FOKUS Privacy Notice
Effective 27 July 2026 · Version 2026-07-27
This Privacy Notice explains how personal data is processed when you request access to or use the FOKUS™ beta (the “Beta”).
1. Data controller
The controller responsible for the processing described in this notice is:
Contact this address if you have questions about privacy or wish to exercise your data-protection rights.
2. Who may use FOKUS
The Beta is intended for users aged 13 or older. If applicable law requires permission from a parent or legal guardian, you may use the Beta only with that permission.
FOKUS does not knowingly collect personal data from children under 13. If you believe that a child under 13 has provided personal data, contact beta@studywithfokus.com so that the matter can be investigated and the data deleted where appropriate.
3. Personal data FOKUS processes
Waitlist and beta-access information
When you request access, FOKUS processes:
- the email address you submit;
- the version of the Beta Terms you accepted;
- the date and time of acceptance;
- the status of your request or invitation; and
- communications relating to your beta-access request.
A waitlist request does not create an account or guarantee admission to the Beta.
Google sign-in and account information
If you create an account using Google, FOKUS receives:
- your Google account name;
- your verified email address;
- your Google profile image, or a link to that image;
- the technical identifier needed to associate the Google sign-in with your FOKUS account; and
- account creation, sign-in and account-status information.
Ordinary FOKUS sign-in does not request access to Google Drive, Gmail, Google Calendar, contacts or other Google services. If you separately choose to connect Google Calendar availability, the limited processing described below applies.
Study and service-use information
FOKUS processes information that you enter or generate while using the Beta, including:
- subjects, examinations and examination dates;
- topics and study plans;
- reviews, ratings and progress information;
- tasks and completion information;
- study activity, scheduling information and recommendation history; and
- settings and other information associated with your account.
Do not enter passwords, payment information, health information or other sensitive personal data into FOKUS unless a feature expressly requests and supports it.
Subscription and payment information
Paid upgrades remain closed during private beta. If you later choose a paid FOKUS subscription after checkout is enabled, FOKUS and Stripe process:
- your FOKUS account identifier and email address;
- the selected offer, billing interval, VAT-inclusive amount and currency;
- Stripe customer, Checkout, subscription, invoice and payment-event identifiers;
- subscription status, trial and billing-period dates, cancellation state, payment success or failure, refund and dispute state;
- billing name, address and tax information needed for payment and automatic tax calculation; and
- the terms version accepted in Stripe Checkout.
Stripe collects and handles payment-method details on its hosted checkout. FOKUS does not receive or store your full card number, card security code or raw Stripe webhook payload.
Technical, security and diagnostic information
FOKUS and its infrastructure providers may process limited technical information needed to deliver and protect the service, such as:
- IP address;
- browser and device type;
- operating system;
- request and sign-in timestamps;
- pages or functions requested;
- error, performance and security logs; and
- cookies or similar technologies that are strictly necessary for authentication, security and session management.
FOKUS does not use advertising cookies, advertising pixels, third-party product analytics, session replay or cross-site tracking.
First-party product analytics
When the first-party analytics switch is enabled, FOKUS records a small set of server-side events in the existing FOKUS database to understand activation, upgrade and trial conversion, retention, and adoption of premium features. These records may include:
- a FOKUS account identifier during the short raw-event retention period;
- a fixed event name and fixed feature or interface-area key;
- the Free or Unbounded plan category;
- the date and time of the event; and
- strictly bounded counts or categories, such as the number of subjects selected.
Product analytics do not contain subjects, exam or topic names, task contents, review ratings, URLs, email addresses, IP addresses, advertising identifiers or free-form metadata. Collection can be disabled globally without affecting ordinary study features.
Optional calendar availability
If you explicitly connect Google Calendar or an eligible organizational Microsoft Calendar account, FOKUS processes:
- an encrypted provider refresh credential;
- the limited permission scopes granted to FOKUS;
- for Microsoft, the verified account email needed to request that account’s schedule;
- busy-period start and end times, without event titles, descriptions, attendees or locations;
- connection, synchronization and cache timestamps; and
- per-user and global daily request counters.
FOKUS uses availability only to adjust study capacity. It does not continuously poll, read event content or write to your external calendar. Busy periods are cached for 24 hours and ordinary synchronization is limited to once per provider per day.
Feedback and communications
If you contact FOKUS or voluntarily provide feedback, FOKUS processes your message, contact details and any information you choose to include.
4. Why personal data is processed and the legal bases
FOKUS processes personal data only where there is a lawful basis to do so.
| Purpose | Data involved | Legal basis |
|---|---|---|
| Review waitlist requests, manage invitations and communicate about requested beta access | Waitlist email, request status and related communications | Taking steps at your request before entering an agreement and, where applicable, performance of the Beta agreement |
| Create and authenticate your account and provide the Beta | Google sign-in information, account information and study data | Performance of the Beta agreement |
| Generate study schedules, readiness estimates and recommendations requested through the service | Study data and service-use information | Performance of the Beta agreement |
| Adjust planning around busy periods when you explicitly connect an external calendar | Encrypted connection credential, provider account identifier, limited permission scopes, busy-period start/end times and synchronization counters | Performance of the Beta agreement; connecting a calendar is optional |
| Create and administer a paid subscription when you intentionally use enabled Stripe Checkout | Account and contact information, selected plan and price, billing and tax information, Stripe identifiers, terms version, payment outcome and subscription lifecycle | Taking steps at your request and performance of the subscription agreement; compliance with accounting, tax and consumer-law obligations where applicable |
| Operate, maintain, diagnose and secure FOKUS; prevent misuse and unauthorized access | Account, technical, diagnostic and security information | Legitimate interests in providing a reliable and secure Beta and protecting users and FOKUS |
| Improve Beta functionality and correct defects | Service-use information, diagnostic information and feedback | Legitimate interests in testing and improving FOKUS; feedback is voluntary |
| Measure activation, conversion, retention and feature adoption using privacy-minimized first-party analytics | Short-lived pseudonymous product events and anonymous daily counts | Legitimate interests in understanding and improving FOKUS without third-party tracking; you may object as described below |
| Record acceptance of terms and establish, exercise or defend legal claims | Terms version, acceptance timestamp and relevant account or communication records | Legitimate interests in demonstrating agreements and protecting legal rights |
| Respond to privacy requests and comply with applicable law | Identity, request and necessary account records | Compliance with legal obligations and legitimate interests in managing requests securely |
Where processing is based on legitimate interests, FOKUS considers the necessity of the processing and its effect on users. You may object to processing based on legitimate interests as explained below.
FOKUS does not use personal data for third-party advertising or sell personal data.
5. Study recommendations and automated processing
FOKUS uses study data to calculate schedules, readiness estimates and recommendations about what you may wish to study next. These outputs support your own decisions. They do not make decisions that produce legal effects or similarly significant effects concerning you.
You remain responsible for checking examination dates, school instructions and recommendations before relying on them.
6. Who can access personal data
Other FOKUS users cannot see your account or study information.
The FOKUS owner may access personal data only where reasonably necessary to administer beta access, provide support, investigate defects or security incidents, comply with law, or maintain and improve the Beta.
FOKUS uses service providers that process data on behalf of FOKUS, including:
- Google, as the identity provider when you choose Google sign-in;
- Google Calendar or Microsoft Graph, only when you explicitly connect the corresponding optional busy-only availability integration;
- Stripe, only when paid billing is enabled and you intentionally enter hosted Checkout or manage an existing paid subscription;
- Vercel, for application hosting, delivery and related technical logs;
- Turso / libSQL, for database infrastructure and storage; and
- Resend, for sending beta invitations and related email delivery; and
- an error-monitoring provider, if configured, which receives redacted server-error metadata without account identifiers, request contents or study data.
These providers process personal data only for the relevant service and under their applicable data-processing terms. They may also process certain information as independent controllers where their own services require it, as described in their privacy notices.
Personal data may also be disclosed where required by law, a binding authority request or legal process, or where reasonably necessary to establish, exercise or defend legal claims.
7. International data transfers
Some service providers or their subprocessors may process personal data outside Finland or the European Economic Area.
Where personal data is transferred outside the European Economic Area, FOKUS will rely on a lawful transfer mechanism where required, such as:
- an adequacy decision adopted by the European Commission, including the EU-US Data Privacy Framework where applicable to a participating organization; or
- the European Commission’s standard contractual clauses together with any supplementary safeguards required for the transfer.
You may contact beta@studywithfokus.com for more information about the safeguards applicable to a particular transfer.
8. How long data is retained
FOKUS retains personal data only for as long as reasonably necessary for the purposes described above.
- Pending waitlist requests: retained while the request is pending and for up to six months after it is approved, declined, withdrawn or expires, unless the requester creates an account or earlier deletion is requested.
- Account and study data: retained while the account remains active.
- Deleted accounts: removed from active production systems within 30 days after a valid deletion request, unless particular information must be retained for security, legal compliance or legal claims.
- Operational backups: deleted information may remain in encrypted backups until the applicable backup is overwritten or deleted, for no longer than 90 days. Backup copies are not restored for ordinary use and will be removed again if restoration is required.
- Terms-acceptance records: retained for the duration of the Beta relationship and normally for three years afterwards where reasonably necessary to demonstrate the agreement or handle legal claims.
- Security and diagnostic logs: normally retained for no longer than 90 days, unless a longer period is necessary to investigate an incident, prevent abuse or comply with law.
- First-party product events: before FOKUS receives subscription revenue, raw events are retained for no longer than 30 days. After the first live subscription revenue, completed days are converted by a daily retention job into small daily counts and the raw events are deleted. The current incomplete day may remain until the next job. Anonymous daily counts are normally retained for up to 24 months.
- Calendar connections: encrypted credentials and connection metadata are retained while you remain connected. Cached busy start/end times expire after 24 hours and are replaced on a later permitted synchronization. Disconnecting removes the local credential and cached busy periods; provider-side authorization may also be revoked in the provider account.
- Subscription and billing records: customer and subscription identifiers, invoices, payment outcomes, tax records, accepted terms version and related accounting records are retained for the subscription relationship and afterwards for the period required by applicable accounting, tax, consumer-protection and legal-claims obligations. FOKUS does not store full card details.
- Support and privacy correspondence: normally retained for up to 12 months after the matter is closed, unless longer retention is necessary for legal compliance or legal claims.
Anonymized information that can no longer be linked to an identifiable person is not personal data and may be retained for product analysis and development.
9. Your data-protection rights
Depending on the circumstances and legal basis, you may have the right to:
- receive information about how your personal data is processed;
- obtain access to your personal data;
- have inaccurate or incomplete data corrected;
- have personal data deleted;
- restrict processing;
- receive personal data you provided in a structured, commonly used and machine-readable format and transmit it to another controller;
- object to processing based on legitimate interests; and
- withdraw consent at any time where processing is based on consent, without affecting processing performed before withdrawal.
These rights are not absolute. For example, some information may need to be retained to comply with law or establish, exercise or defend legal claims.
To exercise a right, email beta@studywithfokus.com. FOKUS may request information reasonably necessary to verify that the request relates to you. Requests are normally answered within one month, subject to extensions permitted by law.
10. Complaints
Please contact beta@studywithfokus.com first if you have a privacy concern so that it can be investigated.
You also have the right to lodge a complaint with the supervisory authority. In Finland, the authority is:
You may also contact the competent supervisory authority in the EU or EEA country where you live, work or believe an infringement occurred.
11. Whether information is required
An email address and the requested acceptance record are required to submit a beta-access request. The Google account information described above is required if Google sign-in is the available authentication method. Account and study information needed by a selected feature must be provided for that feature to work.
Feedback, external calendar connections and other optional communications are voluntary. Choosing not to provide optional information does not prevent ordinary use of the Beta.
12. Security
FOKUS uses reasonable technical and organizational measures appropriate to the Beta to protect personal data against unauthorized access, alteration, loss and disclosure. No online service can guarantee absolute security.
If you believe your account or personal data may have been compromised, contact beta@studywithfokus.com promptly.
13. Changes to this notice
This notice may be updated when FOKUS changes its processing, service providers, features or legal obligations. The effective date and version appear at the top.
Material changes will be communicated through the Beta or by email before they take effect where reasonably possible or where required by law.