Focus Room · Privacy

Privacy policy

Effective date: 27 October 2026 (iOS addendum: 30 October 2026; room sharing: 7 November 2026) · App: Focus Room (Android and iOS, com.beeapps.focusroom) · Developer: Bee Studios

Focus Room works without an account and without internet. Your timer, your room, your tomatoes and your stats stay on your phone.

On first launch you pick a @username; this name and your tomato's colour are stored on our server (your real name is not needed). Beyond that, data reaches our server only when you use one of these features: creating or joining a Focus Team, or backing up your progress with Google Play Games (Android) or Game Center (iPhone). No ads, no analytics or tracking tools; we do not sell your data. We never ask for your email, phone number, location, contacts or photos.

1Who is responsible

Focus Room is developed and published by Bee Studios, the controller of the data described here (the "data controller" under Turkish Law No. 6698 on the Protection of Personal Data, "KVKK", and under the GDPR).

Contact: info@beestudios.app

2What stays on your phone

The following is stored on your device and sent nowhere (unless you turn on backup; see 3.6):

Your room layout, items, tomato balance, daily focus minutes, streak, badges, quests and settings.
In-app usage counters (e.g. how many sessions you started). These are kept on the device only and are never sent to any server or third party.
A random secret key generated on the phone for Focus Teams (see 3.1).

The app opts out of Android's automatic cloud backup, so this data is not copied to your phone's Google backup. On iPhone, this data may be included in Apple's device backup if you have iCloud or computer backup turned on; we cannot see that backup. Uninstalling the app removes all of it from the phone. Settings → Reset progress erases your progress on this device.

3What reaches our server

Our server runs on Cloudflare (Cloudflare Workers and the D1 database). All connections are encrypted with HTTPS.

3.1 Device key: The app generates a random 64-character secret key on your phone and sends it with every request; the server stores only its SHA-256 hash. It is not derived from your hardware ID or advertising ID. It is first used when you check a username or team tag, take a username, join a team or connect Play Games.
3.2 Username and avatar: The @username you choose (3–20 letters/digits) and your character's look (colour, hair, outfit choices; not a photo). It does not have to be your real name. If you change your username, the old one stays reserved for you for 30 days (nobody else can take it) and the times of your changes are kept for 60 days to prevent abuse. Text you type while checking whether a name is available is used only to suggest alternatives and is not stored.
3.3 Focus Teams: The #tag of the teams you create or join, when you joined and whether you are the admin. If an admin changes the tag, the old tag redirects to the same team for 30 days. Join requests you send are valid for 7 days and admin invites to you for 14 days; settled requests and invites remain on record, and those older than 30 days are removed in bulk whenever a new request or invite is created.
3.4 Focus sessions: While you are in at least one team: for every completed focus session, its start and end time, minutes and the day it falls on (the day is computed with your phone's time zone; the time zone itself is not stored). When you first join a team, your daily total minutes for the last 14 days are sent once. During a session, a live "focusing now" status (the session's start and end time) is sent and cleared when the session ends or stops. Sending stops when you leave your last team.
3.4a Your room layout: While you are in at least one team, a list of the items in your room, their positions and the colours you chose is sent so your teammates can look at your room (updated when your room changes). It contains no personal information, photos or tomato balance. Only people who share a team with you can see it. "Delete my server data", "Delete my team data" or deleting your account deletes it too.
3.5 Google Play Games link (optional): If you choose to connect Play Games, the phone gets a one-time code from Google; our server has Google verify it and stores only your Play Games player ID. Google also returns your Play Games display name; we do not store it. We never receive your email address, profile photo or friends list. The device-key hashes of other phones you open with the same account are linked to this record too.
3.5a Game Center link (iPhone): If you are signed in to Game Center on your iPhone, the app connects silently when it opens; otherwise the link is made only with the button in Settings → Account and backup. The phone sends an identity package signed by Apple; our server verifies the signature with Apple's public key and stores only your Game Center player ID. We never receive your Game Center nickname, email address or friends list. As with Play Games, the device-key hashes of other phones you open with the same account are linked to this record; the backup in 3.6 and deletion in section 7 apply to Game Center in the same way.
3.6 Backup (only when Play Games or Game Center is connected): A copy of the save on your phone: your room and items, tomato balance, daily focus minutes, streak, badges, settings and username. It is updated at most every 20 seconds while things change and when the app goes to the background; a single copy is kept and overwritten. Without Play Games your save never leaves the phone.
3.7 Technical record: When your record was created and last seen. We do not store your IP address, device model or advertising ID. Requests pass through Cloudflare's network, which may briefly process IP addresses to operate the service and block attacks.

4Who sees what

Your teammates: People in the same team (up to 12 per team) see: your @username, avatar, minutes focused today / this week / this month, streak, daily minutes for the last 7 days, whether you are focusing right now and when that session ends, whether you are the team admin, and your room layout (items, positions, colours; they can look at it, read-only). Teammates do not see your backup.
Team admins: When you send a join request, that team's admin sees your @username and avatar. When an admin invites you by username, you see the team's #tag, member count and the inviter's @username. Usernames cannot be searched or listed; inviting requires the exact name.
Bee Studios: To support you and run the service, our admin panel can show your username, created and last-seen times, total focus minutes, your teams, whether Play Games is connected and whether a backup exists. The panel does not show backup contents, Play Games IDs or key hashes.
Our service providers: Cloudflare (server and database hosting) processes your data on our behalf. Google verifies your identity when you choose to connect Play Games; Play Games' own data is governed by the Google Privacy Policy. Apple signs your identity for the Game Center link; Game Center's own data is governed by the Apple Privacy Policy.
Nobody else: We do not sell or rent your data, use it for advertising or profiling, or share it with other third parties. We do not give it to public authorities unless legally required (e.g. a court order).

5Why we process it, legal basis

Providing Focus Teams and backup (username, avatar, teams, sessions, Play Games ID, backup): necessary to provide the service you asked for. KVKK Art. 5(2)(c) (contract); GDPR Art. 6(1)(b).
Preventing abuse and keeping things secure (key hash, offensive-name filter, daily request/invite/change limits, reserved old names and tags): KVKK Art. 5(2)(f) (legitimate interest); GDPR Art. 6(1)(f).
Legal obligations (e.g. answering a request from you): KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c).

There is no consent-based processing, automated decision-making or profiling.

6How long we keep it

Username, avatar, team memberships, focus sessions, Play Games ID, backupUntil you delete them
"Focusing now" statusUntil the session ends or stops
Join request / team inviteValid 7 / 14 days; settled ones cleared after 30 days (when a new request or invite is created)
Reserved old username30 days
Username change times60 days
Team's old #tag redirect30 days
Copy of deleted data in the database recovery log (Cloudflare D1)Up to 30 days, then expires automatically

There is currently no automatic expiry for inactive records. Uninstalling the app does not delete your data on our server; see section 7 to delete it.

7Deleting your data

You can permanently delete all your server data from inside the app or by email. Steps and what gets deleted: Account and data deletion.

In short: if Play Games is connected, Settings → Account and backup → Delete account. If not, but you are in a team, Team → ⋯ (Team options) → Delete my team data. If neither applies, write to info@beestudios.app.

8Notifications and permissions

Focus Room uses local notifications only: a countdown notification while a session runs and a heads-up when it ends. On Android 13 and later we ask for notification permission at your first session; the timer works even if you decline. On iPhone there is no countdown notification: when a session starts we schedule a single "session complete" notification on the phone and cancel it if you pause or reset; permission is asked at your first session. We use no push notification service; notification content never reaches our server.

Permissions requested: internet (for teams and backup) and notifications. We do not request location, camera, microphone, contacts or file access.

9International transfers

Cloudflare and Google run global infrastructure, so your data may be processed outside Turkey (for example on servers in the European Union or the United States). This transfer is necessary to provide the team and backup features you ask for and takes place under these providers' data processing terms and security commitments. If you do not use teams or backup, your data never leaves your device.

10Security

All connections are encrypted with HTTPS. We store only a hash of your device key, never the key itself. A Play Games ID is accepted only through a code verified by Google; the app cannot claim an identity. Access to the admin panel is protected by separate authentication and a secret key. No system is perfect; if a breach occurs we will notify you and the competent authority as the law requires.

11Children

Focus Room is designed for users aged 13 and over and is not directed at children under 13. If we learn that someone under 13 has taken a username or joined a team, we delete their server data. If you are a parent or guardian and want your child's data deleted, write to info@beestudios.app. If you live in the European Union and are below your country's age of digital consent, use the team and backup features only with a parent's permission.

12Your rights

Under KVKK Art. 11 and the GDPR you can ask to: learn whether your data is processed and get a copy; have it corrected; have it deleted; restrict processing; object to processing based on legitimate interest; learn which third parties receive it; receive it in a portable format; and claim compensation if you suffer damage from unlawful processing.

Send your request to info@beestudios.app with your in-app @username and any #team tags. We may ask for additional information to reasonably verify that the request comes from you. We reply free of charge within 30 days.

If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board or, in the European Union, to the data protection authority of your country.

13Changes

If the app starts processing new data (for example a new feature or service provider), we update this page together with that release and change the effective date above.

14Contact

info@beestudios.app

Bee Studios · beestudios.app