Privacy Policy

Last updated: March 25, 2026

1. Data We Collect

When you use Re:Focus, we collect:

• Account information: email address, username, and hashed password.
• Board content: cards, tasks, notes, contacts, and communications you create.
• Usage metadata: session tokens, last-login timestamps, and IP addresses (for rate limiting and security).

2. How We Store Your Data

All data is stored on Cloudflare KV, a globally distributed key-value store. Passwords are hashed with PBKDF2-SHA256 and never stored in plaintext.

3. How We Use Your Data

• To provide and operate the Service (board sync, authentication, API access).
• To send transactional emails (verification, password reset) via Resend.
• To detect and prevent abuse (rate limiting, breach detection).

4. Data We Do Not Collect

• We do not use analytics trackers, advertising pixels, or third-party cookies.
• We do not sell, rent, or share your personal data with third parties.
• We do not train AI models on your board content.

5. Third-Party Services

• Cloudflare: hosting, KV storage, and edge delivery.
• Resend: transactional email delivery (verification, password reset).
• Have I Been Pwned: password breach check at registration (only a partial hash prefix is sent — your password is never transmitted).

6. Data Retention and Deletion

Your data is retained as long as your account is active. Upon account deletion, all associated data — including board content, session tokens, and email mappings — is permanently deleted from Cloudflare KV.

7. Your Rights (GDPR / CCPA)

You have the right to:

• Access your personal data (available via the API or board export).
• Correct inaccurate data (edit directly in the app or via Settings).
• Delete your account and all associated data.
• Port your data (full board export via the API).

To exercise these rights, contact us at hello@smithcreativetech.com.

8. Security

We use HTTPS everywhere, HttpOnly secure cookies, PBKDF2 password hashing, account lockout after failed attempts, and rate limiting. API keys are generated with cryptographically secure random values.

9. Children

Re:Focus is not directed at children under 16. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the app or email. Continued use after changes constitutes acceptance.

11. Contact

Questions about your privacy? Reach us at hello@smithcreativetech.com.