Privacy Policy
ADHD Superpower — desktop, iOS and the sync service behind them.
The short version. The app works completely offline and an account is optional. If you never sign in, nothing you write ever leaves your device and this policy has almost nothing to tell you.
If you do sign in, your notes and tasks are stored so your devices can agree with each other. They are not read, not analysed, not sold, and not shared with anyone. There is no advertising, no analytics and no tracking of any kind in this software.
Who is responsible
This is a personal project, not a company. The service is operated by the developer of ADHD Superpower, who can be reached at privacy@adhd.yatishgautam.com for any question or request in this policy.
What is stored, and why
Only if you create an account
| What | Why |
|---|---|
| Your email address | It identifies your account and is the only way to sign in. |
| Your password, hashed | Stored as an Argon2id hash. The password itself is never written to disk or logs and cannot be recovered from the hash. |
| Your timezone | A focus session must land on the correct local day. Without it, sessions near midnight are filed under the wrong date. |
| A display name | Optional. Blank unless you set it. |
| App settings | Session length and similar preferences, so they follow you between devices. |
| Session tokens | A random opaque string proving your device is signed in. Valid for 90 days and revocable at any time. |
Your content, if you sign in
The point of an account is that the same data appears on your laptop and your phone, so the records the app creates are stored on the server:
- Threads — titles, notes, checklists, status, and any link you attach
- Daily pages — your Now line, to-dos, blockers, wins and parked thoughts
- Focus sessions — start and end times, how long you focused, pauses, and the distractions you chose to log
This is the content you typed. It is stored so it can be sent back to your own devices, and for no other purpose.
Server logs
The server records that a request happened — the time, the path, the response status, and the network address it came from — which is what makes it possible to notice an outage or an attack. The logger is explicitly configured to redact authorization headers, cookies and request bodies, so the contents of your records never reach a log file. A thread title is personal, and it is not written down anywhere except the database row it belongs to.
What is never collected
- No advertising identifiers, and no advertising
- No analytics or telemetry — there is no third-party SDK in the apps at all
- No location, contacts, photos, calendar, health or microphone data
- No behavioural profiling, and nothing is inferred about you from your content
- No tracking across apps or websites, so the iOS app never shows the tracking permission prompt
Who it is shared with
Nobody. Your data is not sold, rented, licensed or handed to any third party for any purpose. There are no analytics processors, no advertising networks and no data brokers involved in this service.
The one unavoidable party is the hosting provider that rents the server the database runs on. They do not have any interest in the contents and do not process it on our behalf beyond keeping the machine running.
Data would only ever be disclosed if legally compelled by a valid order.
How it is protected
- All traffic uses HTTPS. There is no unencrypted route into the service.
- Passwords are hashed with Argon2id at the parameters its authors recommend for a server.
- Sign-in uses opaque random tokens rather than self-contained ones, specifically so that a session can be revoked the moment a device is lost.
- The database is not reachable from the public internet; only the API can talk to it.
- Each account can only ever read its own rows. Every query is scoped by user.
No system is perfectly secure, and it would be dishonest to claim otherwise. This is a personal project maintained by one person.
How long it is kept
- While your account exists — your records are kept, because that is the service.
- When you delete a record — it is marked deleted immediately and stops appearing. A marker remains for 90 days so that a device which was offline learns about the deletion instead of restoring the record. After 90 days the row is erased.
- Expired sign-in sessions — deleted automatically.
- When you delete your account — everything is erased immediately. See below.
Your control over it
Export everything
In the app: Settings → Export everything. You get your entire dataset as one
readable JSON file, sorted and formatted so it is actually inspectable. The same is available
from the API at GET /export. No request, no waiting period.
Delete everything
In the app: Settings → Delete account and all data. This immediately and permanently erases your account, every record attached to it, and every sign-in session, on the server and on the device you are holding. It is not a request, not a soft delete, and not reversible.
Data already synced to another device of yours stays on that device until you delete the app there, because the app is designed to keep working without a network and cannot reach across to erase it.
Correct or access it
Editing your records in the app changes them at the source. Everything held about you is in the export, so an access request is a button rather than an email.
Withdraw entirely
Sign out and keep using the app offline, or delete the account. Neither reduces what the app does — syncing is the only feature an account adds.
Legal basis and jurisdiction
Where the GDPR, UK GDPR or PIPEDA apply, the basis for storing your content is the performance of the service you asked for: without storing it, there is nothing to sync. There is no processing based on legitimate interest, and no profiling or automated decision-making.
The rights those laws grant — access, correction, erasure, portability, restriction and objection — are satisfied by the export and delete controls above, which are immediate and require no correspondence. If you would rather make a request in writing, use the contact address.
The server is located in a single region and your data is not moved between regions.
Children
This app is not directed at children under 13, and no account is knowingly created for one. If you believe a child has created an account, contact the address above and it will be deleted.
Cookies
The desktop and iOS apps use no cookies at all — they send a token from the operating system keychain. A future browser version would set exactly one cookie, holding the same session token, strictly to keep you signed in. There are no analytics, advertising or third-party cookies anywhere in this service.
Changes
If this policy changes in substance, the effective date below changes with it and the previous version stays in the project's public git history, so the change is inspectable rather than announced. Material changes affecting data already collected will be notified in the app before they take effect.