Privacy Policy
Last updated 30 August 2026
The short version
- You can use Focus Garden without an account. Nothing leaves your device unless you sign in.
- With an account, we store your email, your name, and your garden — so it follows you between devices.
- No advertising. No tracking pixels. No third-party cookies. Page views are counted; you are not profiled.
- We do not sell your data, share it for advertising, or use it to train anything.
- You can export everything, and you can ask us to delete it.
Who we are
Focus Garden is a focus timer that grows a garden from the time you spend concentrating. This policy covers thefocusgarden.com and the desktop application of the same name. In this policy, “we” means the operator of Focus Garden, reachable at privacy@thefocusgarden.com.
Using Focus Garden without an account
This is the part worth understanding first, because it changes everything below. Focus Garden is local-first: the timer, the growth rules, the streaks and the garden itself all run inside your browser, and your data is stored on your own device using your browser’s storage.
If you choose Just let me start — keep it on this device, no account is created, nothing is transmitted to us, and there is nothing on our servers to disclose, hand over, lose, or delete. The desktop application works the same way and has no account system at all.
An account buys exactly one thing: the same garden on more than one device. Everything in the rest of this policy applies only once you have one.
What we store when you do have an account
| What | Why |
|---|---|
| Your name and email address | To identify your account and send you the emails described below. |
| A hash of your password | To sign you in. We never store the password itself and cannot read it. |
| Your Google account ID, name, email and profile picture — only if you sign in with Google | To link your Google sign-in to your account. We ask Google for nothing beyond your basic profile and email address, and we cannot see anything else in your Google account. |
| Your focus sessions: when each one started, how long it ran, whether it completed, and which project you assigned it to | This is the record your garden, your streaks and your statistics are calculated from. |
| Your garden: plants, their positions and growth, your projects, settings, achievements and catalogue | So the same garden appears on every device you sign in on. |
| Sign-in session records, including your IP address and browser user-agent string | To keep you signed in and to let a session be expired or revoked. These are attached to the sign-in itself, not to your activity, and we do not build a location or behaviour profile from them. |
| Sync bookkeeping: revision numbers and timestamps | To work out which device holds the newest version of a record. |
What we do not do
- No Google Analytics, no product analytics, no session recording, no heatmaps, and nothing that follows you between sites.
- No advertising, and no advertising identifiers.
- No tracking cookies and no third-party cookies. See below.
- No selling or sharing your data, for advertising or anything else.
- No training. Your data is not used to train machine-learning models.
- No reading your content for any purpose other than running the service.
Traffic measurement
One thing does count visits: Cloudflare Web Analytics, which our host adds at the edge. It records that a page was loaded, roughly where in the world from, and which browser — and that is the whole of it.
It is named here rather than waved away because it is the only measurement on the site and you are entitled to know it exists. What it specifically does not do: it sets no cookies, stores nothing on your device, fingerprints nothing, and cannot follow you to any other site. It produces a count of page views, not a profile of a person, and there is no identifier in it that could be tied back to your account.
Cookies
Focus Garden sets one cookie, and only after you sign in. It
holds your session so you stay signed in between visits. It is
HttpOnly, Secure and SameSite=Lax, which
means scripts cannot read it and it is not sent when another site links to ours.
It is strictly necessary for a function you asked for, so there is no consent banner — there is nothing here to consent to. We set no analytics cookies, no advertising cookies, and no third-party cookies of any kind.
Separately, the app stores your garden in your browser’s own storage
(IndexedDB and localStorage). That is not a cookie, it is never
transmitted anywhere on its own, and clearing your site data removes it.
Email we send you
Only transactional email, and only in response to something you did: confirming your address when you sign up, and resetting your password when you ask. We do not send marketing email, and there is no mailing list to be added to.
Who else can see your data
We use a small number of service providers to run Focus Garden. They process data on our instructions and for no purpose of their own.
| Provider | What it handles |
|---|---|
| Cloudflare | Hosting, content delivery, the database your account and garden live in, and the page-view counting described above. |
| Resend | Delivering confirmation and password-reset email. Receives your address and the message. |
| Sign-in, only if you choose to sign in with Google. If you use email and password, Google receives nothing. |
Beyond these, we disclose data only where we are legally required to, and only to the extent required.
Where your data is held
Focus Garden runs on Cloudflare’s network, which is distributed internationally, so your data may be processed outside the country you live in. Our providers operate under standard contractual clauses and their own published safeguards for such transfers.
How long we keep it
Your account and garden are kept for as long as your account exists, because that is the entire point of the account — a garden is a record built over months, and quietly expiring it would destroy the thing you came for.
Sign-in sessions expire on their own after 60 days. Unverified accounts and expired verification links are cleared periodically. When you ask us to delete your account, we remove it and everything attached to it, as described next.
Your choices and your rights
Take your data with you
Settings → Export produces a complete, readable JSON file of your garden and your full session history. It is the same format the desktop application reads and writes, so it is a genuine export rather than a gesture: you can import it into another copy of Focus Garden and carry on.
Delete your account
Email privacy@thefocusgarden.com from the address on the account and we will delete it, along with your garden, your sessions and your sign-in records. We aim to do this within 30 days and will confirm when it is done. Deletion is permanent and cannot be undone, so export first if you want to keep anything.
Deleting your account does not touch the copy on your own device. You can carry on using Focus Garden without an account, and you can clear the local copy at any time through your browser’s site-data settings.
Correct or access your data
Your name is editable in Settings. For anything else — a copy of what we hold, a correction, or a restriction on how we use it — write to privacy@thefocusgarden.com.
If you are in the United States
Several states — California, Colorado, Connecticut, Virginia, Texas and others — give residents rights to know what is collected about them, to get a copy, to correct it, and to have it deleted. Those rights are available to everyone who uses Focus Garden, wherever you live, through the export and deletion routes above. We will not discriminate against you for exercising them.
On the question those laws are usually about: we do not sell your personal information, and we do not share it for cross-context behavioural advertising. Not as a policy choice we might revisit quietly — there is no advertising technology in this product at all, and the section above lists every third party that touches your data. There is no “Do Not Sell” link here because there is nothing for it to switch off.
We do not use your data for automated decision-making or profiling, and we collect no sensitive personal information as those laws define it.
If you are in the UK, EU, or a similar jurisdiction
You have rights of access, rectification, erasure, restriction, portability and objection, and you may complain to your local data protection authority. We rely on contract as our lawful basis for the data needed to provide your account, and on legitimate interests for keeping the service secure and working. We do not rely on consent for anything, because we do nothing optional with your data.
Security
Traffic is encrypted in transit. Passwords are stored only as hashes. Sessions use HttpOnly cookies, and an email address must be confirmed before an account can be used. Sign-in errors are written deliberately so that they cannot be used to discover which addresses are registered.
No system is perfect. If you find a security problem, please write to security@thefocusgarden.com rather than posting it publicly, and we will get to it quickly.
Children
Focus Garden is not directed at children under 13, and we do not knowingly create accounts for them. If you believe a child has an account here, write to us and we will remove it.
Changes to this policy
If this policy changes in a way that materially affects you, we will update the date at the top and tell you by email before the change takes effect. Minor clarifications may be made without notice.