Privacy

The short version

• We don’t sell your data, show ads, or track you across other apps and websites.
• Focus keeps an anonymous count of which steps and screens get used, never what you write, so we can see what’s confusing. You can turn it off in Settings. Nimbus and avlo.app don’t do this.
• Focus needs an account, because it keeps your work in sync. Nimbus works fully without one.
• We keep what each feature needs and nothing else, and you can delete all of it, account included, yourself from inside either app.

Who we are

Focus and Nimbus are made by Avlo LLC, a limited liability company registered in Wisconsin, United States. When this policy says “we”, it means Avlo LLC, which is responsible for your data under data protection law (its “controller”). Our address is W72N382 Cedar Pointe Ave, Cedarburg, WI 53012, United States. For privacy and legal questions, email legal@avlo.app; for anything else, support@avlo.app.

Your Avlo account

Focus requires an account and Nimbus lets you sign in with the same one if you choose to. You can sign in with Apple, with Google, or with your email address. We store:

• Your email address, to identify your account and send you account emails: sign-in codes, the email that confirms a new account, password resets, and security notices when your password changes or a new way to sign in is added. We don’t send marketing to it.
• Your name and profile photo, if you add them. They’re shown to people you share notes with.
• Your theme choice, so both apps look the way you set them on every device.
• Which version of our Terms you agreed to, and when, and which version of this policy we last showed you, so we know when to tell you about a change.

If you sign in with Apple and choose to hide your email, we only ever see the relay address Apple gives us.

Focus

What you put in it

Your tasks, notes, photos you add to notes, tags, courses, calendar events and focus sessions are stored in your account so they sync between your devices and the web app. They’re private to you unless you share a note. Photos in notes are stored privately, and are only shown to you and to people you’ve shared that note with, through links that expire after a few hours.

Connections you choose to make

• Canvas. We store the access token you provide, encrypted, and use it only to fetch your courses and assignments and to mark assignments done when you tick them off.
• Google Calendar. Focus asks for read-only access. The authorisation is stored encrypted and used only to fetch events from the calendars you choose.
• Apple Calendar. Focus reads calendars on your iPhone after you grant permission. Events from the calendars you select are saved to your account as tasks so they appear on your other devices.
• Calendar feeds. If you add a calendar link, we store it and fetch it to keep events up to date.

Disconnecting any of these in Settings deletes its stored credentials.

Google user data

Focus’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use your Google Calendar data only to show your events in Focus. We don’t use it for advertising, we don’t sell it, we don’t use it to train AI models, and no one at Avlo reads it unless you ask us to for support, it’s needed for security, or the law requires it.

Sharing notes

When you invite someone to a note, we send them one email with the invitation. People you share with can see the note, its photos and comments, and your name and photo.

Reminders

Due-date and overdue reminders are scheduled on your device. No push service is involved.

Crash reports

When Focus crashes or hits an error, it sends a report to Sentry so we can fix it. Reports include technical details about the error and your device, your account’s internal ID, and the app’s recent steps before the error, such as which screens you opened and whether a sync finished. They don’t include your email, your name, your IP address or the contents of your tasks and notes.

If Focus shows you an error screen, you can also tell us what you were doing. That message is sent with the report only if you type it and press Send.

Anonymous usage

Focus sends PostHog a short note when you reach certain steps, such as each step of signing up and setting up, or creating a task or a note, so we can see where people get stuck. Each note says which step it was, the app’s version and platform, and a few counts or choices, such as whether a task has a due date or which calendar you connected. It never includes your email, your name, your account ID or anything you write.

To tell one person’s steps apart from another’s without knowing who they are, the Focus app on your phone keeps a random ID on the device. It isn’t linked to your account, and it stays the same if you sign out. Focus on the web makes a new random ID each time you open it and doesn’t store it. PostHog receives your IP address as part of delivering each note; we’ve told it not to keep it or work out your location from it.

Turn it off with Settings → My account → Share anonymous usage. It turns off for that device or browser, whoever is signed in. Anything not yet sent is discarded, and nothing more is sent.

Nimbus

Without an account

Nimbus works fully without signing in. To show a forecast it sends the coordinates of the place you’re looking at to our server, which asks Apple Weather (and Open-Meteo, for air quality and pollen) on your behalf. We don’t keep these requests.

Some requests go straight from your phone to public services. Severe weather alerts come from the US National Weather Service, and a place’s time zone from Open-Meteo, using that place’s coordinates. Searching for a place sends your search text to Open-Meteo, and naming your current location sends its coordinates to OpenStreetMap. Radar images load from NOAA, and the radar map’s code from unpkg. Like any website you visit, these services see your IP address, but nothing that identifies you or your account.

Notifications, only if you turn them on

Notifications are off by default. If you enable them, our server stores:

• A push token from Apple, which lets us send you notifications.
• Your current location, rounded to about a kilometre, and its city name. If you allow location “Always”, the app updates it in the background so alerts follow you. We never store your precise location or your saved places for this.
• Your notification settings and time zone.
• A random identifier created on your device. It isn’t linked to your Apple ID or your Avlo account.

We use these only to send the notifications you asked for.

If you sign in

Your saved places, units, display and notification preferences and theme are stored in your account so they follow you to your other devices.

Our websites

avlo.app runs no analytics. Focus on the web sends the same anonymous usage notes as the apps (seeAnonymous usage), without storing anything in your browser for it. If you join the waitlist, we store your email address, the apps you picked, the page you signed up on and when. We’ll use it only to email you when each app you picked launches, with an unsubscribe link in every email, and then delete it. If you use the contact form on the support page, your name, email address and message are sent to our support inbox as an email, so we can reply; the website itself keeps no copy. Our host, Cloudflare, processes your IP address to deliver the site and protect it from abuse.

Cookies and browser storage

avlo.app sets no cookies. Focus on the web (projectfocus.avlo.app) uses your browser’s storage, not cookies, for a few things it can’t work without: keeping you signed in, keeping a copy of your tasks and notes so it opens quickly, remembering your settings and which way you last signed in, and remembering whether you dismissed the “open in the app” banner, and whether you’ve turned anonymous usage off. None of it tracks you or is shared with anyone. That’s why there’s no consent banner: storage that’s strictly necessary for a service you asked for doesn’t need one. Signing out clears your account’s copy from the browser.

Who handles your data for us

We don’t share your data with anyone else, except where the law requires it.

Keeping and deleting your data

• Delete your account from Settings in Focus or in Nimbus. Your account, tasks, notes, photos, tags, synced Nimbus settings and connections, including any stored Canvas or Google credentials, are deleted straight away. If you signed in with Apple and delete from the iPhone app, we also revoke Avlo’s access to your Apple ID.
• Export your Focus data as a file from Settings at any time.
• Delete your Nimbus data without deleting your account, from Settings in Nimbus. This removes your synced Nimbus settings, this phone’s notification registration and everything Nimbus stored on the phone.
• Turn off Nimbus notifications and your device’s push token, location and settings are deleted from our server. Records for devices Apple reports as gone are deleted within 60 days, and the log we keep to avoid sending an alert twice is deleted after 60 days.
• Things you delete in Focus stay in Recently Deleted for 30 days so you can restore them, then are removed the next time you open Focus. Photos you take out of a note are removed within about a week, the same way.
• Crash reports are kept by Sentry for up to 90 days.
• Anonymous usage notes are kept by PostHog for up to a year. Because they aren’t linked to your account, deleting your account doesn’t find them, and we can’t look up which ones are yours. Turning the setting off stops new ones.
• Leave the waitlist with the unsubscribe link in any email from it, or by emailing support@avlo.app.

Why we’re allowed to use your data

If you’re in the European Economic Area or the United Kingdom, these are our legal bases:

• To provide what you asked for (contract): your account, your Focus data and connections, syncing, sharing and forecasts.
• Your consent, which you can withdraw at any time: notifications and the location they use, calendar access, and the waitlist.
• Our legitimate interest in keeping the apps working and secure, and in improving them: crash reports, anonymous usage, and limiting abuse of our forms and servers. You can object to this; for anonymous usage, the switch in Settings does it straight away.
• Legal obligation, when the law requires us to keep or disclose something.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. You can do most of this yourself in the apps; for anything else, email legal@avlo.app and we’ll answer within a month. We’ll help wherever you live. If you’re in the EEA or UK and unhappy with how we’ve handled your data, you can also complain to your local data protection authority.

Where your data is stored

Avlo is based in the United States, and our providers process data there and in other countries. When we or our providers receive data from the EEA, UK or Switzerland, it’s protected by the EU-US Data Privacy Framework (and its UK and Swiss extensions) where a provider is certified, or otherwise by the European Commission’s standard contractual clauses.

Children

Neither app is directed at children under 13, and we don’t knowingly collect data from them. If you believe a child under 13 has given us their data, email us and we’ll delete it.

Changes

If this policy changes, we’ll update the date at the top. If the change is significant, Focus shows you a short summary of it the next time you open it, with a link to the full policy.

Contact

Questions about privacy or your data: legal@avlo.app, or by post to Avlo LLC, W72N382 Cedar Pointe Ave, Cedarburg, WI 53012, United States.