Privacy policy

Version 2026-07-13 — in force from 2026-07-13

Who we are

Refocus is a research pilot run by Sam Evans, an individual based in the United Kingdom. Sam is the data controller for the personal data described in this policy — there is no company behind Refocus, just him. If you have any question about this policy or your data, write to [email protected] — he reads it personally.

What Refocus is

Refocus is a pilot study of a focus-training practice. Using the app means taking part in that pilot: the same data that shows you your own progress is what lets us evaluate, in aggregate, whether the practice works. We say this plainly here because it shapes everything below.

What we collect

Your email address — used to sign you in (magic links) and, only if you opt in, to send you a daily reminder.
Your consent records — whether and when you accepted this policy and the terms, whether and when you consented to practice-data storage, and which version of these documents you agreed to.
Practice data — your sessions (type, level, duration, chosen anchor), the guidance cues the app played, each time you tapped Recentre, the category you gave it, and any optional reflection notes you chose to write.
Check-in responses — your answers to the mind-wandering questionnaire (shown twice) and your breath-counting task results.
Reminder settings — your chosen time of day, timezone, channel preferences, and (if you enable notifications) a push subscription for your device.
Your in-app settings — sound on or off, check-in prompts on or off, and your reminder channel choices.
How you found us — if you arrived via a link with campaign tags (UTM parameters) or from another site, we record that source against your account, plus a rough platform type (iOS / Android / desktop) from your browser.
Usage events — things like signing up, starting or completing a session, and streak changes, so we can see whether the pilot is being used at all.

We do not collect your name, precise location, contacts, health records, or anything from other apps. There is no advertising or third-party analytics tracking in Refocus.

Cookies and device storage

We use cookies only to keep you signed in, plus one first-touch cookie that remembers which link brought you here (kept for up to 90 days). The app also stores small flags on your device (for example, so a celebration animation plays only once) — these never leave your device. No advertising cookies, no cross-site tracking.

How we use your data

To run the service: sign you in, play your sessions, show you your own progress.
To evaluate the pilot: aggregate, de-identified analysis of whether the practice changes mind-wandering measures.
To send the reminders you asked for — and only those.
To send you one invitation, once, when the pilot ends — to the production app that follows it, if one launches. That's the only marketing-like email we'll ever send. If you'd rather not receive it, email [email protected] at any time and we won't.
To keep the service secure and working.

Note for reviewer: the post-pilot invite is handled as disclosure + opt-out, in the shape of a PECR soft opt-in (existing relationship, similar product, opt-out offered here and in the message itself). One nuance to weigh: regulation 22's soft opt-in technically requires the contact details to have been obtained "in the course of a sale or negotiations for a sale", and a free research pilot may not cleanly meet that — you may prefer an explicit opt-in instead. If so, that's a small follow-up (a settings toggle or a one-line tick); the disclosure + opt-out drafted here stands as the good-faith baseline either way.

We never sell your data, never share it for advertising, and never use it to build profiles for anything other than showing you your own practice.

Legal bases

Signing in, running your sessions, and keeping the service secure rest on our contract with you and our legitimate interest in operating the service. Sending reminders rests on the separate consent you give during onboarding — which has an off switch in settings.

Because the pilot is the service — using Refocus means taking part in the study — we rely on the processing being necessary to provide the service you sign up for as the basis for storing your practice and check-in data. The tick box at sign-up is how we make sure you know that and agree to it, and it is recorded with a date and document version; but participation itself is the basis, not the tick alone. Declining simply means not enrolling in the pilot, and you can leave — and have your data deleted — at any time.

Note for reviewer: two points to confirm together at this section. (1) The practice-data tick is required to sign up, so pure "freely given" consent is arguable — we've drafted the basis as necessity for the research service, with the tick as the recorded confirmation; if you prefer documented-valid-consent as the basis, the wording changes but nothing in the app does. (2) Special-category data / Article 9: some pilot data — the mind-wandering questionnaire responses and especially the optional free-text reflections — could be viewed as data concerning mental health, which would need a separate Article 9 condition (typically explicit consent, or the research condition with safeguards) on top of the Article 6 basis. The app is deliberately non-medical (it trains attention as a skill and does not diagnose or treat anything), which is a genuine argument that this is not health data — but that's your call, and it interacts with point (1): if any of it is special category, that likely argues for keeping explicit consent as the mechanism rather than pure necessity. Please weigh both together.

Who processes your data, and where

Supabase — our database and sign-in provider; your data is stored in the EU.
Vercel — hosts the app itself.
Resend — delivers our emails (sign-in links and, if opted in, reminders).
Your browser or device's push service (Apple, Google, or Mozilla) — delivers push notifications if you enable them. The notification content passes through their infrastructure.

These providers process data on our instructions under their own data processing agreements. Where any processing happens outside the UK/EU, it is covered by recognised safeguards (standard contractual clauses).

How long we keep it

Accounts that were never signed into — if you request a sign-in link but never use it, we delete the account record (including your email and consent record) after 30 days.
Pilot data — kept for the duration of the pilot and a following analysis period, then deleted or fully anonymised.
Your email for the post-pilot invite— kept for that single invitation until it's sent or you tell us not to, whichever comes first. Opting out of the invite doesn't affect anything else about your account.
On request — you can ask us to delete your account and everything attached to it at any time (see your rights below); deletion removes your practice data, check-in responses, reminders, and subscriptions with it.

Your rights

Under UK GDPR you can ask us for a copy of your data, ask us to correct or delete it, restrict or object to processing, and take your data elsewhere. You can withdraw your consent to reminders at any time — there's an off switch in settings. For your practice and check-in data, the way out is asking us to delete your account, which removes it all. Write to [email protected] and we will respond within a month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Changes to this policy

If this policy materially changes, we'll publish the new version here with a new version date, and the version you agreed to stays recorded on your account. This is version 2026-07-13.