Skip to main content

Privacy Policy

Effective Date: March 14, 2026 | Last Modified: March 14, 2026

Google CASA Tier 2 Security Assessment

Focus Box passed the Google CASA Tier 2 security assessment for applications requesting Gmail access. The assessment reviews how apps protect user data, handle OAuth access, and maintain secure data practices.

  • No email content stored
  • OAuth tokens encrypted at rest
  • Scoped Gmail access only
  • Disconnect and delete anytime
ESOF security assessment shield

1. Introduction

This Privacy Policy ("Policy") explains how Focus Box ("Company," "we," "our," or "us") collects, uses, and discloses your information when you use our website, application, and services (the "Service"). Please read this Policy carefully. If you do not agree with our practices, please do not use the Service. By accessing or using Focus Box, you acknowledge that you have read, understood, and agree to be bound by this entire Policy. This Policy applies to all users of Focus Box, including both free and paid subscribers.

2. Information We Collect

We collect information in the following ways: 2.1 Information You Provide Directly: - Email address during account registration - Payment information (processed by Lemon Squeezy — we do not store card details) - OAuth tokens from Gmail or Microsoft Outlook (encrypted at rest) - User configuration preferences (digest time, timezone, priorities, labels) 2.2 Information We Collect Automatically: - Email provider message IDs for emails we have already processed - Email sender, subject, and body text during live processing (used transiently for classification and summarization, then discarded - not stored) - Usage analytics: features accessed, time spent, error logs - Device information: browser type, operating system, IP address 2.3 Information from Third Parties: - Google and Microsoft provide user information via OAuth (email, name, profile picture)

3. How We Use Your Information

We use collected information for the following purposes: - Service Delivery: Classifying emails, applying labels/categories, and avoiding duplicate reclassification - AI Processing: Analyzing sender, subject, and a portion of email body text during live processing to classify priority and generate digests - Account Management: User authentication, account settings, subscription management - Improvement: Analyzing usage patterns to improve features and performance - Communication: Sending service updates, security notices, or account changes - Legal Compliance: Enforcing our Terms of Service, preventing fraud, complying with law - Analytics: Aggregated, non-identifiable usage metrics to understand service health We never sell, rent, or share your personal data with third parties for marketing purposes.

4. Data Retention

We retain your information for as long as necessary to provide the Service: - Account Data: Retained for the duration of your subscription and 30 days after deletion - Email Provider Message IDs: Retained only to prevent duplicate classification - Email Sender / Subject / Body Content: Not retained - used during processing and immediately discarded - OAuth Tokens: Retained only while your account is active; deleted when you disconnect or delete your account - Server Logs: Retained for up to 90 days for security and debugging purposes - Backup Data: Retained for 35 days You may request deletion of your data at any time by deleting your account. Data deletion is permanent and immediate.

5. Data Security

We implement industry-standard security measures to protect your information: - Encryption at Rest: OAuth refresh tokens are encrypted at rest - Encryption in Transit: All communications use TLS 1.2 or higher - Access Control: Database queries are parameterized and filtered by user_id — one user cannot access another's data - Regular Backups: Automated backups every 30 minutes - Security Updates: We apply security patches promptly and maintain current dependencies - Google CASA Tier 2: Focus Box has passed the Google CASA Tier 2 security assessment for Gmail API access However, no security system is completely impenetrable. While we implement robust safeguards, we cannot guarantee absolute security.

6. Third-Party Services

We use the following third-party services: - Lemon Squeezy: Payment processor (does not share your card details with us) - Google Cloud: Gmail API for email access and label management - Microsoft Graph: Outlook API for email access and category management - Third-Party AI Models: Email classification and summarization - All data is stored in U.S. based servers

7. Your Privacy Rights

You have the following rights regarding your data: - Right to Access: Request a copy of your data at any time - Right to Deletion: Delete your account and all associated data immediately - Right to Correction: Update inaccurate or incomplete information - Right to Portability: Request your data in a machine-readable format - Right to Opt-Out: Disconnect your Gmail or Outlook account at any time To exercise these rights, contact us at [email protected]. Additional Rights for EU and California Users: - GDPR (EU): You have additional rights under the General Data Protection Regulation - CCPA (California): You have additional rights under the California Consumer Privacy Act - Contact our Data Protection Officer for specific GDPR/CCPA requests

8. Cookies and Tracking

We use cookies for the following purposes: - Authentication: Session cookies to keep you logged in - CSRF Protection: Security tokens to prevent cross-site request forgery - Analytics: Optional performance metrics (can be disabled) Third-party services (Lemon Squeezy, Google, Microsoft) may set their own cookies. You can disable cookies in your browser settings, but this may limit functionality.

9. Children's Privacy

Focus Box is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we discover that a child under 13 has provided information, we will delete it immediately and terminate their account. If you are a parent or guardian and believe your child has provided information to Focus Box, please contact us at [email protected].

10. International Data Transfers

Focus Box is based in the United States. Your information may be transferred to, stored in, and processed in countries other than your country of residence. These countries may have data protection laws that differ from your home country. By using Focus Box, you consent to the transfer of your information to countries outside your country of residence, including the United States.

11. Policy Changes

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated Policy and updating the "Last Modified" date. Your continued use of Focus Box after changes constitutes your acceptance of the updated Policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: Email: [email protected] Data Protection Officer (for GDPR requests): Email: [email protected] Last Modified: March 14, 2026

Questions about our privacy practices? See our Terms of Service.