Information stored by this browser
Without Firebase configuration and a verified account, tasks and details, project names, task completion/recurrence state, timer preferences and presets, generated ambience preferences, music volume and saved music-favourite IDs, focus-session records and the timer recovery snapshot are kept in browser local storage on the device and browser being used. Data can be lost if browser data is cleared, private browsing is used or storage becomes unavailable. A user-initiated JSON export is available; exported files may contain sensitive task notes and activity history.
Optional account and cloud sync
Alpha 0.2.2 contains an optional Firebase Authentication email/password flow and a Cloud Firestore app-data snapshot. This service is not initialized unless the project owner configures it, and cloud sync is not enabled until a user verifies their email and explicitly chooses a first-sync action. When enabled, the snapshot may include task titles and notes, project names, categories/tags, task status and recurrence, focus-session history and intentions, timer presets, preferences and timer recovery state. Timer ticks are not individually uploaded.
Firebase Authentication receives the email address and password for sign-in; focusroom does not store the password itself. Firebase sends verification and password-reset messages using the configured provider templates. Google/Firebase may process technical request metadata as part of its service. The actual project, database region, settings, retention and current provider terms must be reviewed before deployment; the source code alone cannot establish how the provider is configured.
Sync choices, backups and deletion
The app asks before first upload/download/merge/replacement. Applying cloud data or merging tries to create a JSON backup first; replacing cloud state requires confirmation. Keep separate backups, because the app does not guarantee provider-managed database backups. The current cloud implementation rejects snapshots above its 700 KiB application limit without truncating local data.
Account deletion requires password reauthentication and attempts to remove this account’s cloud snapshot and Firebase Authentication user. It does not erase local browser data on the current or other devices, nor does it delete downloaded JSON backups or emails already delivered. Any copies you exported or synced elsewhere must be handled separately.
Audio, notifications and other integrations
Procedural ambience is generated locally through browser audio APIs. Mundane and Pretty Little Lies are bundled as local MP3 assets and are served by the app's hosting origin. The other ten music tracks stream from OpenGameArt or other source hosts only after you press play; those hosts may receive the audio request and associated technical metadata under their own policies. Four Freesound recordings are bundled locally as WAV/FLAC assets and played by Focusroom’s native audio player. Playback of these local recordings does not request audio from Freesound; their original pages are retained in the project’s creator and licence notes. The music player does not send your task data to these hosts. Browser notifications are optional and use the permission you grant through your browser. The alpha does not implement analytics, live advertising, payment collection, a server-submitted feedback channel or a paid subscription service.
Hosting, security and limitations
If hosted, the hosting provider and network infrastructure may process technical request data according to their terms. Firestore Security Rules are included in the project but must be published and tested in the actual Firebase project before cloud data is trusted. The alpha has not completed a release-grade security, accessibility, performance or compliance audit. Do not put passwords, financial information, medical details or other highly sensitive data in task notes.
Retention, rights and policy updates
Local data remains until you change/remove it, reset the app or browser storage is cleared. Cloud snapshot and authentication records are intended to remain until account deletion succeeds, subject to provider systems, terms and operational logs. Backups and copies on other devices remain user-controlled. The operator/contact identity, actual provider region, retention review, applicable legal basis/rights processes and complaint/contact method are not configured in this draft and must be established before public release.