Privacy Policy

1. Who We Are

Focused Flow is a product by Ascendant Ventures Ltd ("we", "our", or "us"), a company registered in England and Wales. Our registered address is available on request. We are committed to protecting your privacy and handling your personal data in an open and transparent manner.

Focused Flow is a productivity and wellbeing application designed specifically for people with ADHD. We understand the sensitivity of the data you trust us with and treat it accordingly.

This Privacy Policy applies to our website at focusedflow.io, our mobile application ("the App"), and any related services we provide (collectively, "the Services").

For questions about this policy or to exercise your rights, please use our Contact page or submit a formal Data Subject Access Request.

2. What Data We Collect

We collect the following categories of personal data depending on how you use our Services:

Website

• Contact information: Your name and email address when you sign up for the newsletter or contact us through our website.
• Consent records: Whether you gave GDPR consent and optional marketing consent, and when.
• Communication data: Messages, feedback, or enquiries you send us via our contact form.
• DSAR records: Details of any data subject access requests you submit, including reference numbers.

Mobile Application

• Account information: Your name and email address when you create an account.
• Productivity data: Tasks, to-do items, focus session records, timer history, and habit tracking entries that you create within the App. This data belongs to you and is used solely to provide the App's functionality.
• Voice input: When you use voice commands, audio is processed on-device or via our API to convert speech to text. We do not retain raw audio recordings.
• Calendar data: If you grant calendar access, we read your calendar events to help you plan your day. We do not write to your calendar without your explicit action, and we do not store calendar data on our servers beyond your active session.
• Notification preferences: Which notifications you have enabled or disabled within the App.
• Usage data: Aggregate, anonymised information about how features are used (e.g., which screens are visited, session duration) to help us improve the App. This data cannot be used to identify you individually.
• Device information: Device type, operating system version, and app version, used for debugging and compatibility.

3. How We Use Your Data

We use the information we collect to:

• Operate, maintain, and improve the Services.
• Create and manage your account.
• Deliver the App's core features (task management, focus sessions, habit tracking, voice commands).
• Send you product updates and our newsletter — only if you have opted in.
• Respond to your enquiries, support requests, and GDPR rights requests.
• Monitor the health and performance of our systems.
• Comply with our legal obligations under UK and EU law.

We will never sell your personal data to third parties, use it for advertising, or process it for any purpose incompatible with the purposes set out in this policy.

3a. Google API User Data

Focused Flow's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What Google data we access

With your explicit permission, Focused Flow accesses your Google Calendar events via the https://www.googleapis.com/auth/calendar.events scope. This allows the app to:

• Read your existing calendar events to display your schedule and avoid scheduling conflicts.
• Create new calendar events to block focus time on your behalf.
• Update or delete events that Focused Flow created.

How we use Google Calendar data

Your Google Calendar data is used solely to provide the in-app features you have requested:

• Events are read to show your schedule inside the Focused Flow app.
• New focus-session events are written to your calendar when you request them.
• Event summaries are included in your AI voice coaching briefing to help you plan your day — this data is processed by our AI providers solely to operate this feature (see Sharing section below).
• Calendar data is never used for advertising, profiling, or any purpose unrelated to the app's features.

Sharing of Google Calendar data

Your Google Calendar data is never sold, shared for advertising, or disclosed to third parties for any purpose unrelated to providing Focused Flow's features. To power the AI voice coaching and scheduling assistant, calendar event summaries are processed by the following sub-processors:

• Microsoft Azure OpenAI (GPT-4o, hosted on Microsoft Azure infrastructure) — generates AI coaching responses that reference your schedule. Microsoft does not use Azure OpenAI API data to train its models.
• ElevenLabs (Starter plan) — synthesises AI coaching responses to speech for the voice assistant. ElevenLabs does not use paid-plan data to train its models.

No other third parties receive your Google Calendar data. These sub-processors are contractually prohibited from using your data for any purpose other than providing the service.

AI and Google user data — Limited Use statement

The use of raw or derived user data received from Google Workspace APIs (including Google Calendar) will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is processed by our AI service providers solely to operate the features you request, and is never used to train any AI or machine learning model by us or any third party.

Data protection for Google Calendar data

Google Calendar data is transmitted over TLS, stored with AES-256 encryption at rest, and subject to row-level security so only your authenticated account can access it. OAuth access tokens are stored securely and never logged or exposed.

Retention and deletion of Google Calendar data

• We do not persistently store your Google Calendar events — they are fetched in real time when you open the calendar view.
• OAuth access and refresh tokens are revoked and deleted when you disconnect Google Calendar or delete your account.
• You can revoke Focused Flow's access to your Google Calendar at any time via myaccount.google.com/permissions.

4. Lawful Basis for Processing

Under the UK GDPR, we rely on the following lawful bases:

• Consent: When you subscribe to our newsletter, grant calendar access in the App, accept analytics or marketing cookies on our website, or agree to share usage data in the App. You can withdraw consent at any time (Cookie settings on the website; Profile → Share usage data in the App).
• Contract performance: When you create an account and use the App, we process data necessary to deliver the service you have agreed to receive.
• Legitimate interests: Keeping our Services secure, preventing fraud and answering your support requests. We have assessed that these interests are not overridden by your privacy rights.
• Legal obligation: We may process data where required to comply with a legal obligation, such as responding to a court order.

5. Third-Party Processors

We use carefully selected third-party services to operate the Services. All processors are contractually bound to process your data only on our instructions and to maintain appropriate security measures. Our current processors include:

"SCCs in place" means Standard Contractual Clauses are in place to ensure UK GDPR-compliant transfers of data outside the UK/EEA.

5a. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies, including advertising pixels operated by third parties. This section explains what each technology does and your choices.

Meta Pixel (Facebook Pixel)

We use the Meta Pixel (ID: 921448967254965) on our website. This is a piece of JavaScript code placed by Meta Platforms, Inc. that allows us to:

• Measure the effectiveness of our advertising on Facebook and Instagram.
• Track when visitors view pages or take actions such as navigating to our app download page.
• Build Custom Audiences of people who have visited our site, so we can show them relevant ads.
• Use Advanced Matching to improve attribution by hashing and sending certain customer information (such as email address) to Meta in a privacy-safe way.

The Meta Pixel sends data to Meta's servers in the USA. This transfer is covered by Standard Contractual Clauses. You can learn more about how Meta uses data in its Privacy Policy and opt out of interest-based ads via Facebook's ad settings.

TikTok Pixel

We use the TikTok Pixel (ID: DAGIMEJC77U3EU7G76R0) on our website. This is a piece of JavaScript code placed by TikTok Technology Limited that allows us to:

• Measure the effectiveness of our advertising on TikTok.
• Track when visitors view pages or take actions such as navigating to our app download page.
• Build Custom Audiences of people who have visited our site, so we can show them relevant ads.
• Use Advanced Matching to improve attribution by hashing and sending certain customer information (such as email address) to TikTok in a privacy-safe way.

The TikTok Pixel sends data to TikTok's servers in the USA and Singapore. This transfer is covered by Standard Contractual Clauses. You can learn more about how TikTok uses data in its Privacy Policy and opt out of personalised ads via TikTok's ad settings.

Pinterest Tag and AdRoll

We also use the Pinterest Tag (ID: 2614073277652) to measure our Pinterest ads, and AdRoll (NextRoll, Inc.) to show ads to people who have visited our website and measure how they perform. Both send data to servers in the USA under Standard Contractual Clauses. See the Pinterest Privacy Policy and the NextRoll Privacy Notice.

Google Analytics

We use Google Analytics 4 to understand how visitors use our website. It only sets cookies after you agree to analytics cookies. Until then, Google Consent Mode sends cookieless pings without identifiers, so we can count visits without tracking you.

Your consent

We only use these technologies with your consent. Our cookie banner asks separately for analytics (Google Analytics) and marketing (the Meta Pixel, TikTok Pixel, Pinterest Tag and AdRoll). Advertising pixels do not load until you agree to marketing cookies. You can change your choice at any time with the Cookie settings link at the bottom of every page.

If you prefer not to be tracked by these pixels, you can opt out via the platform-specific links above, or use a browser extension such as uBlock Origin or the EFF's Privacy Badger.

6. Data Retention

We retain personal data only for as long as necessary for the purpose it was collected:

• Newsletter subscriptions: Retained until you unsubscribe. You may unsubscribe at any time via the link in any newsletter email.
• App account data: Retained for the duration of your account. If you delete your account, your personal data is deleted within 30 days.
• Contact and DSAR records: Retained for 3 years to maintain a record of our compliance obligations, then deleted.
• Usage analytics: Kept only as long as it is useful for improving our website and App. We delete analytics linked to your account if you ask us to or delete your account.

7. Your Rights Under UK GDPR

As a data subject, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data ("right to be forgotten").
• Right to restriction: Request that we limit how we use your data in certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of prior processing.

To exercise any of these rights, please submit a request via our Data Subject Access Request (DSAR) form. We will respond within 30 days. We may need to verify your identity before fulfilling the request.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been handled unlawfully.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage. These include encrypted connections (HTTPS), database encryption at rest, access controls, and regular security reviews.

No transmission of data over the internet is 100% secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.

9. Children's Privacy

Our Services are not directed to children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify you via email or a prominent notice within the App. We encourage you to review this policy periodically.

11. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us. We aim to respond to all privacy enquiries within 5 business days.