Privacy Policy

1. Your focus data

Focus sessions, task labels, catch history, island layouts, character choices and preferences are stored on your device. Names and task labels may contain personal information if you choose to enter it. Basic focus is available without an app login.

On iOS, optional iCloud sync stores records in your own iCloud account using Apple CloudKit. On Android, the separate Cloud record sync setting is off until you sign in and explicitly enable it. It merges existing finished focus records into your current Stillfin account on our server, including record IDs, dates, durations, focus mode, task labels, catch results and points. It also downloads that account’s records to the device. Private journal notes, running timers and the allowed-app list are not uploaded by record sync. Android record sync does not automatically import or synchronize your iCloud history.

2. Optional sign-in

Apple or Google authorization uses the provider’s sign-in interface. Our server verifies the credentials and stores your app account ID, provider identifiers, nickname, island name, sessions and encrypted provider refresh credentials needed to keep access secure and revoke authorization. Firebase Authentication is also used to associate existing account identities during migration. We do not receive your Apple or Google password. Sign in with Apple may provide a private relay email address.

Android signs in through your external browser. A temporary authorization state and one-time provider code are used to finish this flow. The server encrypts stored provider codes and expires unfinished attempts. The app protects its saved login verifier and session tokens with Android Keystore-backed encryption; they are excluded from app backups and record exports.

3. Friends and shared islands

Our server stores island cards, friend relationships, island-sharing preferences, shared island snapshots and focus invitations. A card recipient can add you as a mutual friend. Only friends can view your island, and only while you enable the island-sharing setting. Closing the island or removing a friend revokes the corresponding access. A focus invitation is addressed to a specific friend and is valid for 30 minutes; a room lasts up to 24 hours. Participants can see each other’s nickname, character, displayed focus duration and activity status. Personal focus records and intentions are not included in the shared island. On iOS, nearby rooms use Apple Multipeer Connectivity over the local network. Deleting your app account removes the social data associated with it from our database. Information already seen or saved by another person cannot be recalled.

Optional profile photo. You may choose a profile photo using the system photo picker, which gives the app access only to the image you select. The image is cropped and compressed on your device; re-encoding removes EXIF/GPS metadata before the processed photo is uploaded to our own service and linked to your Stillfin account. Only you and your currently linked friends can read the photo through authenticated requests; it has no public image URL. Choosing the character avatar again deletes your current photo from the active service, and deleting your Stillfin account also deletes its associated photo. Copies in protected service backups are handled under the existing backup-retention rules and may remain until those backups are removed; these actions do not erase backup copies immediately.

4. Purchases and subscriptions

For App Store purchases, Apple processes payments. Our server sends purchase verification information to RevenueCat and stores verified entitlement status. RevenueCat processes purchase history, product IDs, receipts or transaction information, entitlement status and a pseudonymous app user ID, which may retain an existing Firebase user ID for purchase continuity. Provider services may also process device, app, timestamp and network information needed to deliver and secure purchases. We do not receive your bank-card details. Focus intentions, catch history and friend lists are not sent to RevenueCat by our app.

5. Device permissions

On iOS, Screen Time / Family Controls is optional and applies the focus restrictions you select using Apple’s privacy-preserving application tokens. Local-network access supports nearby multiplayer on iOS.

On Android, the optional Allowed Apps mode uses AccessibilityService only after a separate in-app explanation, your affirmative consent and enabling the service in Android Settings. During a session you start in this mode, it reads the foreground app’s package identifier to show a focus shield over disallowed apps. It does not retrieve screen contents, text, passwords, browsing URLs or screenshots, or operate other apps on your behalf. The app picker reads locally available app labels, icons and package identifiers; your selected allowed-app list stays on your device. These identifiers and accessibility events are not uploaded, shared with service providers or used for advertising. The service is not an accessibility tool for people with disabilities. You can disable it in Android Settings, and basic focus works without it.

Android notifications and alarm access support the timer and local reminders. The current Android version does not upload a push-notification token or send remote inactivity notifications. Background audio plays the ambience you choose. System share and document pickers access only the destination or recipient you select for an export. You can change available permissions in your device’s Settings. The app does not include advertising or cross-app tracking.

6. Website and support

This support website serves static pages without advertising trackers or analytics scripts. The web server may record IP addresses, request paths, timestamps and user-agent information for security and troubleshooting. If you email us, we receive the address and message you send and use them to respond. Please do not send passwords, payment credentials or sensitive personal information.

7. Service providers and international processing

We use Apple services, Google / Firebase Authentication and RevenueCat for the functions described above. Their processing locations may differ from your country, subject to their applicable privacy terms and safeguards. The current Android version has no payment SDK or in-app purchasing flow; it can check existing account entitlements through our server.

If you choose to submit a rating or review through Google Play’s review interface, Google Play processes your rating and review text. A published review can be public; closed-test feedback is shared privately with the developer. You can manage or delete it through Google Play or your Google Account. The app does not read what you typed into that interface. Review the provider privacy information linked below. We do not sell personal information or use it for cross-app targeted advertising.

8. Retention, deletion and your choices

On-device data remains until you erase it in the app or remove it through the device’s storage controls. iCloud data can remain after uninstalling the iOS app. Settings → Delete Account starts the app’s deletion flow; read its confirmation screen for the exact scope.

On Android, disabling record sync or signing out stops further sync but does not delete records already stored on your device or in your account. Deleting the Stillfin account removes its server profile, social data and synchronized focus records, and the app clears its local account data and private export caches. If cleanup cannot finish, the app retains the pending deletion so you can retry. Files you have saved outside the app and copies you have shared with others are not recalled. You can also stop sharing an island or contact us to request deletion.

Purchase providers may retain transaction records where required for legal, tax, fraud-prevention or billing purposes. Deleting app data or an account does not cancel an App Store subscription: manage it in your Apple subscription settings. Contact us to request access, correction or deletion of information we control, or to exercise other rights available under applicable law.

9. Children and security

Stillfin is not specifically directed to children under 13. If you believe a child provided personal information without appropriate permission, contact us. We use platform security and access controls, but no system can promise absolute security. Protect your device, iCloud account and shared links.

10. Changes and contact

We may update this policy when the app or its services change. The effective date appears at the top of this page. Developer: 吴少强 (Wu Shaoqiang). Email: fguby1995@gmail.com.