Your attention. Your controls.

Development preview, updated 20 October 2026. This is not yet a public subscription service.

What the portal stores

If you enable app sharing on a phone, its selectable app names and Android package identifiers are synced to your private account. You can turn sharing off to remove this list and stop remote app selections. App icons and page content are not uploaded. Blocked-attempt insights can be shared separately, as described below. Gift records store sender/recipient account IDs and trial dates; gift secrets are hashed. Up to five paired devices are allowed per ordinary preview account; gift trial accounts are limited to one and cannot send gifts. Offline paired devices count toward these limits. Disconnecting frees a slot. Your account identifier, device names and models, saved app and website blocklists, recurring schedules, emergency-use timestamps, session requests, device confirmations, and last connection times are stored to provide device management. Device credentials and pairing codes are stored as hashes on the server. General browsing history and page content are not uploaded by the Android app.

Owner support and technical health

From Android 0.23, device sync includes app version/build, Android version, Accessibility and local VPN readiness, VPN running status and battery optimization status. These operational fields support reliability and troubleshooting; they do not include browsing-attempt history, app inventories or calendar contents. The owner console is restricted to the configured verified owner account and shows device and session delivery status, account email, submitted feedback and aggregate gift usage. It does not expose customer blocklist contents or Insights. Feedback can optionally include a technical snapshot; the app previews the message before sending. Server troubleshooting records contain a random support reference, a fixed route name, HTTP status and time. Request bodies, URLs with query strings, credentials and user identities are excluded. Server errors are retained for 30 days; rate-limit responses are sampled. Owner console access and feedback status changes are audited for 180 days. Technical device state reflects its last sync and can become stale.

Optional Focus insights

History collection starts off. You can enable local history in Android Settings → Permissions & privacy and separately consent to share it with your paired portal account. Records contain blocked app names and package identifiers, blocked website domains, attempt times and completed focus-session durations. Full URLs, searches, page content, background network packets and activity outside focus sessions are excluded. Unknown destinations are not recorded as website attempts. Repeated blocks of the same target within 30 seconds in a session are grouped. Counts describe detected blocks, not time saved or continuous enforcement. Local history keeps up to 5,000 records and removes expired records when the app next runs. Shared records expire after 90 days, with daily server cleanup. Turning off sharing removes the server copy on the next successful phone sync. You can delete history from the app or portal; deletion reaches offline phones when they reconnect. Future records can continue if collection or sharing stays enabled. Anyone signed into the same portal account can view its shared insights. Completed minutes are recorded when sessions finish; each device is counted separately.

Beta feedback

You can send feedback and manage gift trials from the paired Android app or the web portal. App account actions authenticate with existing device credentials and affect its paired account. Android feedback always references that phone. Gift links can be copied or shared using the Android chooser; nothing is sent to another person automatically. When you submit feedback, we store your account identifier, report type, message, optional device reference and submission time. Only your account can read its reports through the portal; the service owner can review stored feedback to improve the beta. No screenshot, device log or calendar detail is attached automatically. From Android 0.23, you may optionally include a previewed technical snapshot. Reports are saved for review; replies and automatic notifications are not connected. Please avoid including passwords, pairing codes or other sensitive details.

Sign in directly on Android

From Android version 0.18, sign-in is required before using the app; there is no guest mode. Signing out returns to the sign-in screen and prevents new manual, scheduled and remote sessions. Existing session timers finish normally, and signed-in phones can use downloaded routines offline. Existing QR-paired phones must sign in to the same account to retain their device slot. Android sign-in registers this phone with your account without a QR code or a portal dashboard visit. Email sign-in sends your email and password over HTTPS to our sign-in endpoint, which verifies them with Supabase; passwords and Supabase session tokens are not stored on the phone or in the application database. Google sign-in and account creation use your browser, then return to Android using a short-lived approval code protected by a verifier held on the initiating phone. Temporary sign-in records expire after ten minutes, with approved codes usable for two minutes; expired records are cleaned on new requests and daily. Device credentials are encrypted with Android Keystore and stored only as hashes on the server. Signing out in the app revokes this phone and frees its account slot. Ordinary accounts allow five phones and gift trials one. Existing QR connections can be reused when signing in to the same account. Sharing app inventories, calendars and Insights remains separately optional.

QR sign-in and permission controls

Sign-in QRs expire after two minutes and can be used once. From version 0.19, phones sign in with Google or email; portal-to-phone QR sign-in has been removed. The app has separate welcome, sign-in and account-creation screens. Native email registration sends credentials over HTTPS to Supabase through our endpoint; verification email confirms the address, and the customer returns to the app to sign in. Temporary provider tokens in the confirmation redirect are discarded rather than adopted as browser identity. A signed-in phone can approve a browser after matching its six-digit code. Browser login uses a separate first-party session in a secure HttpOnly cookie, bound to the original requesting browser and approving phone. The application stores only its token hash, verified account identity, phone reference and expiry. It lasts up to seven days, can be ended by browser sign-out and stops working if the approving phone is removed. It does not create or expose a Supabase session. Expired QR and browser-session records are cleaned daily. Older phones may need a one-time Google or email sign-in to establish their verified email for web approval. QR data never contains a password or reusable phone credential. Keep phone invitations private and approve only your own requests. Settings → Permissions & privacy shows actual Android permission status and separate sharing choices. Android permissions require system approval; the dashboard cannot grant them silently.

How devices connect

Pairing is voluntary and uses a single-use code that expires after five minutes. A paired phone syncs its named blocklists and recurring schedules in both directions while the app or accessibility service runs. Offline edits are queued; changed revisions are reviewed as drafts rather than silently overwriting another edit. Server deletion markers prevent offline edits from restoring deleted items. Battery restrictions and network loss can delay delivery. The portal shows reported state and cannot guarantee continuous enforcement.

Optional phone calendar

The Android app requests calendar read access only when you enable Read phone calendars in Settings → Permissions & privacy. Meetings and classes can be viewed locally. If you separately enable Share calendar busy times, only event start and end times for the next 14 days are uploaded to your account. Event titles, attendees, locations and descriptions stay on the phone. Turning sharing off removes the uploaded snapshot after the next successful sync. Adding a routine to a calendar opens your calendar app for confirmation; calendar edits do not change blocking schedules. The portal can export the next 90 days as an ICS file.

Internet focus

All-internet lists require Android VPN permission. A local packet sink discards IPv4 and IPv6 network traffic from other apps while the session is active; no traffic is forwarded to a VPN server or logged. Selected app exceptions, Focus Harbor and essential phone controls bypass it. From Android app version 0.13, non-exempt apps are also covered by a focus screen during all-internet sessions. Android supports one active VPN. Website exceptions require supported browsers to bypass the packet sink and then use accessibility address-bar checks; this is not network-level domain filtering. An exempt browser app allows all its websites. In-app browsers, hidden address bars and background traffic do not have a complete domain-filtering guarantee. Android can revoke VPN or accessibility permissions.

Device controls

Disconnect a device from the dashboard or Android app. Downloaded sessions keep their original local timer after disconnection. Synced routines pause when the phone learns it has been disconnected. Commitment mode disables ordinary early-stop controls. One emergency end is available every seven days across the paired account; paired phones require internet to authorize it. Unpaired phones keep a local allowance. Offline devices receive a portal emergency cancellation on their next sync; Android settings, permission revocation, and uninstall remain available.

Preview limitations

The landing page, Android download page and beta APK, and device connection endpoints are public for development testing. Customer dashboards and account APIs require verified Supabase sign-in or a browser session explicitly approved by a signed-in phone. Devices authenticate with their own credentials. Legacy pairing QRs contain a portal address and short-lived pairing code; sign-in QRs contain only a short-lived sign-in token. The scanner uses Google Play services. Billing, account self-deletion and push delivery are not available in this beta. Customer email/password login and recovery require the configured Supabase project and verified email delivery. The new portal does not automatically import accounts or devices from the earlier ChatGPT preview. Android 0.11 caches synced schedules and runs them locally with inexact alarms. Internet is needed to receive new changes and cancellations; offline devices can retain older schedules until their next sync.