The privacy of your data, and it is your data, not ours, is a big deal to us. This policy lays out what we collect and why, how it is handled, and your rights over it. We never sell your data. We never have and we never will.
Who we are
Sirius Focus is made by Alchymir Ltd, a company registered in England and Wales under company number 15469949, at 22 Silk Mill Close, Leeds LS16 6PW, United Kingdom. We are the data controller for the personal data described here. You can reach us about anything in this policy at privacy@alchymir.com.
This policy covers the website at siriusfocus.com, the web app, desktop app and Sirius Focus mobile apps. We refer to all of them as the "service".
What we collect and why
Our guiding principle is to collect only what we need. Here is what that means in practice.
Identity and access
When you create an account we ask for an email address. That is how you sign in, how we confirm the account is yours, and how we send you anything at all. If you choose a password, we store a one-way hash of it, never the password itself. If you sign in by emailed link, there is no password to store. We also keep the sign-in tokens that keep you signed in on each device, so that you do not have to sign in every time.
Your content
Your projects, actions, goals, habits, reviews, notes and log entries are stored on your device. If you connect an account and enable sync, we also store the synced content on our servers so it can follow you between devices. Local-only workspaces are not uploaded through sync. We use synced content to provide the service.
Subscriptions and sync access
Local workspaces are free. If you choose a subscription, the purchase is made through Paddle or Stripe Managed Payments, the merchant of record shown at checkout. Your full card number and security code go to the provider and never reach our servers. Payment notifications can include masked payment-method details. The provider tells us that the purchase happened, and we keep a record of it: the amount, currency and tax, when it was billed, whether it was refunded, and the payment provider's identifiers for the transaction and for you as its customer. We keep that record to manage subscription access, supporter recognition, refunds and tax. If you opt in, we also store the nickname and the sentence you choose for the public supporters page. Nothing about a purchase is shown publicly unless you opt in.
We record when your sync trial starts and ends, the subscription periods you have paid for, refunds, and any separate sync-access grants. We use these records to determine when your account can sync and to manage billing and recovery. Supporter recognition is recorded separately from ongoing sync access.
Payment notifications
We store payment-provider notifications to process purchases, subscription changes and refunds, and to investigate billing failures. These records include the event data sent by the provider, which may contain customer identifiers, contact or billing details, subscription details and transaction information, together with processing attempts and errors.
We load Paddle.js when you request a Paddle checkout or open a payment link. These requests contact Paddle and its ProfitWell service. We pass your customer identifier to the checkout to complete your purchase. Paddle receives browser and connection information when its script loads and handles that information under its privacy policy.
Optional Discord connection
If you link Discord, we store your Discord user identifier, username and the time you linked it. We use that connection to grant or remove the community supporter role. You can unlink it from the Discord connection page. Your public supporter nickname and note are separate from this connection.
Copies on your devices
Each workspace keeps a local copy in your browser or app storage, so it works without a connection. You can create and use local workspaces without signing in. Connected workspaces also have a server copy for sync. Signing out ends access to the server but can leave a local workspace on the device. Use the app's local-data removal controls to delete those copies. Account deletion removes the current workspace from the device you use to delete it; it cannot remotely erase an offline device or a copy you have exported.
Settings and account activity
We store the settings you choose, including your time zone if you confirm one, and we stamp when your account was created, when you last signed in and when you were last active. The stamps tell us whether the product is being used. We also use limited activity information to decide when to offer product guidance.
Usage analytics
Usage analytics is on by default for a new account. We record a limited set of actions, such as completing an action or using a review. Records include the time, feature, outcome, app version, and operating-system family. For signed-in use, records are associated with your account and the device that performed the action. They do not include the content you write, search text, or precise location. You can turn this off at any time under Settings → Privacy without affecting the app's features.
Optional queued usage records expire after 30 days and are limited to 5,000 events per installation. Accepted analytics records expire after 90 days. Local-only reporting uses a resettable installation identifier, and we do not attach its earlier reports to an account when you sign in. Turning off reporting clears pending optional records on that device and stops new collection there. Account changes are applied to other devices when they can communicate with the service, and the server rejects reports that no longer have permission. A signed-in device that has not yet been able to confirm your current permission collects nothing, and queues nothing, until it can.
When Usage analytics is enabled, signed-in apps can send aggregated sync performance reports, such as connection failures, retry counts, queued-change counts and transfer timings. These reports include app and storage information, but exclude your projects, notes and other written content. Turning off Usage analytics also stops these optional sync reports.
Devices
We keep a list of your signed-in browser profiles and app installations so you can recognize and sign them out. It includes the operating-system family, app version, and when each last connected. These account-security records are separate from optional analytics. Changing your password signs out every session, including the one you are using. Resetting a forgotten password signs out every other session and signs you in again on the device you used to reset it. A disconnected device learns that it has been signed out when it next contacts us; remote sign-out cannot immediately erase an offline copy.
Anti-bot assessments
The sign-in and registration forms are protected by Cloudflare Turnstile, to keep automated sign-ups and password guessing out. Turnstile looks at signals from your browser to decide whether it is dealing with a person. We receive only its verdict, a token that says pass or fail. We do not see the signals it evaluated. Cloudflare's own privacy policy governs what it does with them.
Server logs
Like every web server, ours keeps access logs. Depending on configuration, they can include the IP address each request came from, the page or endpoint it asked for, and when. We use them to keep the service secure and to work out what went wrong when something breaks. Retention depends on the logging system: records needed for an open security incident or support investigation can be kept until it is resolved. Contact us for the applicable operational retention settings.
Error reports
Error reporting is a separate, optional setting from usage analytics, on by default, under Settings → Privacy. Unless you turn it off, when the app or our server hits a fault, a report goes through a first-party relay we control to an error tracker we run ourselves, on our own servers. The relay checks your current permission before forwarding anything; a report is never sent while error reporting is off. A report can include what went wrong, the lines of our code around it, the app version, the device's operating-system family, and the id of the account and device that were signed in, so we can tell whether one person or everyone is affected. We filter authentication secrets, request bodies, and other content beyond that approved set of fields. GlitchTip, our error tracker, is configured to keep reports for 30 days. Reports already accepted before you turn error reporting off cannot be unsent; deleting your account removes the local link to those reports but does not immediately erase them from GlitchTip; see "Deleting your account" below.
Cookies and browser storage
We set a session cookie so you stay signed in, and a cookie that remembers your time zone so pages render in your local time. Both are ours. We set no advertising cookies and do not use your app content for advertising.
Payment-provider scripts and checkout pages may use their own cookies or browser storage. Paddle's practices are described in its privacy policy; Stripe's are described in its privacy policy.
Email we send you
Some email is part of signing in: the confirmation when you create an account, a sign-in link if you ask for one, and a password reset if you ask for that. You cannot turn those off, because you need them to get in.
Two kinds of email are scheduled: a single invitation to plan your morning, sent a couple of days after you sign up, and a short announcement when something new ships. You can turn either or both off in the app under Settings, Notifications, or with the unsubscribe link at the foot of any of them.
Voluntary correspondence
When you email us with a question or for help, we keep that correspondence, including your email address, so we have a record to refer to if you get in touch again.
Mobile app permissions
The mobile app uses network access and app-private storage, and its Android build also declares network-state, vibration and secure-credential biometric permissions. We do not receive biometric templates from the device. Release builds do not request shared-storage or overlay access. Development builds may use overlay permission for developer tools. The app does not request access to your contacts, calendar, location, camera or microphone.
When we access or disclose your information
To run the service. We use the following services to run Sirius Focus. Each receives the data that its job needs:
- Hetzner Online GmbH, Germany, hosts our application infrastructure. Local-only workspaces stay on your device. Payment, email, community and software-update services also process the information described here.
- GlitchTip, an error tracker we run ourselves on our own infrastructure, receives error reports only when you have turned error reporting on. It is not a third party we disclose data to; it is part of our own systems, named here because it has its own retention setting, described under "Error reports" above.
- Resend, Inc., United States, delivers the email we send. It receives your email address and the contents of each email, which is never your content, only the messages described above.
- Cloudflare, Inc., United States, provides the Turnstile anti-bot check on our sign-in and registration forms.
- Paddle, through the entity identified at checkout, processes subscription and historical supporter payments when Paddle is used at checkout. It receives your email address and your payment details, and is the data controller for the payment itself under its own privacy policy.
- Stripe Managed Payments processes subscription and historical supporter payments when Stripe is used at checkout. It receives your email address and payment details and handles payment data under its own privacy policy. Existing subscriptions continue with the provider that originally sold them.
- Discord receives role-management requests for your Discord account if you choose to link it. Its handling of community and account information is described in its privacy policy.
- Expo delivers mobile software updates. Update checks can send technical app, device and connection information to its update service. They do not upload your private workspace content. See Expo's privacy policy.
Access to your content is limited. We do not routinely read it. Access is restricted to support, necessary fault investigation, security and abuse investigations, or legal requirements, as described below.
To help you, with your permission. If we ever need to look at your content to help you with a support request, we will ask first.
To investigate abuse. If we have good reason to believe an account is being used to break the law or to harm others, we may look at what we need to in order to act, and we may notify the appropriate authorities where the law requires it.
When required by law. Alchymir Ltd is a United Kingdom company. We do not hand user data to any government unless we are compelled to by a legally binding order, and we will tell you before we do unless the law forbids it. Requests from authorities outside the United Kingdom are answered only when UK law compels us.
If Alchymir Ltd is acquired by or merges with another company, which we have no plan for, we will tell you well before any of your personal information changes hands or becomes subject to a different privacy policy.
Your rights over your information
Under the UK General Data Protection Regulation and the Data Protection Act 2018 you have the following rights, and we apply them to everyone who uses Sirius Focus, wherever they live:
- To know what we collect and why, which is what this page is for.
- To access the personal data we hold about you.
- To correct anything that is wrong.
- To erase your data, subject to applicable legal exceptions. Account deletion is described below.
- To restrict or object to how your data is processed, in certain situations.
- To portability: to receive your data in a machine-readable form. On the web, open Settings, choose General, and use Download my data to export your workspace content and usage analytics records as JSON. For other personal information, including billing and device records, contact us.
- To complain to the Information Commissioner's Office at ico.org.uk, or to your own data protection authority if you are outside the United Kingdom.
To exercise any of these, email privacy@alchymir.com from the address on your account. We may need to check that it is really you before we act, and we will answer within one month.
How we secure your data
Everything between your device and our servers travels over TLS. Passwords are stored only as one-way hashes. Sign-in tokens expire and can be revoked. Our servers are reachable only through the encrypted connections the service needs, and we keep them patched.
Deleting your account
You can delete your account yourself, at any time, from inside the app:
- On the web: open Settings, choose General, and use Delete account at the foot of the page.
- On Android: open Settings, scroll to Account, and tap Delete account.
You confirm deletion in the app. Before deleting an account with a recorded provider subscription, we confirm that future renewals are cancelled. If the provider is unavailable or cancellation cannot be confirmed, deletion stops and you can retry. This does not itself refund previous payments.
Deletion removes your account, synced content, settings, sync history, usage analytics records, and device records from the live database. We revoke stored sign-in tokens; revocation records remain until expiry to prevent reuse. A limited email-link cutoff record prevents old sign-in links from recreating access and expires after those links can no longer be used. Error reports already accepted into GlitchTip before deletion are not immediately erased: we remove the local link to your account and flag those reports for manual erasure, and will automate that removal once our error tracker's deletion workflow can be verified end to end. Remove copies on other devices yourself, especially devices that are offline.
Payment records are kept for accounting: amount, currency, tax, dates, refund status and the provider's transaction identifier. Its link to your local user account is removed, but a provider identifier can still be linked to you through that provider; we do not describe it as anonymous. Your public supporter listing, Discord connection and local payment-customer records are deleted. Matching stored webhook payloads and their job errors are redacted during deletion. Later notifications received from a provider remain subject to the retention below.
If you can no longer sign in and want your account deleted, email privacy@alchymir.com from the address on the account and we will do it for you, once we have checked that the request is yours.
Data retention
Synced account content is kept while your account exists unless you delete it sooner. Completed actions follow the retention period you choose in Settings. Contact-form submissions are deleted from the application after 14 days; the emailed correspondence remains in our support mailbox for handling and referring back to your request.
Usage analytics records you generate while a setting is on are kept for 90 days from when we receive them, then deleted. Error reports are kept for 30 days in GlitchTip, our error tracker. Both settings are on by default and can be turned off at any time under Settings → Privacy; turning either one off stops new collection but does not itself erase records already accepted, which age out on the schedules above.
A daily job redacts finished payment-webhook payloads and job errors after 30 days, then deletes the remaining event IDs and processing metadata after 90 days. Unfinished jobs retain their payload while processing and retries are pending. Financial records are retained for applicable accounting and tax obligations and resolving payment disputes. Provider-held records follow that provider's policies.
Backups, operational logs and diagnostic systems have separate retention settings. Deletion from the live database does not instantly erase an existing backup. Such copies are restricted to recovery and investigation and expire through the relevant system's rotation. Contact privacy@alchymir.com for the applicable periods or to make an erasure request that includes these systems.
Lawful bases
- Providing the service: account access, requested sync, billing and requested account integrations are processed to perform our contract with you.
- Security and reliability: fraud prevention, limited access logs, fault investigation and support records serve our legitimate interests in keeping the service secure, reliable and accountable. You can object to this processing.
- Legal obligations: records required for accounting, tax and responding to binding legal requirements are processed to meet those obligations.
- Optional publication and recovery: we rely on your consent to publish your supporter nickname and note, and to enable optional background payment recovery. Withdraw it using the relevant setting; withdrawal does not affect earlier lawful processing.
- Usage analytics and error reporting: understanding how the service is used and catching faults before they spread serve our legitimate interests in keeping the product working and improving it. Each is on by default and a separate, independent choice under Settings → Privacy. You can object to either at any time by turning it off; doing so stops new collection immediately but does not undo processing that already happened.
- Product emails: account and payment messages support our contract; optional product guidance and news serve our legitimate interest in helping customers use the service, subject to applicable electronic-marketing rules. You can opt out in Notifications or through the email's unsubscribe link.
Where your data lives
Alchymir Ltd is in the United Kingdom. We use Hetzner for application hosting and the services listed above for email, payments and community features. Personal data can be processed in other countries by these providers and their subprocessors. A local-only workspace stays on your device unless you choose to sync or share it.
International transfers
International transfers require an applicable legal mechanism, such as an adequacy decision or contractual safeguards. Payment providers and Discord describe their own arrangements in their privacy policies. You can ask us for details of the safeguards applicable to information we transfer. We do not send your private app content to payment providers or Discord to provide supporter membership.
Changes and questions
We may update this policy as the product changes or the law requires. When we make a significant change we will refresh the date at the top of this page and take whatever other steps are appropriate to tell you, which for anything that matters means an email. The current version always lives at this address.
Questions, comments or concerns about this policy, your data or your rights? Email privacy@alchymir.com and we will be glad to answer them.
Adapted from the open-source policies published by 37signals, used under CC BY 4.0.