DeepFlow privacy policy

1. Who is responsible

DeepFlow is a focus and Pomodoro timer made by JUSTE APPS, SASU, RCS Créteil 130 436 108, 23 avenue de la Chapellerie, 94370 Sucy-en-Brie, France. JUSTE APPS is the controller of the personal data described here.

For privacy questions or requests, email deepflow@justeapps.com. Publisher information is available in our legal notice.

2. What stays on your phone

Your focus sessions, their durations, your tags and your settings are stored on your phone. Apart from the anonymous usage statistics described below, which count for example that a session of 25 minutes was completed, they are not sent to us or to anyone else.

• DeepFlow has no account, no advertising and no tracking. It sends anonymous usage statistics, described below.
• Reminders and the Live Activity are created on your phone. They do not go through a server.
• Deleting the app deletes its data. If you back up your phone, for example with iCloud, the backup may include DeepFlow’s data, as it does for other apps.

3. Anonymous usage statistics

To improve the app, DeepFlow sends us anonymous usage statistics: what happens in the app, not who you are or what you focus on. They tell us, for example, how many focus sessions reach their end.

These are events such as the app being opened, a focus session starting, reaching its end or being stopped, or a notification being opened, with a few details that help us read them, such as the length you chose.

Each event also says which app sent it, when it was sent, and what PostHog’s software adds about your phone: the app’s version, the operating system and its version, the device model, the language and the time zone. It carries a random identifier that PostHog’s software creates on your phone, so that we can count phones rather than events. That identifier stays on your phone until you delete the app. It is not linked to your name, to your feedback, to other apps or to an advertising identifier.

Statistics never include your tags, your feedback or your email address. DeepFlow does not record the screens you visit, your taps or your sessions, and it does not build a profile of you.

We use PostHog, as our processor, to receive and store the statistics, in the European Union (Frankfurt). PostHog receives your IP address with each connection, as any server does. It uses it to add an approximate location to each event, your country, region and city, then discards it: the address is not kept with the statistics, and the location is never more precise than the city. Statistics are deleted at most 13 months after they were sent.

This relies on our legitimate interest in measuring the app’s audience to improve it (Article 6(1)(f) GDPR). The statistics are not linked to you, serve only to measure and improve DeepFlow, and are not shared with anyone else for their own use. See PostHog’s privacy policy.

4. Feedback you send

Besides the usage statistics above, Send Feedback, in Settings, is the only part of DeepFlow that sends anything over the network. Writing to us is optional. When you send feedback, we receive:

• your message;
• an email address, only if you enter one in the “for replies” field;
• DeepFlow’s version and language, and your platform (iOS);
• the date it was sent.

Nothing else about you is sent: no device identifier, no account, no location. Our feedback service does not keep your IP address. To limit abuse, it counts requests by a hash of the address, which is forgotten after a minute.

DeepFlow remembers the address you entered, on your phone, so that you do not have to type it again.

5. Why we use it, and on what basis

We use your feedback to improve DeepFlow and, if you left an address, to reply to you. We do not use it for marketing, and we do not sell it.

This relies on our legitimate interest in answering the people who write to us and in improving the app (Article 6(1)(f) GDPR). Sending feedback, and leaving an address, are your choice.

6. Where it is kept, and for how long

Feedback is stored by Cloudflare, in a database located in the European Union.

• Your email address is erased 90 days after we have handled your feedback.
• The rest of the feedback is deleted 2 years after it was sent.

When we reply, we write from our email account, hosted by Google Workspace. That exchange is then an email like any other, as described in our studio privacy policy.

7. Who receives it

Your feedback and the usage statistics are read by Juste Apps. The following providers process them on our behalf:

• PostHog receives and stores the anonymous usage statistics, in the European Union (privacy policy).
• Cloudflare receives and stores feedback (privacy policy).
• OpenAI provides the AI assistant that helps us sort feedback and prepare replies. A person reads and sends every reply (privacy policy).
• Google hosts our email, from which replies are sent (privacy policy).

OpenAI and Google may process information outside the European Economic Area, under the safeguards their terms provide, such as the European Commission’s standard contractual clauses. PostHog, Inc. is based in the United States: it stores the statistics in its EU region, and its terms provide the same safeguards for any access from outside the European Economic Area. Information may also be disclosed where required by law. We do not sell your personal data.

DeepFlow is distributed by Apple’s App Store. When you download or rate the app, Apple may process information under its own policy.

8. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, restriction of processing, or object to processing. Data portability applies in certain circumstances.

Contact deepflow@justeapps.com to make a request. To help us find your feedback, tell us roughly when you sent it and the address you left, if any. Usage statistics are not linked to you, so we usually cannot tell which are yours; deleting the app deletes the identifier they carry. Do not send identity documents unless requested through an appropriate channel.

You may also lodge a complaint with your local data protection authority. In France, you can contact the CNIL.

9. Changes to this policy

If DeepFlow starts handling data differently, this policy will be updated before the change ships. The date above identifies the latest revision.