Privacy Policy

Apptuned Ltd ("Apptuned", "we", "us") operates the Apptuned Focus productivity application available at focus.apptuned.net. We are the data controller for the personal data described in this policy.

Contact: privacy@apptuned.net
Postal: Nairobi, Kenya

We collect only what is necessary to provide and improve the service:

• Account data: Email address, display name, avatar (optional). Collected at registration.
• Profile data: Energy level preferences, accessibility settings, productivity customisations.
• Task data: Tasks, steps, brain dumps, timelines you create within the app.
• Voice recordings: Audio you choose to record for the brain dump feature. Transcribed immediately; recordings deleted within 24 hours (if audio retention is enabled with your consent).
• AI chat messages: Conversation content saved per your chosen history preference (cloud, device-only, or not at all — see Section 5).
• Usage analytics: Anonymised page views and feature usage (Vercel Analytics), only if you consent.
• Payment data: Billing details are processed by our payment provider (Sellra / Flutterwave) and are not stored on our servers.
• Technical data: IP address, browser type, device type — for security and fraud prevention only. Not used for profiling.

We process your data under the following legal bases:

• Contract (Art. 6(1)(b) GDPR / KE DPA s.30(a)): Core app features (tasks, AI assistance, reminders) are necessary to provide the service you signed up for.
• Consent (Art. 6(1)(a) GDPR / KE DPA s.29): Voice recording retention, analytics, marketing emails, and AI chat history. Consent can be withdrawn at any time without affecting prior lawful processing.
• Legitimate interests (Art. 6(1)(f) GDPR / KE DPA s.30(e)): Security monitoring, fraud prevention, and product improvement through aggregated analytics.
• Legal obligation: Tax records and dispute resolution as required by Kenyan law.

Apptuned Focus uses AI (OpenAI, Groq, or self-hosted models) to power features including task deconstruction, brain dump extraction, and the AI chat coach.

• Your content is sent to the AI model in transit to generate responses. It is not used to train AI models (we use API mode, not fine-tuning datasets).
• We strip or anonymise personally identifying information before it reaches third-party AI APIs where possible.
• You can opt out of AI processing at any time — this will disable AI-powered features but the core app remains usable.

On first use of the AI chat feature, you choose how your conversation history is stored:

• Save to account: Messages are stored encrypted in our database, linked to your account, accessible across devices. You can delete all history from Settings.
• Device only: Messages are stored in your browser's localStorage. Never sent to our servers beyond the immediate API call. Cleared when you clear browser data or click "Clear history".
• Don't save: Messages exist only for the duration of the page session. Nothing is persisted anywhere.

You can change this preference at any time in the chat interface or in Settings.

We share data only as necessary:

• Supabase (PostgreSQL): Database hosting. EU-region servers. Data processor under DPA.
• OpenAI / Groq: AI inference. Your content is subject to their API terms (not used for training). You consent to this when enabling AI features.
• Resend: Transactional email delivery. Receives your email address only when sending you a message.
• Vercel: Hosting and analytics (anonymised, no cookies by default).
• Payment providers (Sellra, Flutterwave): Process payments independently. We receive only payment confirmation, not card details.

We do not sell your data. We do not share data with advertisers.

• Account data: Retained while your account is active. Deleted within 30 days of account closure.
• Task & productivity data: Retained for the life of your account. You can delete individual items at any time.
• Voice recordings: Maximum 24 hours (with audio retention consent). Transcriptions may be retained longer as task text.
• Cloud chat history: Retained until you delete it from Settings, or your account is closed.
• Payment records: 7 years as required by Kenyan tax law.
• Server logs: Maximum 90 days, then automatically purged.

Under GDPR and the Kenya Data Protection Act 2019, you have the right to:

• Access a copy of the personal data we hold about you
• Rectification of inaccurate data
• Erasure ("right to be forgotten") — you can delete your account and all associated data
• Restriction of processing in certain circumstances
• Data portability — export your tasks and data in a machine-readable format
• Object to processing based on legitimate interests
• Withdraw consent at any time for consent-based processing

To exercise any right, email privacy@apptuned.net. We respond within 30 days. No fee for reasonable requests.

You may also lodge a complaint with the Kenya Office of the Data Protection Commissioner (ODPC) or your local data protection authority.

• All data in transit uses TLS 1.2+ encryption
• Data at rest is encrypted using AES-256 (Supabase default)
• Row-Level Security (RLS) ensures users can only access their own data
• We conduct periodic security reviews and dependency audits
• API keys and secrets are stored as environment variables, never in code

If you discover a security vulnerability, please disclose it responsibly to security@apptuned.net.

We use only essential cookies for authentication (Supabase session cookies). See our Cookie Policy for full details.

Apptuned Focus is not directed at children under 18. We do not knowingly collect data from anyone under 18. If you believe we have collected data from a minor, please contact privacy@apptuned.net immediately.

Our services use infrastructure in the EU (Supabase) and the US (OpenAI, Vercel). Transfers from Kenya and the EU are conducted under appropriate safeguards including Standard Contractual Clauses (SCCs) and adequacy decisions where applicable.

We will notify you of material changes to this policy via email or an in-app notice at least 14 days before changes take effect. Continued use after that date constitutes acceptance of the revised policy.