Gravity Focus Privacy Policy
Posted: September 30, 2026 · Effective Date: October 7, 2026
한국어 버전
What's changing (effective October 7, 2026)
- New section on the optional phone calendar connection (Android) (1.4)
- More specific description of usage analytics (Amplitude): includes your account ID (Firebase UID) when you are signed in (1.3, 5.1)
- Added the provider that delivers in-app feedback (Discord) and completed the list of collected items, such as Brain Dump and reward records (1.2, 5)
Gravity Focus ("App") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and safeguard your information in accordance with applicable privacy laws including the Korean Personal Information Protection Act (PIPA), the EU General Data Protection Regulation (GDPR), and the Japan Act on the Protection of Personal Information (APPI).
1. Information We Collect
1.1 Information You Provide
| Data | Purpose |
|---|
| Email address | Account identification, login, customer support |
| Google account info (name, profile photo) | Social login, user identification |
| Nickname, bio | Profile settings, user identification |
1.2 Information Generated During Service Use
- To-do lists, routines, and schedule data
- Pomodoro/focus session records (start/end time, duration, completion status)
- Journal entries (up to 1,500 characters) and mood records (5-level scale)
- Routine checklist items and attached drawings
- Usage statistics (streaks, completion counts, points)
- Brain Dump entries and "Thoughts to revisit" notes
- Reward records (stars, reward boxes, constellations)
- App settings and preferences
- Subscription status and payment information (payments processed by Google Play)
1.3 Automatically Collected Information
The following information is collected automatically while you use the App. We do not collect your name, email address, IP address, or advertising ID. However, if you are signed in, your account ID (Firebase UID) is sent with usage statistics, so they may be analyzed per account.
- App-generated device ID (random UUID, newly created on reinstall, not linked to other apps or services)
- Account ID (Firebase UID, if you are signed in)
- Device information (OS name, OS version)
- App version
- App usage events and session data (Amplitude)
- Language settings
- Error logs (Firebase Crashlytics)
Usage Statistics Collection: The above information is collected by default for new installations. You can choose to disable collection during initial setup (onboarding) or at any time in More → "Send usage statistics".
1.4 Phone Calendar (Optional, Android)
Only if you turn on "Phone calendar" in the Schedule tab and allow calendar access, the App processes calendar data as follows:
- What it reads: The calendars stored on your device (name, account name) and their events (title, start and end time, all-day flag)
- How: Read on your device only, to show them in the Schedule tab. This data is never sent to a server or saved by the App
- Importing: Only events you import become app data (timetable or schedule items) stored on your device, and like other app data they are included in your personal Google Drive backup (optional). The identifier used to prevent duplicates is stored as a hash, not the original
- No writing: The App never creates or changes events in your phone calendar
- How to stop: Tap "Disconnect" in the phone calendar settings of the Schedule tab, or turn off calendar access in your device settings
2. How We Use Your Information
- Service Delivery: Task management, routine management, focus sessions, schedule management, journal features
- Phone Calendar (optional): Showing your device calendar events in the Schedule tab and importing the ones you choose
- Account Management: User authentication, login, cross-device data synchronization
- Subscription Management: Pro subscription status verification and management
- Service Improvement: Feature enhancement through usage pattern analysis
- Error Response: App error detection and stability improvement
- Customer Support: Responding to inquiries, handling complaints, and collecting user feedback via in-app feedback feature
2.1 Legal Basis for Processing (GDPR)
| Legal Basis | Processing Activities |
|---|
| Contract Performance | Core app features (task management, routines, focus sessions, journal, cloud sync) |
| Consent | Analytics data collection (Amplitude), crash reporting (Firebase Crashlytics), phone calendar access (optional) |
| Legitimate Interest | Security, service stability, fraud prevention |
| Legal Obligation | Retention of payment records as required by law |
3. Data Retention
Principle: We retain your data only as long as necessary for the purposes described above.
Account Deletion: All personal data is permanently deleted upon request (except where retention is required by law).
| Data Type | Retention Period | Reason |
|---|
| Subscription/payment records | 5 years | Electronic Commerce Act (Korea) |
4. Third-Party Sharing
We do not share your personal information with third parties except in the following cases:
- With your prior consent
- As required by law
5. Data Processing Partners and International Data Transfers
We use the following third-party services to operate the App. Your data is transferred to servers located in the United States:
| Service Provider | Purpose | Data Transferred | Country | Retention |
|---|
| Google LLC (Firebase) | Authentication, nickname and subscription status storage, error reporting, app integrity checks, relaying feedback | Email, account ID, nickname, subscription status, error logs | United States | Duration of service use |
| Google LLC (Drive) | Backup to user's own Google Drive (optional) | Encrypted app data | United States | Duration of service use |
| Amplitude, Inc. | App usage analytics | Device ID (random UUID), account ID (when signed in), app usage events | United States | Duration of service use |
| RevenueCat, Inc. | Subscription management | App user ID, subscription status | United States | Duration of service use |
| Discord Inc. | Delivering and storing messages sent via in-app "Send Feedback" | Your message, platform, time sent | United States | Until the inquiry has been handled |
You may refuse international data transfer, but this may limit your use of the service.
Safeguards for International Transfers: All data is transmitted via HTTPS encryption. Our service providers maintain appropriate data protection measures and comply with applicable data protection regulations.
5.1 Amplitude Analytics
We use Amplitude for service improvement. The following data is collected:
- Data Collected: App-generated device ID (random UUID), your account ID (Firebase UID) if you are signed in, app usage events (screen views, feature usage, session start/end), app/OS version, language settings
- Data NOT Collected: Your name, email address, IP address, or advertising identifier (ADID)
- Purpose: Usage pattern analysis, feature improvement, service quality enhancement
- Transmission: HTTPS encrypted transmission
- Collection: Enabled by default for new installations. You can choose to disable collection during initial setup (onboarding) or at any time in More → "Send usage statistics".
- Details: Amplitude Privacy Policy
5.2 RevenueCat Subscription Management
We use RevenueCat for in-app subscription management:
- Data Collected: App user ID (account ID), subscription status, purchase history
- Purpose: Subscription validation, purchase restoration, subscription analytics
- Details: RevenueCat Privacy Policy
5.3 Firebase Crashlytics
We use Firebase Crashlytics for stability improvement:
- Data Collected: App crash logs, error stack traces, device information
- Purpose: Error detection and resolution, stability improvement
- Consent: Activated upon acceptance of this Privacy Policy. You can disable collection in Settings.
- Details: Firebase Privacy Policy
5.4 Google Drive Cloud Backup (User's Own Storage)
When you enable cloud synchronization, your app data is backed up to your own Google Drive storage. Data is not transmitted to the app operator's servers.
- Storage Location: Your own Google Drive account
- Data Stored: To-do lists, routines, schedules (including imported phone calendar events), focus records, journal entries, mood records, Brain Dump entries, and other app data
- Security: All backup data is encrypted with AES-256 before upload
- Access Scope: The app only accesses files it created (drive.file scope)
6. Behavioral Information Collection
The App collects the following behavioral information for service improvement:
| Item | Details |
|---|
| Data Collected | App usage events, screen views, feature usage patterns, session data (linked to a device ID and, when signed in, an account ID) |
| Collection Method | Automatic collection via Amplitude (enabled by default for new installations) |
| Purpose | Service improvement and user experience optimization |
| Transmission | HTTPS encrypted transmission (IP addresses not collected) |
| How to Opt Out | During initial setup (onboarding) or turn off "Send usage statistics" in the More menu |
7. Your Rights
You have the following rights regarding your personal data:
- Request to access your personal data
- Request to correct or delete your data
- Request to stop processing your data
- Account deletion
- Data Portability: You can export your data via cloud backup in encrypted JSON format
- Right to Object: You can object to analytics data processing via the settings toggle
How to exercise your rights: Use in-app settings or contact us at the email below.
Account Deletion: Account Deletion Guide
7.1 How to Withdraw Consent
- Analytics/error data collection: During initial setup (onboarding) or go to More → turn off "Send usage statistics"
- Phone calendar connection: Tap "Disconnect" in the phone calendar settings of the Schedule tab, or turn off calendar access in your device settings
- Full consent withdrawal: Delete your account in Settings, or contact us at skadldh@gmail.com
Even after consent withdrawal, data required to be retained by law will be kept for the legally mandated period.
7.2 EU Residents (GDPR)
If you are an EU resident, you additionally have the right to:
- Lodge a complaint with your local data protection supervisory authority
- Withdraw consent at any time (without affecting the lawfulness of processing based on consent before withdrawal)
- Request restriction of processing
8. Data Destruction
When the retention period expires or the purpose of processing is achieved, personal data is destroyed without delay:
- Electronic files: Permanently deleted using irreversible methods
- Other: Shredded or incinerated
9. Data Security Measures
- Encrypted data transmission (HTTPS/TLS)
- Cloud backup data encrypted with AES-256
- Access control through Firebase security rules
- Minimization of personal data access privileges
10. Children's Privacy
The App does not collect personal information from children under the age of 14. If a child under 14 wishes to use the service, parental or legal guardian consent is required.
11. Data Controller Information
12. Remedies for Rights Infringement
If you need to report or consult about personal data infringement:
- Korea: Personal Information Infringement Report Center: privacy.kisa.or.kr / 118
- Korea: Supreme Prosecutors' Office Cyber Investigation: www.spo.go.kr / 1301
- EU: Contact your local data protection supervisory authority
13. Changes to This Policy
This Privacy Policy is effective from the date stated above. Any additions, deletions, or corrections will be announced through the App or this page at least 7 days before the changes take effect.