the AI to remove a site or app from your block list (then also its kind, e.g. "entertainment").
• Sleep journal (only what you log): for each night or nap — when you went to bed and woke up, how long it took to fall asleep, what you did before sleep (book, phone, …), how rested you felt and a note. Kept in your browser and, when you are signed in, in our database so your devices match; only you can see it. Delete any entry from the journal. Your time zone and morning reminder time are saved with your settings so the reminder comes at your own 9:45 (or the time you pick, or never).
• Habit tracker (only what you add): each habit's name, icon, the weekdays it is due, how many times a day, and which days you ticked it. Kept in your browser and, when you are signed in, in our database so your devices match. Delete a habit any time (it is gone for good after 30 days).
• Parent control (only if you add a child, or accept a parent): the child's email and the name the parent gives, whether the child accepted, and whether the AI partner may open things for the child. People a parent adds as code givers are saved like partners.
• Kinds of blocked sites: the kind you pick for each blocked site (social media, messaging, entertainment, adult, other), saved with your settings, and requests to remove a site or app during a lock (the site or app, its kind, your reason) — shown to your partners like unlock requests.

Information created when you use Focus Action

• Activity: completed focus and break sessions (length and time), streaks, and the shared timer state that keeps your devices in step.
• Screen time (optional): if you turn it on, minutes per website per day on each computer with the extension, and minutes per app per day (with the app's name) on each phone with the Android app.
• App lock: when a lock starts and ends, unlock requests, their 8-digit codes, their status (waiting, approved, expired, replaced) and when a site was unlocked on a device.
• Devices: a name and type for each signed-in browser (for example "Chrome on Windows · laptop"), when it was last active, and its sign-in session, so you can see and log out your devices.
• Music history: the YouTube videos you played in Sounds (video id, title, channel and time), so you can play them again.

Information from your device and browser

• Stored in your browser: notes, settings, tasks, sessions and timer state are saved in your browser's local storage, and a custom background image you upload stays in your browser only and is never uploaded.
• Notifications: if you turn on code-request notifications, your browser gives us a push subscription (a delivery address and encryption keys) for that device.
• Camera: used only when you choose to scan a login QR code. The image is processed on your device and is never uploaded or stored.
• Focus Action Pro (if you buy it): payments are made to Paddle.com, our reseller and Merchant of Record. From Paddle we receive and keep your plan (monthly, yearly or lifetime), its status (trial, active, cancelled), the trial and renewal dates and Paddle's customer and subscription ids — never your card details. If you own a family plan we keep the emails of the people you add, so they get Pro when they sign in with them.
• Technical data: like most websites, our hosting and database providers receive standard request data such as IP address, browser type and time of the request, and keep it in short-lived logs for security and reliability.

What we do not collect

Apart from the optional Screen time below, we do not collect your browsing history. We never collect contacts, precise location, microphone audio, card or bank details (Paddle handles payments) or the content of the pages you visit. We do not use advertising, cross-site tracking or analytics cookies.

2. The Focus Action Guard extension

The extension exists to help you stay focused: it covers the sites on your block list with a lock screen while your app lock runs, and — only if you turn it on — shows how much time you spend on each site.

• On every page it reads the address of the tab (its site name) and compares it with your block list locally, on your computer. For the lock, addresses are not stored, logged or sent anywhere.
• Screen time (off unless you turn it on in Settings → Screen time): while a tab is on screen and you are using it, the extension adds up the minutes per site name (for example "youtube.com: 42 min") for that day. Every few minutes it uploads those daily totals for this computer to your account, together with the computer's name (for example "Chrome on Windows"), so you can see them in Stats; while offline they wait on the computer. If the extension is added again it reads this computer's last days back from your account and counts on from there. It never records full addresses, page titles, page content, what you type or click. Daily totals are kept for 60 days; you can clear them any time in Stats, and turning Screen time off stops the counting.
• It stores locally: a random status key that links the extension to your account, a random device id, a random install id (so this computer keeps one device id in your account when you sign out and in), your block list and the latest lock status.
• It sends to our server only what the lock needs: the status key and device id (to check whether a lock is running and whether this device is unlocked), and, when you ask for an unlock, your reason, minutes and the device name ("Chrome on Windows"), and the code you enter.
• It does not read page content, forms or passwords, and it does not change pages that are not on your block list.
• Before you sign in a welcome page explains each permission and how your data stays safe. Site access on all sites lets the lock screen appear on any site you lock; Allow in Incognito (your choice) runs the same site-name check in private windows, so they do not skip the lock. If one is off, the extension shows "!" and asks again when your browser starts.

The use of information received through the extension follows the Chrome Web Store User Data Policy, including its Limited Use requirements: we use it only to provide the lock feature you see, we do not transfer it to others except as described in this policy, and we never use it for advertising or sell it.

The Focus Action Android app

The Android app shows the Focus Action website and adds a blocker: while your app lock runs, apps that belong to the sites on your block list (for example YouTube, Facebook, Instagram, TikTok) are covered with a lock screen.

• Usage access: with your permission (Android Settings → Usage access) the app reads, on your phone, which app was last brought to the screen while a lock runs, and compares it with your block list on the phone. For the lock this is not stored, logged or sent anywhere.
• Screen time (off unless you turn it on in Settings → Screen time): the app adds up, on the phone, how many minutes each app was on screen per day — the same usage data Android's Digital Wellbeing shows — and every 10 minutes uploads those daily totals for this phone (app name or, for apps like YouTube, the site name, and minutes) so you can see them in Stats. It never records what you do inside apps. Kept for 60 days; clear it any time in Stats.
• Site lock in browsers (only in the separate "site-lock" edition of the app, an Android accessibility service you turn on): while a lock runs it reads only the address shown in the address bar of supported browsers (Chrome, Samsung Internet, Firefox, Edge, Brave and others), takes the site name, and compares it with your block list on the phone. It does not read pages, forms, passwords or other apps, and it does not store or send addresses.
• Display over other apps: used only to bring up the lock screen over a locked app.
• Closing locked apps: while a lock runs, a locked app that is still on screen in a floating video window or split screen is paused (the app takes the sound), covered by the lock screen and then closed, so it cannot keep playing. Apps you did not lock are never touched.
• Apps to lock: when you choose apps to lock, the app lists the apps installed on your phone so you can pick; the list stays on the phone. Only the apps you pick (their names and package ids, e.g. "WhatsApp, com.whatsapp") are saved with your settings, so your other devices can show and change the choice.
• It stores on the phone the same things as the extension: a random status key, a random device id, your block list and the latest lock status. It sends to our server only the status key and device id, every 30 seconds, to check whether a lock is running and whether this phone is unlocked.
• One device id per phone: so reinstalling or updating the app keeps the same device (and its screen time) in your account, the app makes a key from Android's id for this app (Android gives each app its own; it changes with a factory reset). The key is hashed on the phone, then hashed again with your account into your device id — the Android id itself never leaves the phone. It is not used for ads or to track you across apps.
• Camera: the app asks for it when you set it up (you may say no), but uses it only when you scan a login QR code, as on the website — the picture is read on the phone and never saved or uploaded. A notification shows while the blocker runs; you can remove the app any time.
• Notification access (optional, Google Play and site-lock editions): Android only lets apps with this access see which app is playing a video and press its pause. Focus Action uses it for that alone: during your lock, a video from a locked app is paused. It never reads your notifications or messages, stores nothing, sends nothing, and does nothing while no lock runs.
• Permissions before sign-in: when the app opens, a setup screen asks for each permission above (and notifications and "no battery limit", so Android does not stop the blocker), each with why it is needed and how your data stays safe. You may say "Not now"; anything still off is asked again the next time you open the app.

3. How we use information

• To provide Focus Action: sign you in, sync your tasks, settings, sessions and timer across devices, and run the app lock.
• For accountability: deliver your unlock requests and codes to your partners, and show the history of requests to you and your partners.
• To notify you: send sign-in emails and, if you turned them on, push notifications about code requests.
• To keep it safe: prevent abuse (for example limiting wrong code attempts), protect accounts, and fix problems.
• To improve it: understand and fix errors. We do not build advertising profiles.

4. How information is shared

Inside Arimai Labs

To run and improve Focus Action, our admins see an admin page with totals (how many people use each feature) and a list of accounts: email, first name, when the account was made and last used, and counts such as devices, focus sessions this week, notes and sleep entries. They do not see your notes, tasks, unlock reasons or codes, sleep entries, calendars or the sites you use.

Payments

Paddle.com (Paddle.com Market Ltd) sells Focus Action Pro for us as Merchant of Record. When you buy, Paddle collects your name, email, country, payment details and tax information under its own privacy policy, and tells us only what we need to switch Pro on: who bought which plan and its status and dates. See paddle.com/legal/privacy.

With people you choose

• Partners you add can see, for requests you make after you added them: your first name and email, the reason, the minutes or "end the lock", the device name, the time, the result, and — while it is valid — the unlock code. With a request that is still waiting they also see today's time on your locked sites and apps (top 5, phone and computer apart), if Screen time is on, so they can decide.
• Friends (v1.44): a friend gets your codes and requests like a partner as soon as you add them, and you get theirs once they accept. Either of you can end it.
• People who add you as their partner: you see the same information about their requests. You can stop this at any time.
• Your parent in Focus Action (only after you accept their request — they cannot add you without your yes): sees your lock and its end time, the sites and apps on your block list (and can change them), today's and this week's screen time (phone and computer, top 8 sites/apps), today's habits (names and done or not), the number of requests waiting, your unlock requests with their codes, and your code history. They can start, extend or end your lock and choose who else may give you codes. Only the parent can end the link. They never see your tasks, notes, sleep journal or calendar.
• Family plan: the person who pays sees the emails they added and whether each person has signed in; members see who owns the plan. Nobody in a family sees another member's data.
• Once a person you added signs in with that email, they can see that you added them (your name and email).

With service providers who run Focus Action for us

These providers may use the information only to provide their service to us.

For legal reasons

We may share information if the law requires it, or to protect the rights, safety or property of our users, the public or us. If Focus Action is ever transferred to another owner, this policy will continue to apply to your information unless you are told otherwise.

We never sell or rent your personal information.

Google user data

Focus Action's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use your Google Calendar and Google Tasks data only to show today's events and tasks in your To do list. We do not sell it, use it for ads, use it to train AI models, or let people read it (except when you ask us for help or the law requires it).

5. Third-party content

• YouTube: when you play music or paste a YouTube link in Sounds, the video plays in YouTube's player and we look up its title from YouTube. YouTube receives your request under the Google Privacy Policy.
• Google Fonts: the website loads its fonts from Google Fonts, which receives your IP address and browser type to deliver them.

6. Your choices and controls

• Use without an account: everything stays in your browser and nothing is sent to our servers.
• Profile: change your first name and age any time in Account → Your profile.
• Your content: edit or delete notes, note pictures and tasks; restore or permanently delete notes from the trash; change settings and your block list (when no lock is running).
• Google Calendar: Settings → Google Calendar → Disconnect removes the connection (and withdraws our access at Google) or the pasted address, and the calendar tasks you have not started. Deleted calendar tasks are not added again. You can also remove Focus Action's access any time at myaccount.google.com/permissions.
• Unlock history: use Clear in the Lock panel to delete your finished requests.
• Partners: remove a partner, or stop getting someone's codes, in Account → Partner.
• Notifications: turn them off in Account → Partner or in your browser settings. Signing out turns them off for that browser.
• Devices: log out any device from Account → Your devices.
• Screen time: off by default; turn it on or off in Settings → Screen time, and clear saved totals in Stats.
• Extension: remove it any time from your browser's extensions page; its local data is removed with it.
• Android app: turn off Usage access, Display over other apps or the Focus Action site lock (Accessibility) in Android Settings, or uninstall the app; its local data is removed with it.
• Delete your account: in the app, Account → Delete my account (see how), or email us from the address you sign in with (see Contact us) and we will delete your account and its data within 30 days.

7. How long we keep information

• Account data, notes, tasks, settings, sessions and partners: until you delete them or your account. Deleted notes (and their pictures) stay in the trash for 30 days, then are removed. Pictures are stored privately — only your signed-in account can open them.
• Unlock requests: only your 15 most recent finished requests are kept; older ones are deleted automatically, and you can clear them sooner.
• Screen time: daily totals for 60 days.
• Unlock codes: valid for 15 minutes; after 10 wrong tries the request is cancelled.
• Login QR requests: expire after a few minutes and are deleted afterwards.
• Login PIN (if you set one): kept only as a salted hash — nobody, not even us, can read the PIN back. It is checked when a new device signs in with a QR code and deleted with your account.
• Push subscriptions: until you turn notifications off, sign out, log the device out, or the browser stops accepting them.
• Technical logs at our providers: kept for a short period under their policies.
• Copies in provider backups may remain for a limited time after deletion before they are overwritten.

8. Security

Data is sent over encrypted connections (HTTPS). Every table in our database is protected so each person can reach only their own data; codes are shown only to partners; extension keys can only read lock status and ask for or redeem a code; and push notifications are encrypted so that the push service delivering them cannot read them. No system is perfectly secure, so please keep your email account safe — it is the key to your Focus Action account.

9. Legal bases and your rights

Where data protection laws such as the GDPR apply, we rely on:

• Contract: to provide the features you sign up for (accounts, sync, app lock, partners).
• Consent: for push notifications, Screen time, the camera for QR login, and the optional age field. You can withdraw consent at any time.
• Legitimate interests: to keep Focus Action secure and working, balanced against your rights.

Depending on where you live, you may have the right to access, correct, delete or download your information, to object to or restrict some uses, and to complain to your local data protection authority. Contact us to use these rights; we will answer within 30 days.

10. International transfers

Our providers may store and process information in countries other than yours. When they do, we rely on their safeguards (such as standard contractual clauses) so your information keeps a similar level of protection.

11. Children

Focus Action is not directed to children under 13, and we do not knowingly collect their personal information. A younger child should use it only with a parent or guardian — for example with parent control, where the parent adds the child's account and the child accepts. If you believe a child under 13 has given us personal information, contact us and we will delete it.

12. Changes to this policy

We may update this policy as Focus Action changes. We will change the date at the top, and for important changes we will let you know, for example with a notice in the app, before they take effect.

13. Contact us

Questions, requests or complaints about privacy:
Arimai Labs (MD. AKAID AHMED ARSHAD) — akaidahmedarshad@gmail.com
WhatsApp: @arshadahmedarshad
Website: focusaction.arimailabs.com