Introduction

Welcome to HocusFocus. This Privacy Policy explains how Marian Cocota ("we," "our," "us," or the "Developer") collects, uses, stores, shares, and protects personal information when you use the HocusFocus mobile application, related websites, support channels, beta programs, and associated services (collectively, the "Service").

HocusFocus is designed to help users track activities, build routines, record reflections, analyze productivity patterns, and optionally use cloud sync, AI-powered features, movement tracking, and accountability tools. Because the Service includes optional features that use sensitive permissions, we want to be clear and specific about what data is involved.

This Privacy Policy supports compliance with applicable privacy laws:

• GDPR: The General Data Protection Regulation (EU) 2016/679
• Romanian Data Laws: Applicable Romanian data protection and consumer protection statutes
• Google Play Policy: Google Play User Data, Data Safety, and prominent disclosure requirements
• International Standards: Applicable consumer and data protection standards across global beta regions

By using the Service, you acknowledge this Privacy Policy. If you do not agree, please do not use the Service.

1. Data Controller Information

• Data Controller: Marian Cocota (Individual Developer)
• Email: support@hocusfocus.life / privacy@hocusfocus.life
• Postal Address: Street Nicolae Titulescu, nr. 8, Hațeg, Hunedoara, 335500, Romania
• Role: Independent developer and operator of HocusFocus

For privacy questions, legal notices, or data rights requests under GDPR, contact us directly at privacy@hocusfocus.life.

2. Information We Collect

We collect only information reasonably necessary to operate, secure, improve, and support the Service. Some features are optional and collect data only when you choose to use them.

2.1 Information You Provide Directly

Account Information (Optional): If you create or use an account through Firebase Authentication, we may process:

• Email address
• Display name or profile name
• Authentication-related identifiers and tokens managed securely by Firebase

You may use significant parts of HocusFocus without creating an account. Account creation is required only for cloud-based sync features.

Productivity & App Content You Create:

• Activity names, descriptions, categories, colors, timers, schedules, and reminders
• Session records, including start time, end time, duration, completion state, and notes
• Routines, objectives, tasks, milestones, streaks, and related progress data
• Journal entries, prompted reflections, and text notes
• Mood and energy selections or ratings
• Voice notes and audio journal recordings
• Achievement, badge, and gamification progress data
• App preferences, onboarding choices, and feature settings

Profile & Image Content (Optional): Profile images, activity illustrations, or verification photos captured intentionally for accountability features.

2.2 Optional Permissions & Features

• Calendar Data: If granted, allows reading/writing routine events. Never used for advertising.
• Microphone / Audio: Processed only during active voice journaling and audio notes.
• Camera / Photos: Processed only for user-submitted accountability verification photos.
• Location & Movement: Approximate or precise location during active movement tracking sessions only. Not collected when tracking is inactive.
• Notifications: Delivery preferences, quiet hours, and reminder timing.

2.3 Subscriptions & Transactions

Purchases and subscriptions are processed by Google Play and RevenueCat. We do not receive or store your full payment card details.

2.4 AI-Assisted Features

If you use AI features (e.g. routine drafting or photo verification), relevant prompt or photo data is processed through Google / Firebase / Vertex AI / Gemini. Processing is limited to what is strictly necessary to perform the requested function.

2.5 Information We Do NOT Collect

• No contacts or address books
• No SMS content or call logs
• No advertising tracking IDs (we do not run third-party ad networks)
• No unselected photo library files
• No financial account or payment card numbers
• No medical records or health diagnosis files

3. How We Use Your Information

• To Provide the Service: Account management, storing routines, sync, reminders, and offline tracking. (Legal basis: Contract performance)
• To Improve & Personalize: Generating personal statistics, optimizing onboarding, and evaluating beta features. (Legal basis: Legitimate interests / consent)
• AI Features: Drafting routines and checking photo verification when explicitly triggered. (Legal basis: Contract performance / consent)
• Billing & Entitlements: Validating purchases, unlocking premium tiers, and managing renewals. (Legal basis: Contract performance & legal obligation)
• Security & Support: Fixing crashes, monitoring uptime, preventing abuse, and answering support requests. (Legal basis: Legitimate interests)

4. How We Share Your Information

We do not sell your personal data to any third party.

We share data only with necessary infrastructure partners:

• Google / Firebase: Auth, database, storage, crash diagnostics, AI
• Google Drive (Optional): Personal backup inside the private drive.appdata folder
• RevenueCat: Subscription entitlement verification
• Google Play: App delivery and billing management
• Mapbox: Map tile rendering for movement sessions

5. Data Storage, Sync & Retention

Local Storage: Core data is stored locally on your device with private app sandboxing and SQLCipher encryption where enabled.

Cloud Storage: If cloud sync is enabled, data is stored in Firebase secure European / global regions protected by Firebase Security Rules.

Retention Periods:

• Local Data: Retained until deleted in-app or the app is uninstalled.
• Cloud Data: Retained until deleted in-app or account deletion is requested.
• Diagnostics: Auto-deleted within 90 days.
• Billing Records: Retained as required by EU financial regulations (up to 7 years).

6. Security

We apply rigorous organizational and technical safeguards, including HTTPS/TLS encryption in transit, SQLCipher database encryption, strict Firebase Security Rules, and private device storage.

7. Your Privacy Rights

Under GDPR and applicable consumer laws, you have the right to access, rectify, export, restrict, or delete your personal data. You can exercise these rights directly within the app or by emailing privacy@hocusfocus.life.

8. International Data Transfers

Where third-party services (such as Firebase or RevenueCat) process data outside the EEA, transfers are governed by European Commission Standard Contractual Clauses (SCCs) to ensure equivalent protection.

9. Children's Privacy

The Service is not directed to children under 13 years of age (or 16 where required by EU local law). We do not knowingly collect personal data from children without verifiable parental consent.

10. Third-Party Links & Policies

The Service connects with third-party providers including Google Play, Firebase, RevenueCat, and Mapbox. Each provider operates under its own privacy policy.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect product updates, new integrations, or legal requirements. Material updates will be communicated through the app or website.

12. Contact & Complaints

• Privacy Contact: privacy@hocusfocus.life
• Support Contact: support@hocusfocus.life
• Developer: Marian Cocota · Street Nicolae Titulescu, nr. 8, Hațeg, Hunedoara, 335500, Romania
• Supervisory Authority: dataprotection.ro

13. Summary of Key Privacy Points

• No Account Required: Core tracker features operate 100% offline without mandatory account creation.
• No Data Sold: Your habits, routines, and personal reflections are never sold or used for ad targeting.
• Encrypted & Secure: End-to-end TLS in transit and local database sandboxing.
• You Are in Control: Delete specific items or your entire account at any moment.