Privacy Policy

Effective date: 17 April 2026 Last updated: 17 April 2026

BrewFocus (“BrewFocus”, “the app”, “we”, “us”) is a focus and productivity application developed and published by Sleak Software, operated as a sole proprietorship by Canberk Pitirli in the Republic of Türkiye.

This Privacy Policy explains what personal data we collect when you use BrewFocus, how we use it, who we share it with, and the rights you have over that data. It applies to the BrewFocus mobile applications (Android and iOS), the BrewFocus desktop application, and any related websites we operate.

If you do not agree with this policy, please do not use BrewFocus.

Contact: sleaksoftware@gmail.com

1. Who is the controller of your data

The data controller is:

Sleak Software (sole proprietorship) Operator: Canberk Pitirli Country: Republic of Türkiye Contact: sleaksoftware@gmail.com

For users in Türkiye, Sleak Software is the “veri sorumlusu” under Law No. 6698 on the Protection of Personal Data (“KVKK”). For users in the European Union / European Economic Area, Sleak Software is the “controller” under the General Data Protection Regulation (GDPR).

2. What data we collect

We only collect the minimum data required to run the app.

2.1 Data you give us directly

Email address — required to create an account and receive transactional emails (confirmation, password reset).
Username — optional; used to identify you inside the app.
Password — stored as a salted hash by our authentication provider; we never see your plaintext password.
Avatar image — optional; uploaded by you and stored in our file storage.
Focus sessions, tasks, projects, and settings — the productivity data you create inside the app (timestamps, durations, session phase, task titles, project names, custom durations, preferred background noise, theme choice, daily focus goal, and similar).

2.2 Data collected automatically

Basic device information — operating system, app version, device model, and preferred language, collected so we can diagnose bugs and deliver the correct update.
Crash and error reports — when the app crashes or throws an unhandled error, a stack trace and minimal device context are sent to our error-monitoring service. We strip email addresses and other identifiers from error payloads where possible.
Aggregated usage events — anonymous counters such as “a session was started” or “the paywall was shown”, used to understand how the app is being used. These events are not tied to your real name or email in analytics.

2.3 Data we do NOT collect

We do not collect:

Your contacts, photos, location, microphone, camera, or calendar.
Any health, biometric, financial, or advertising identifiers.
Any data from children under 13 (see Section 10).

3. Purchases and payments

Subscriptions and one-time purchases (BrewFocus Pro Monthly and BrewFocus Pro Lifetime) are processed by Google Play Billing on Android, Apple App Store on iOS, or Paddle / Stripe on desktop (as applicable at the time of purchase). These providers handle your payment information; we never receive or store your full credit card number.

We receive only:

Your purchase status and entitlement (active / cancelled / expired).
An anonymous purchase identifier used to link the purchase to your account.
The store-specific transaction metadata required to grant Pro features.

Refunds are handled by the store where you purchased. Please contact Google Play, Apple, or the applicable processor directly for refund requests.

4. Why we use your data (legal bases)

We process your personal data for the following purposes and on the following legal bases (GDPR Article 6 / KVKK Article 5):

Purpose	Legal basis
Creating and maintaining your account	Performance of a contract
Syncing your focus sessions, tasks, and settings across devices	Performance of a contract
Sending transactional emails (sign-up confirmation, password reset)	Performance of a contract
Processing purchases and granting Pro features	Performance of a contract
Diagnosing crashes and fixing bugs	Legitimate interest (running a reliable product)
Understanding anonymous usage patterns	Legitimate interest, and consent where required by law
Preventing fraud and abuse	Legitimate interest
Complying with legal obligations	Legal obligation

We do not sell your personal data. We share data only with the service providers we need to run BrewFocus:

Supabase, Inc. (United States / European Union) — database, authentication, file storage, serverless functions. Stores your account, tasks, sessions, settings, and avatar.
Google Play Billing (Google LLC) — processes Android purchases.
Apple App Store (Apple Inc.) — processes iOS purchases.
RevenueCat, Inc. (United States) — manages subscription entitlements across platforms.
Sentry (Functional Software, Inc.) (United States / European Union) — receives crash reports and error traces.
PostHog, Inc. (United States / European Union) — receives anonymous product-usage events.
Resend, Inc. or a successor transactional-email provider — delivers authentication emails.

Each sub-processor is bound by its own data processing agreement with us and, where applicable, by Standard Contractual Clauses for international transfers.

We may also disclose data when required by law (for example, in response to a valid court order from a Turkish court or a competent foreign authority) or to protect the rights, safety, and property of our users or ourselves.

6. International data transfers

BrewFocus is operated from Türkiye. Our sub-processors may store or process your data in the United States, the European Union, or other jurisdictions. When we transfer data outside your country:

Transfers to the EU/EEA rely on the adequacy of that jurisdiction.
Transfers to the United States or other non-adequate jurisdictions rely on Standard Contractual Clauses and the sub-processor’s additional safeguards (encryption at rest and in transit).
Transfers abroad from users in Türkiye are performed with your express consent where required by KVKK Article 9, which you give by creating an account and using the app.

7. How long we keep your data

Active accounts: we keep your data as long as your account exists.
Deleted accounts: when you delete your account (in-app or by email to sleaksoftware@gmail.com), we permanently delete your authentication record, profile, tasks, projects, focus sessions, settings, and avatar within 30 days. Anonymised aggregate statistics that cannot be linked back to you may be retained.
Crash reports: retained for up to 90 days, then purged.
Purchase records: retained for up to 10 years where required by tax and accounting law in Türkiye.

8. Your rights

Depending on where you live, you have some or all of the following rights:

Access — ask what personal data we hold about you.
Rectification — correct inaccurate data.
Erasure — request deletion of your account and data.
Portability — receive a copy of your data in a machine-readable format (JSON).
Restriction or objection — limit or object to our processing.
Withdraw consent — where processing is based on consent, withdraw it at any time.
Lodge a complaint — with your local data protection authority (for example, the Turkish KVKK Authority, your EU member-state DPA, or the UK ICO).

How to exercise your rights

In-app: open Settings → Account → Delete Account or Export My Data.
By email: write to sleaksoftware@gmail.com with the subject “Data Request”. We will respond within 30 days.

We may ask you to confirm your identity (for example, by sending the request from the email address associated with your account) before acting on a request.

9. Security

We apply reasonable technical and organizational measures to protect your data:

All network traffic between the app and our servers is encrypted in transit (TLS 1.2+).
Passwords are stored as salted hashes; we never see your plaintext password.
Database access is gated by row-level security, so one account cannot read another account’s data.
Access to production systems is restricted to the operator (Canberk Pitirli) and is protected by multi-factor authentication.

No system is perfectly secure. If we become aware of a breach that affects your personal data, we will notify you and the relevant authorities within the timeframes required by applicable law.

10. Children

BrewFocus is not directed to children under 13 (or under 16 in certain EU member states where that higher age of digital consent applies). We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact sleaksoftware@gmail.com and we will delete the account.

11. Cookies and similar technologies

The BrewFocus mobile and desktop applications do not use cookies. Our website (if any) may use a minimal set of cookies or local-storage items strictly necessary to operate the site; these do not track you across other sites.

12. California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of any “sale” or “sharing” of personal information as those terms are defined under California law. We do not sell or share personal information for cross-context behavioural advertising. To exercise any California right, email sleaksoftware@gmail.com.

13. Changes to this policy

We may update this policy from time to time. When we do, we will update the “Last updated” date at the top and, for material changes, notify you in the app or by email. Continued use of BrewFocus after the effective date of an update means you accept the updated policy.

14. Contact us

Questions, complaints, or data requests:

Sleak Software Email: sleaksoftware@gmail.com Country: Republic of Türkiye