Focus Vault · Android
Privacy Policy
This policy explains what information the Focus Vault Android app handles, why, where it is kept, how long for, and what control you have over it. Focus Vault is published by MATUNOS (PTY) LTD, a company registered in South Africa ("MATUNOS", "we", "us").
The short version
- We do not collect any personal information through the app. We cannot see your name, the apps you block, how you use your phone or how long you focus — unless you choose to email us a problem report, which you see in full first (section 11).
- The app goes online for one thing only: PC Link, if you choose to pair a PC (version 1.2 and later). It then exchanges short messages with your PC through our relay. They are end-to-end encrypted with keys that exist only on your phone and your PC, so the relay passes them on without being able to read them. If you never pair a PC, the app never connects to the internet.
- The relay keeps a random pairing ID and nothing that identifies you. It keeps no logs, and the pairing is deleted when you unpair or after 90 days without contact.
- No account, no sign-in, no analytics, no advertising, no tracking SDKs, no data sales.
- Everything the app stores stays in its private storage on your device, is excluded from cloud backup, and is erased when you clear the app's storage or uninstall it.
- The accessibility service reads only which apps are on screen (their package names), so it can block the apps you chose. It does not read what is on the screen, what you type, or anything else. From version 1.2.1 the app keeps a seven-day log of its own actions on your phone, which notes when it blocked one of your blocked apps and never mentions any other app (section 4).
1. Who we are
The developer of Focus Vault, and the responsible party under South Africa's Protection of Personal Information Act, 2013 (POPIA) — the controller in the language of the EU and UK GDPR — is:
MATUNOS (PTY) LTDRegistration number: 2026/288742/07
4 Cheetah Lane, Rivonia, Gauteng, 2191, South Africa
Privacy and support contact: androidsupport@matunos.com
Under POPIA, the Information Officer of a private company is its head. You can reach our Information Officer at the same address.
2. What this policy covers
This policy covers the Focus Vault app for Android, the Focus Vault: PC Link browser extension and the relay that connects them (section 3), any email you send us about it (section 11), and this web page (section 15). It does not cover Google Play, your phone's operating system, your web browser or email provider, which are governed by their own privacy policies.
3. What we collect
Through the app: nothing that tells us who you are or how you use your phone. "Collect" here means the same as it does on Google Play: information transmitted from the app off your device. Focus Vault contains no analytics, crash-reporting or advertising SDK, and there is no Focus Vault account. We cannot see how you use the app, which apps you block, how long you focus, or what you are called in it. The one exception is a problem report you choose to email us yourself (section 11); the app does not send it, your email app does, after you have seen all of it.
Up to version 1.1, Focus Vault did not declare the Android INTERNET permission and could not send anything off your phone. From version 1.2 it declares INTERNET for PC Link alone, described below, and connects to nothing unless you pair a PC. The one item our server then holds is a random pairing ID. That is why, from version 1.2, Focus Vault's Google Play Data safety section declares "Device or other IDs", collected for app functionality and not shared, where earlier versions declared no data collected.
"View network connections" on the Play listing. Google Play may show this permission (ACCESS_NETWORK_STATE). It is added automatically by Google's WorkManager library, which Focus Vault uses to schedule an hourly on-device check. It lets software see whether a connection exists; it cannot send or receive data, and the app's hourly check never goes online.
If you pair a PC: PC Link (version 1.2 and later)
PC Link is optional. It lets a focus session on your phone also block chosen websites on your computer, through the Focus Vault: PC Link extension for Chrome and Chromium-based browsers. The phone is in charge: the PC only follows what the phone tells it, and the extension does nothing until it is paired.
Pairing. The extension shows a QR code. When your phone's camera opens it, Focus Vault starts on your phone, and the two create a pair of encryption keys between them. The keys never leave the two devices. The code is a link to matunos.com/pair. The secret part of it comes after a #, and browsers do not send that part to any server. If Focus Vault is not installed, the link opens a web page that says how to get it (section 15).
What travels between your phone and your PC. Every message is end-to-end encrypted, so only your phone and your PC can read it:
- From the phone: the list of websites to block (those that belong to the apps you block, plus any you add), and whether a focus session is running or paused and when it ends.
- From the PC: whether it has applied the latest message, so the app can show you that your PC is locked.
Nothing else is exchanged. That means no browsing history, no usage figures, no credits, and nothing about what is on either screen.
The relay. The messages pass through our relay at relay.matunos.com, which runs on Cloudflare's network. It holds:
| What the relay holds | Why | How long |
|---|---|---|
| A random pairing ID, made when you pair. It is not linked to your name, email, phone number or Google account. | So your phone's messages reach your PC, and only your PC. | Until you unpair, on the phone or in the extension, or 90 days after the last contact from either device. |
| The latest encrypted message in each direction, replaced by the next one | So a PC that was asleep or offline catches up when it comes back. | Until it is replaced, or the pairing is deleted. |
The relay cannot decrypt those messages. Like any internet service, it sees your device's IP address while it is connected, because that is how a reply finds its way back. It keeps no request logs, does not store IP addresses, and does not use them to work out where you are. Your phone only connects to the relay while at least one PC is paired, and only to send or receive these messages.
The extension. It stores its keys, the pairing ID and the latest message from your phone in your browser's storage for extensions. It blocks sites through the browser's own blocking rules. It is shown a tab's address only when that tab is on one of the listed sites, uses it only to send that tab to the Focus Vault page during a focus session, and never stores or sends it. It is not shown any other page you visit. It has no content scripts, so it reads no web page, and it connects to nothing except the relay. Its browser permissions let it block and redirect the listed sites, keep its own storage, wake itself up to check in with the relay, and reach the relay. Removing the extension deletes everything it stored. We publish it in the Chrome Web Store, which is run by Google under Google's Privacy Policy.
Google Play's rating card and update prompt (version 1.2 and later). From version 1.2, Focus Vault includes one third-party library: Google's Play Core. Through it the app asks the Google Play Store app on your phone to show Google's own rating card — at most three times in total, never during a focus session — and to tell you when an update is available and download it. The Play Store app, not Focus Vault, talks to Google. Focus Vault sends nothing through it, and is not told whether you rated it or what you wrote. Play Core adds no permission, and earlier versions do not contain it.
4. Information kept on your device
To work, the app keeps the following in its private storage on your phone. We never have access to any of it. The only parts that ever leave the device are the PC Link list of websites, if you pair a PC, which goes end-to-end encrypted to your own PC (section 3), and a problem report, if you choose to email us one (section 11).
| What | Where it comes from | Why the app keeps it |
|---|---|---|
| Your display name and chosen avatar mark | You type or pick it. Optional — if you skip it, the app uses a placeholder. It need not be your real name. | Shown in the app and in its notifications. |
| The apps you choose to block (app name, package name, unlock cost) | You pick them from the list of apps installed on your phone. | So the blocker knows what to hold back. |
| Focus sessions and progress — credits, orbs, streaks, rank, achievements, items you have unlocked in the in-app shop, running unlock timers, your daily screen-time goal | Created as you use the app. | This is the app's game economy. Orbs and credits are earned only; they have no money value and cannot be bought. |
| A short activity log — the last 20 earn/spend entries | Created as you use the app. | Shown on the LOGS screen. |
| Seven days of daily totals — one "unproductive screen time" figure and one Focus Efficiency score per day | Calculated on your device from usage access, if you grant it (section 6). | To work out your Focus Efficiency figure against your own recent days. |
| PC Link (version 1.2 and later, only if you pair a PC) — the websites linked to each blocked app and any you add, your paired PCs' names, the pairing IDs and the encryption keys | You add sites and pair PCs. The keys are made on the phone when you pair. | So the phone can tell your PC what to block, and nobody else can read it. |
A diagnostic log (version 1.2.1 and later) — the app's own events over the last seven days: when blocking started, stopped or was paused by your phone, when it blocked one of your blocked apps or counted unlock time for one (by its name or its Android package name, such as com.example.videoapp), focus sessions, why the app last closed, and the details of its last crash | Written by the app as it runs. | So that, if something goes wrong, you can send us a report of it (section 11). It never names an app you have not blocked, and never holds anything shown or typed inside another app, your screen-time figures or your display name. |
| Preferences — theme, light/dark schedule, difficulty, which tips and notices you have already seen, and (from version 1.2) how many times and when the app last asked Google Play to show its rating card and which update it last offered | You set them. | So the app behaves the way you left it. |
To let you choose apps to block, the app asks Android for the list of apps that have a launcher icon, plus which app is your home screen. It uses Android's narrow package-visibility queries for this, not the broad "query all packages" permission. It stores only the apps you actually select.
5. The accessibility service
Blocking other apps on Android requires the Accessibility Service API, and Focus Vault uses it for that alone. The app shows you an explanation and asks for your agreement before sending you to Android's settings to switch it on. It does nothing until you turn it on yourself.
What it reads
When the windows on screen change, the service reads the package name of each app that has a window visible — for example com.example.videoapp. It reads every visible window, not only the focused one, so that a blocked app cannot slip past in split-screen, a pop-up window or picture-in-picture. It also asks Android whether a phone or voice call is in progress (from the audio mode and, during an internet call, whether any app is using the microphone — not which app, and nothing it hears; never from call details), so a call is never interrupted, and whether any media is playing — not which app is playing it, which Android does not say — so that a blocked video in picture-in-picture cannot simply be started again.
What it does with it
- Compares the package name against your list of blocked apps and any unlock time you have.
- If an app is blocked, draws Focus Vault's block screen over it, or returns you to the home screen.
- If a blocked app is playing in a floating picture-in-picture window, briefly requests audio focus so its sound stops — and if it starts playing again, does so again and draws the block screen.
- Pauses and resumes your unlock timers so only the app actually in use counts down.
What it does not do
- It does not read text, images, or anything else shown inside other apps, even though Android's accessibility permission is broad enough to allow it.
- It does not read keystrokes, passwords, messages, notifications or form contents.
- It does not record which apps you open. Package names are compared in memory and discarded. The only exception is the app's diagnostic log (section 4, version 1.2.1 and later), which notes when one of your blocked apps was blocked, by its name or package name, and nothing about any other app.
- It does not transmit anything, and it does not tap, type or act inside other apps. Its only actions are the block screen, "go home", and the audio request described above, all following fixed rules you configured.
You can switch it off at any time in Android Settings → Accessibility. Blocking stops, and nothing else in the app is affected.
6. Usage access (optional)
If you grant usage access (PACKAGE_USAGE_STATS), Focus Vault reads your phone's own screen-time statistics from Android: how long each app was in the foreground, and when the screen was on. It uses them to draw your usage charts on the LOGS screen, to compute your Focus Efficiency, and to decide whether to show you an on-device reminder to put the phone down.
Per-app figures are calculated when you view them and are not saved. The only thing kept is the seven daily totals described in section 4. Usage access is optional: if you decline, the charts show no data and everything else works. You can revoke it in Android Settings → Apps → Special app access → Usage access. The exact menu path varies by manufacturer.
7. Every permission, explained
| Permission | Why |
|---|---|
Internet (INTERNET) — version 1.2 and later | PC Link alone — see section 3. Used only while a PC is paired, and only to reach relay.matunos.com. |
Accessibility service (BIND_ACCESSIBILITY_SERVICE) | Blocking — see section 5. Turned on by you in system settings. |
Usage access (PACKAGE_USAGE_STATS) | Optional usage charts and Focus Efficiency — see section 6. |
Notifications (POST_NOTIFICATIONS) | Session countdown, "harvest ready", reminders, and a warning if blocking has been switched off. You can refuse or mute any of them. |
Foreground service (FOREGROUND_SERVICE, FOREGROUND_SERVICE_SPECIAL_USE) | Keeps a focus session you started (10–90 minutes) counting down while you are away from the app. It shows an ongoing notification with an abort button and stops itself when the session ends. |
Vibration (VIBRATE) | Haptic feedback on buttons and at the end of a session. |
Added by Google's WorkManager library: ACCESS_NETWORK_STATE, RECEIVE_BOOT_COMPLETED, WAKE_LOCK | Keep the hourly on-device check scheduled, including after a restart. See the note in section 3 — none of these allow data to be sent. |
Added by Google Play when it delivers the app: com.android.vending.CHECK_LICENSE | Google Play's automatic protection. It lets the app ask the Google Play Store app on your phone whether Focus Vault was installed from Google Play. It gives the app no internet access, and the app sends nothing through it. |
Not requested: location, contacts, camera, microphone, phone or call logs, SMS, storage/files, calendar, accounts, "display over other apps", or "query all packages".
8. Sharing and third parties
We do not sell, rent, share or disclose personal information from the app. The only thing we hold is the PC Link pairing ID (section 3). Focus Vault shows no advertising and does no cross-app tracking. It contains no in-app payments.
Cloudflare runs the PC Link relay for us, as our service provider, under the Cloudflare Privacy Policy. It processes the connections and stores what section 3 describes, on our behalf and for no purpose of its own. That is not "sharing" in Google Play's sense.
For completeness, these third parties may process information independently of us when you use the app:
- Google Play handles installation and updates under Google's Privacy Policy. If you have chosen in Android to share usage and diagnostics data with Google, Google may collect crash and "app not responding" reports. Google shows developers these only as reports in Google Play Console (Android vitals). We use such reports solely to fix bugs, and they do not identify you to us.
- Ratings and reviews you leave on Google Play — from the rating card the app may show (version 1.2 and later) or from the store itself — are handled by Google under the same policy and are public. We see them in Google Play Console like any other review.
- Your phone's notification system displays Focus Vault's notifications. Notifications can include your in-app display name, and whether they appear on your lock screen is controlled by your Android settings.
- Your web browser opens this page if you tap "Privacy Policy" in the app's Settings. The browser loads the page, not the app.
We will disclose information only if the law requires it. The only app-related thing we hold is a pairing ID, together with messages we cannot read.
9. Security
The app's data lives in its private app storage, which Android's app sandbox protects from other apps. On devices with Android's device encryption turned on (the default on modern phones), that storage is also encrypted at rest by the operating system. Focus Vault does not add its own encryption layer to that storage. Unless you pair a PC, it transmits nothing. PC Link's messages are end-to-end encrypted with keys made on your phone and your PC, and they travel over an encrypted (TLS) connection. So someone who broke into the relay would find pairing IDs and messages they could not read. Anyone who can unlock your phone could open the app and see what it shows, so protect your device with a screen lock.
10. Retention and deletion
| Information | How long it is kept |
|---|---|
| Everything in section 4 | On your device until you delete it using any of the options below. We never hold a copy. |
| Daily screen-time totals and efficiency scores | A rolling seven days; older days are removed automatically. |
| Activity log | The latest 20 entries; older entries are removed automatically. |
| The PC Link pairing ID and the latest encrypted message each way, on the relay | Until you unpair, or 90 days after the last contact from either device. Each message is replaced by the next. |
| What the PC Link extension stores in your browser | Until you unpair or remove the extension. |
| What the accessibility service reads | Not stored — used in memory and discarded, except that the diagnostic log notes when one of your blocked apps was blocked (next row). |
| The diagnostic log and the last crash's details (version 1.2.1 and later) | A rolling seven days, and at most 2,000 entries; the crash details until the next crash. A problem report waiting to be attached is kept in the app's cache until the next report. Erasing your data in the app and clearing storage delete all three. |
| Emails you send us | See section 11. |
How to delete your data
- Erase in the app: Settings → Maintenance → Erase user data (named Purge Local Node Data before version 1.2.1) resets your progress, economy, history, unlocks, purchases and preferences, and deletes the diagnostic log. It deliberately keeps your display name, avatar mark and blocked-app list, and the record that you have already seen the introduction, whether today's screen-time reminder has been shown and (from version 1.2) when the app last asked for a rating or offered an update — so erasing your data never brings those asks back.
- Erase everything: Android Settings → Apps → Focus Vault → Storage → Clear storage, or uninstall the app. Either permanently deletes all of the app's data. Any pairing the phone can no longer reach is then deleted from the relay 90 days after its last contact.
- Unpair a PC: in the app's Settings, or in the extension. Unpairing deletes that pairing from the relay at once, and with it the last message each way.
Backups: the app's data is excluded from Android's automatic cloud backup and from device-to-device transfer. It will not reappear after a reinstall or on a new phone, and neither we nor Google can restore it.
There is no Focus Vault account, so there is no account to close. The only thing we hold is a PC Link pairing, and you can delete it yourself by unpairing.
11. If you email us
If you contact androidsupport@matunos.com, we receive your email address, your name if it is included, and whatever you choose to write or attach. This is the only way we receive personal information in connection with Focus Vault, and only because you sent it. Please don't send more than you need to — we will never ask for your passwords or payment details.
The app can open your own email app for you. In version 1.2 this is Settings → Send feedback; from version 1.2.1 it is Settings → Feedback & issues, which first asks what you want to send:
- Idea or comment opens your email app with our address filled in and three lines in the message that you can see, change or delete: the app version, your Android version and your phone model. (Version 1.2's Send feedback does exactly this.)
- Something's wrong first shows you a problem report, in full, then opens your email app with the report attached as a text file. The same report is offered on the screen that tells you blocking has stopped, and once after the app has crashed.
What a problem report contains: the app's version and build, whether it was installed from Google Play, and when it was installed and last updated; your phone's make, model and Android version; whether blocking, usage access, notifications and battery restrictions are on for the app; the app's own state — whether a focus session or an unlock is running, your settings, how many PCs are paired and the names of the apps you chose to block; why the app last closed and the details of its last crash; and the diagnostic log (section 4). It never contains anything shown or typed inside another app, the name of any app you have not blocked, your screen-time figures, your display name, your PC Link pairing IDs, keys or websites, or any identifier for you or your phone, such as an advertising ID.
Nothing is sent until you send it from your email app, and Focus Vault is not told whether you did. We use a problem report only to find and fix the problem it describes.
- Purpose: to reply and resolve your question, and to keep a record of that correspondence.
- Provider: our email is hosted by Zoho Corporation (Zoho privacy policy), which processes it on our behalf. Its servers may be outside South Africa; see section 14.
- Retention: kept only as long as needed to deal with your enquiry and any follow-up, and deleted within 12 months of our last exchange, unless the law requires us to keep it longer.
- We do not add you to any mailing list and do not share your email with anyone.
12. Children
Focus Vault is a general-audience productivity app. It is not directed at children under 13 and is not part of Google Play's Families programme. The app collects no personal information from anyone, including children. Under POPIA a child is anyone under 18. If you are under 18, please involve a parent or guardian before emailing us. If you believe a child has sent us personal information by email, contact us and we will delete it.
13. Your rights
Depending on where you live, you have rights over your personal information. Under POPIA these include the right to know whether we hold information about you, and to ask for access, correction or deletion. You may also object to processing and complain to the Information Regulator. The EU and UK GDPR add restriction, portability and withdrawal of consent, plus the right to complain to your local data protection authority. Laws such as the California Consumer Privacy Act give rights to know, delete and opt out of sale or sharing.
For app data you do not need to ask us. It is on your phone, where you can see all of it and erase it yourself (section 10). The PC Link pairing ID is the one thing we hold. It is not linked to you, so we could not find yours from a request, but unpairing deletes it at once. For emails you sent us, write to androidsupport@matunos.com. We will answer within 30 days, and it is free. We may need to confirm the request comes from the owner of that email address.
We do not sell or share personal information as those terms are defined in US state privacy laws, and we do not use it for targeted advertising. Focus Vault makes no automated decisions with legal or similarly significant effects. Its Focus Efficiency score and ranks are calculated on your device and affect only the game.
14. Legal bases and international transfers
- App data: processed only by the app on your own device, at your direction. We do not process it, so no transfer takes place.
- PC Link: the pairing ID and the encrypted messages are processed because they are needed to provide the feature you switched on by pairing (POPIA section 11(1)(b); GDPR Article 6(1)(b)). Cloudflare's network is global, so the relay may handle them outside South Africa, the EU or the UK. Where that happens, we rely on Cloudflare's contractual data-protection commitments, as POPIA section 72 and GDPR Chapter V permit.
- Emails: processed because it is necessary to respond to a request you started — our legitimate interest, or steps you asked us to take (POPIA section 11; GDPR Article 6(1)(b) and (f)). Our email provider may store messages outside South Africa, the EU or the UK. Where that happens, we rely on the provider's contractual data-protection commitments, as POPIA section 72 and GDPR Chapter V permit.
- Providing information to us is always voluntary. The only consequence of not emailing us is that we cannot answer your question.
15. This web page
matunos.com is hosted by Cloudflare, which processes technical information needed to deliver any web page — such as your IP address and browser type — for delivery and security. Through Cloudflare, this site also:
- Counts visits with Cloudflare Web Analytics. It sets no cookies and does not track you across websites. It records figures such as which page was viewed, the site that linked to it, your browser and device type, your country and how quickly the page loaded. We see only totals, never individual visitors.
- Checks for automated bots. Cloudflare's bot protection may run a short script in your browser to tell people apart from automated scrapers.
- Hides email addresses from spam harvesters. A small script from this site reveals them in your browser.
These are provided under the Cloudflare Privacy Policy. This page sets no cookies, shows no advertising, and loads no web fonts or other third-party content.
The PC Link pairing page, matunos.com/pair, appears only when a pairing link is opened on a phone without Focus Vault installed. It is hosted the same way, except that Web Analytics is switched off for it, so the secret part of the link after the # is not recorded anywhere.
16. Changes to this policy
If Focus Vault changes how it handles information, we will update this policy before releasing that version and change the date at the top. That includes adding any feature that needs internet access, which would also show up as a new permission on its Google Play listing. For a material change we will also say so in the app's release notes. Past versions are available on request.
17. Contact and complaints
For any question about privacy or this policy, or to exercise your rights:
MATUNOS (PTY) LTD — Information Officer4 Cheetah Lane, Rivonia, Gauteng, 2191, South Africa
androidsupport@matunos.com
If you are not satisfied with our response, you have the right to complain to a regulator. In South Africa that is the Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 · POPIAComplaints@inforegulator.org.za · inforegulator.org.za. If you are in the EU or UK, you may complain to your local data protection authority.