Effective Date: July 14, 2026 · Last updated: September 7, 2026
1. Introduction
Minimal Desk Setups ("we", "our", or "us") respects your privacy and is committed to protecting your personal information. This Privacy Policy outlines how we collect, use, and safeguard your information when you use our app.
2. What We Collect
Your email address (for login and authentication, and - only if you opt in - marketing email)
A record of the choices you made when you signed up: that you accepted the Terms and Privacy Policy, and whether you opted in to marketing email, each stored with the date and the version of the wording you agreed to
Usage activity (e.g., pages visited, features used)
Technical data (e.g., browser, device type, and OS)
You can use Focus+ without an account at all. Doing so creates a guest workspace held against an anonymous identifier rather than an email address, and we hold no email, no name and no contact details for a guest. Anything you make as a guest - tasks, notes, timer sessions - is stored the same way an account holder’s is, and if you later create an account it becomes yours rather than being copied across.
3. How We Use Your Data
To authenticate and secure your account
To send you the emails the app itself depends on, such as your sign-in code
To send you product updates and tips - only if you ticked the marketing box when you signed up. This is separate from the emails above, and you can unsubscribe at any time without losing access to your account
To keep a record of the consents you gave, so we can show what you agreed to and when
To improve app performance and user experience
To analyze usage patterns and fix bugs
4. Session Recording & Analytics
We use analytics tools, including PostHog, to help us understand how users interact with the app. These tools may record anonymized session replays including clicks, scrolls, and navigations. This information is used solely to improve the functionality, usability, and performance of Focus+.
5. Data Sharing
We do not sell your personal data. We only share data with trusted third parties when necessary to operate our services (e.g., authentication, hosting, analytics, and email delivery) - all of which are GDPR and privacy-compliant.
If - and only if - you opt in to marketing email when you sign up, we share your email address and an account identifier with Klaviyo, the platform we send marketing email from, so that it can send you those emails and honor your unsubscribe. If you do not opt in, nothing about you is sent to Klaviyo and no profile is created for you there. Withdrawing the opt-in later stops the emails; contact us if you would also like the profile itself removed.
6. Data Retention
We retain your data for as long as your account is active or as needed to provide services. You may request deletion of your data at any time by contacting us.
Guest workspaces are treated differently, because there is no account to keep them for. A guest workspace with no activity for 30 days is deleted automatically, along with everything in it. Creating an account before then keeps it indefinitely, on the same terms as any other account.
7. How We Protect Your Data
Security procedures are in place to protect the confidentiality of your data, including the data we receive from Google. The main ones are:
Encryption in transit. Every connection between your browser, our app and our database is encrypted with HTTPS/TLS. We do not serve the app over an unencrypted connection.
Encryption at rest. Our database and file storage are hosted on Supabase, where stored data - including OAuth tokens and the copy of your calendar events - is encrypted at rest.
Access is restricted to your own account. Every table in our database enforces row-level security, so a request can only ever read or change rows belonging to the signed-in account. One user cannot read another user's tasks, notes, calendar events or Google tokens, and this is enforced by the database itself rather than by the app asking politely.
Secrets stay on the server. Our Google client secret and our privileged database key exist only inside server-side functions. They are never sent to your browser and are not present in the app's code.
The authorisation exchange happens server-side. When you connect Google Calendar, the authorisation code is exchanged for tokens by a server-side function, not in your browser.
We ask for the narrowest permissions we can. Focus+ requests only the specific Google Calendar permissions its features need, rather than full access to your calendar. We do not request permission to share, delete or change the sharing of your calendars.
The stored calendar copy is read-only to the app. The mirrored copy of your events can only be written by our server-side sync function; the app in your browser can read it, but cannot alter it.
We minimise what we keep. We store only what the features you have enabled need. We do not store guest email addresses from your calendar events, and we do not store passwords at all - signing in uses a one-time emailed code or Google.
Deletion is honoured. Disconnecting Google Calendar deletes the stored tokens and the stored copy of your events. Deleting your account removes the data associated with it.
Access within our team is limited to the people who need it to operate and support the service.
No service can promise perfect security, but if we ever become aware of a breach affecting your personal data we will act promptly and notify affected users and, where required, the relevant authorities.
8. Your Rights
You may request access to or deletion of your data at any time
You can opt out of analytics tracking by using private browsing or by requesting exclusion
If you opted in to marketing email, you can withdraw that at any time using the unsubscribe link in any of those emails. It does not affect your account or the sign-in codes we email you
9. Google User Data (Google Sign-In and Google Calendar Integration)
Focus+ uses your Google Account in two separate and entirely optional places, and each one asks for your permission on its own:
Continue with Google on the sign-in screen, which is an alternative to the emailed sign-in code. It gives Focus+ your Google account email address and basic profile information, and nothing else - in particular it gives us no access at all to your calendar.
Connect Google Calendar from Settings, a separate step that requests access to your Google Calendar so Focus+ can offer calendar sync. It is only active while you keep it connected, and signing in with Google does not turn it on.
What we access:
Your Google account email address (to identify you when you sign in with Google, and to identify the connected calendar account)
Your list of calendars, and the events on the calendars you choose to display
How we use it:
To sign you in to your Focus+ account, if you choose Continue with Google
To show your Google Calendar events on the Focus+ calendar
If you enable two-way sync, to create and update calendar events for the tasks you schedule in Focus+
How we store it:
OAuth access and refresh tokens, and the event details needed to display and sync your schedule, are stored in our database (Supabase), encrypted at rest and transmitted only over encrypted connections, and used solely to provide the calendar features you have enabled. Access is restricted to your own account by row-level security in the database. See section 7 for the full list of protections that apply to Google user data.
We keep a copy of the events from the calendars you have chosen to display, covering roughly the last 2 months and the next 6 months, so your calendar loads immediately and works across your devices. It holds the same details the app shows you: title, time, location, description, meeting link, and the names of guests. We do not store guest email addresses.
We do not sell or rent your Google user data, and we do not use it for advertising or to develop, improve, or train generalized AI and/or ML models. The only third party it is ever shared with is the one described in section 5: if you opted in to marketing email, your email address - however you signed up - is shared with Klaviyo so that we can send you those emails. Your calendars and events are never shared.
Your control:
You can disconnect Google Calendar at any time from Settings in Focus+. Disconnecting deletes the stored tokens and the stored copy of your calendar events. It does not close your Focus+ account or stop you signing in with Google.
Limited Use disclosure: Focus+'s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
10. The Focus+ Browser Extension
Focus+ has an optional companion extension for Chrome. It is a separate thing from the web app and is not needed to use Focus+ at all. This section covers the extension specifically, because what it holds is different from, and much smaller than, what the app holds.
What it stores:
The focus session you currently have running: whether it is a focus block, a break or the stopwatch, the time it ends, whether it is paused, and the name of the task it belongs to.
Whether you have chosen to hide its toolbar icon.
That is the whole list. It is kept in your own browser, in the browser's extension storage, and the session is removed once it ends. The extension transmits nothing to us or to anyone else. It has no server of its own, sends no analytics, and does not report what you are working on.
What it can reach, and why:
One website. The extension runs a small script on focus.minimaldesksetups.com and nowhere else. That script carries your timer between the Focus+ page and the extension, which is what lets a session continue after you close the tab. It does not read the content of that page, or of any other site.
New tabs. It can tell when you open a new browser tab, so it can take that tab to Focus+. It cannot see your browsing history and does not look at the pages you visit.
Notifications and alarms. To tell you when a session has finished, including when Focus+ is not open anywhere, and to schedule that moment.
Anything you then do inside Focus+ is covered by the rest of this policy, exactly as it would be with no extension installed. Removing the extension deletes everything it stored, and changes nothing in your account.