Privacy Policy (English)
Last updated: 1 November 2026
1. Controller
The controller responsible for data processing in the FocusReef app and on this website is:
Lukas Thumann
Pavelsbacher Str. 6a
92361 Berngau
Germany
Email: focusreef.support@gmail.com
2. Overview
FocusReef is a learning and idle game. We process personal data only where necessary to provide the app and its features, where you have given your consent, or where we have a legitimate interest. Each section below states which of these applies.
You have no legal or contractual obligation to give us data. Without a user identifier and technical data the app cannot run, though. We only need your email address if you want to secure your account.
3. Data we process
a) User account (guest account, registration and login)
A guest account is created as soon as you choose your display name when you first start the app. A randomly generated user identifier and the display name you choose are stored with our service provider Supabase (see section 5), and your game progress is saved to the cloud. No email address is required for this.
If you later secure your guest account with a login, we additionally process your email address and password for authentication and to protect your account. We cannot see your password in plain text.
Purpose: providing the account, login, cloud storage of game progress, friends feature
Legal basis: Art. 6 (1) (b) GDPR (performance of the user agreement)
b) Game progress and cloud storage
Your game progress (e.g. collected currency, unlocked content, statistics) is linked to your account and stored in the cloud so that it remains available across devices.
Purpose: storing and restoring your game progress
Legal basis: Art. 6 (1) (b) GDPR
c) Friends feature and leaderboard
Other users can find you by your display name through the friend search, but only when the full name is entered. Nobody can retrieve a list of all players. If you accept a friend request, your game progress (e.g. aquarium, collected content) and your focus statistics become visible to those friends, including within the friends leaderboard. The friends feature is optional. Without accepted friendships, other users only see your display name.
Purpose: social features (friends, comparison, leaderboard)
Legal basis: Art. 6 (1) (b) GDPR (providing the feature you use)
d) Shared reef (group feature)
You can form a shared reef together with users you are friends with. Within such a group, your display name and your contribution to the shared focus time are visible to the other members. The group's progress (accumulated focus time, streaks, incubating eggs and unlocked content) belongs to the group collectively and remains in place when individual members leave. If you leave a group, your future contributions are no longer recorded. Contributions already made remain part of the shared group progress, as they can no longer be attributed to individual people. Participation is optional. The person who founds a reef chooses its name. All members and everyone invited to the reef can see it.
Purpose: shared gameplay feature with users you are friends with
Legal basis: Art. 6 (1) (b) GDPR (providing the feature you use)
e) Advertising (Google AdMob)
The app is partly financed through advertising, in particular through reward videos you can choose to watch. For this we use Google AdMob. Data such as device and advertising identifiers, approximate location data and usage information may be processed.
Before the app loads ads, it asks you in a consent dialog if you are in the European Economic Area (EU, Iceland, Liechtenstein, Norway), the United Kingdom or Switzerland. There you decide whether information may be stored on or read from your device, such as the advertising ID, and whether ads may be personalised. The advertising partners involved are listed in the consent dialog.
• If you agree to personalised ads, Google and these partners build a usage profile from the data to choose suitable ads (profiling). This does not involve an automated decision that has a legal or similarly significant effect on you.
• If you agree only to storing and reading information, you get non-personalised ads. Google then uses identifiers on your device only to limit how often you see the same ad, to fight fraud and for aggregated reporting.
• If you decline, nothing is personalised and no advertising identifier is used. Google then shows limited ads where available. Your IP address is still used to deliver the ad. To fight fraud, Google may use its own cookies or local storage. Reward videos will be available less often or not at all. You can keep using the app.
The consent dialog states, as Google's standard text, that Google and the partners may use precise geolocation data. The app itself does not ask for your location and has no location permission. Your location can therefore only be determined approximately from within the app, for example through your IP address.
You can change or withdraw your decision at any time: Menu (three bars), then "Manage ad consent". Withdrawal applies to the future.
On iPhones the app also shows Apple's "Allow tracking" prompt. If you decline, Google does not receive your iPhone's advertising ID. You can change this in your iPhone settings under Privacy & Security, Tracking.
Purpose: financing the app, delivery of advertising
Legal basis: for storing and reading information that you agreed to, Section 25 (1) of the German TDDDG (consent), for personalised ads, Art. 6 (1) (a) GDPR (consent), for non-personalised and limited ads, Art. 6 (1) (f) GDPR (legitimate interest in financing the app)
f) In-app purchases
If you buy content within the app, payment is handled exclusively through the respective app store (Apple App Store or Google Play). We do not receive any payment data ourselves, only details of the purchase itself, such as the product, the time and the transaction number.
To process and verify purchase receipts we use the service provider RevenueCat (see section 5). The app connects to RevenueCat as soon as it starts, even if you never buy anything, and asks which purchases exist for you. To do so it transmits an identifier:
• If you use the app with a guest account, this is a randomly generated identifier that applies only to the installation of the app on your device.
• If you have secured your account with a login, it is the user identifier of your account (see section 3a). This keeps your purchases tied to your account, including on another device. If you secure a guest account later, RevenueCat links the purchases held under the guest identifier up to that point to your account.
We do not pass your email address or your display name on to RevenueCat. With every request RevenueCat also receives technical details: device type, operating system and app version, language setting, store country and your IP address. On Apple devices a device identifier is added, which the system assigns for all apps from the same provider. It does not change when you sign in or out.
When you buy something, when you restore purchases and when the app checks your purchases against the store, it sends the receipt issued by the store to RevenueCat. A purchase found in the store may then be assigned to the account you are currently signed in with.
RevenueCat tells the app which purchases belong to your identifier. The app uses this to unlock the purchased content. We record in your game progress which purchases have already been credited (see section 3b). If RevenueCat reports that a purchase of FocusReef Plus no longer exists, for example after a refund, the app checks this against the store. If the purchase is no longer present there either, the app withdraws the benefits it had unlocked.
Through RevenueCat we can also see which purchases exist under an identifier and how the app's income develops.
Purpose: providing purchased content, verifying purchase receipts, assigning and restoring purchases, taking refunds into account, evaluating purchases and income
Legal basis: Art. 6 (1) (b) GDPR. For the query at app start before you have bought anything, and for evaluating purchases and income, Art. 6 (1) (f) GDPR (legitimate interest in reliably recognising existing purchases and in keeping track of the app's income)
g) Technical data
Technically necessary data (e.g. device type, operating system version, crash reports) may be processed in order to provide the app and fix errors.
If the app crashes or a serious error occurs, we send an error report to our service provider Sentry (see section 5). Such a report mainly contains the location in the program code where the error occurred, the technical steps just before it, the device type, the operating system and app version, and the time it happened. If the crash happens in the native part of the app, it may also contain the randomly generated installation ID. We do not transmit your name, your email address or your game progress. The reports are stored on servers in the European Union and are currently deleted automatically after 30 days.
Each time you open the app, it also tells Sentry that a session began and whether it ended without a crash. This happens for all users, even if no error occurs. This message contains a randomly generated installation ID stored on your device, the app version and the time. It shows us how many sessions run without a crash. Your IP address is technically involved in every transmission to Sentry. We have set up Sentry so that IP addresses are not stored with the reports. Sentry sets the retention period for session data.
For login, game progress, settings and purchases the app stores information on your device and reads it there. This is strictly necessary for you to use these features (Section 25 (2) no. 2 of the German TDDDG).
Purpose: identifying the causes of crashes, fixing errors, stable operation of the app
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in stable operation)
h) Reporting and blocking
You can report or block other players in the app.
Blocking: We store which account you have blocked and when. An existing friendship, any open friend requests and any open reef invitations between the two of you are deleted in the process. While the block is in place, you cannot send each other friend requests and cannot find each other through the name search. If you are both members of the same reef, you remain visible to each other there (see section 3d). The blocked person is not notified. Other users cannot see your blocks. You can lift a block in the app at any time, and the entry is then deleted.
Reporting: When you submit a report, we store the user identifier of your account, the user identifier of the reported person and their display name at the time of the report, the reason you selected (offensive name, harassment, cheating or something else) and the time. Reports are read only by us as the operator of the app. Other users cannot see them, and neither can the reported person. Once a report has been handled, we note the date it was handled and, where needed, an internal note. If you report someone from within a shared reef or a reef invitation, we also store the name and ID of that reef.
Purpose: protecting users from harassment and offensive names, reviewing reported violations of the terms of use
Legal basis: for blocking, Art. 6 (1) (b) GDPR (providing the feature you use), for reports, Art. 6 (1) (f) GDPR (legitimate interest in protecting users and enforcing the terms of use)
i) Emails to us
If you email us, we process your address, name and message in our Google (Gmail) mailbox until we no longer need them and no retention duty applies.
Purpose: handling your request
Legal basis: Art. 6 (1) (b) GDPR, for reports and requests about your rights Art. 6 (1) (c) GDPR
4. Permissions
The app only requests permissions that are necessary for its features. You can withdraw permissions at any time in your device settings.
5. Recipients and service providers
Supabase Pte. Ltd. (Singapore) (authentication, database, cloud storage) processes account and game progress data as well as blocks and reports on our behalf. When the app accesses the database, Supabase keeps technical logs that include your IP address, in order to run and secure the service. Supabase sets the period after which they are deleted. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure operation).
Google Ireland Limited (advertising through AdMob) processes advertising and device data under its own responsibility, as do the advertising partners named in the consent dialog. More information: https://policies.google.com/privacy
RevenueCat, Inc. (USA) (processing and verification of in-app purchases) processes on our behalf purchase receipts, an identifier (for guest accounts a random identifier of the installation, for secured accounts the user identifier of the account), on Apple devices additionally a device identifier assigned by the system, plus technical device details and the IP address. The app connects to RevenueCat at start for all users, even without a purchase.
Sentry (Functional Software, Inc., USA) (crash and error reports) processes technical error data on our behalf. We use the provider's EU region, so the data is stored in the European Union.
Apple App Store / Google Play handle in-app purchases and distribute the app.
We have data processing agreements with Supabase, RevenueCat and Sentry.
6. Transfers to third countries
Supabase stores the database and backups in the European Union (France), and logs are also kept in the EU. Sentry stores error reports and session data in the European Union. Supabase is based in Singapore and works with Supabase, Inc. (USA), and Sentry is based in the USA. Staff and subcontractors outside the EU may therefore access data in individual cases, for example for support. For Supabase this is based on the EU standard contractual clauses. Sentry is certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission of 10 July 2023, and also offers standard contractual clauses.
RevenueCat processes the data described in section 3f on servers in the USA. This applies to all users from the first start of the app, even without a purchase. The transfer is based on the EU standard contractual clauses, which are part of our data processing agreement with RevenueCat.
Google may also process data outside the EU and the EEA, including in the USA. Google relies on the EU-US Data Privacy Framework for this and, where that does not apply, on standard contractual clauses.
You can find the text of the standard contractual clauses at the European Commission: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj. You can get a copy by writing to focusreef.support@gmail.com.
7. Retention
We store personal data only for as long as necessary for the stated purposes or as required by statutory retention obligations. Account and game progress data are stored for as long as your account exists and are removed when the account is deleted.
A block remains stored until you lift it or one of the two accounts is deleted.
We keep reports (see section 3h) for 12 months in order to review the reported violation and to recognise repeated violations by the same account. After that they are deleted automatically. If an account involved is deleted before then, the report nonetheless remains until the 12 months have passed. The user identifier of the deleted account is removed from the report. The display name the reported person had at the time of the report stays in it.
The identifier and the purchase data at RevenueCat (see section 3f) remain stored for as long as we use the service for FocusReef, or until we delete the entry at your request (see section 8). We keep them so that purchased content can be restored and so that we can prove purchases and refunds. The legal basis is Art. 6 (1) (f) GDPR. How long the respective app store keeps your purchase data is governed by the rules of Apple or Google.
We make backup copies of the database, for example before changing it. They serve recovery after errors and are kept at Supabase. They also contain data of accounts that are deleted later, and they are deleted after 90 days at the latest. The legal basis is Art. 6 (1) (f) GDPR.
8. Deleting your account
You can delete your account and the associated data at any time directly in the app (menu with the three bars, then "Delete account"). This removes the account, profile, friendship and game progress data stored with us. The game progress stored locally on your device is also reset, so that it is not carried over into another account. If you start the app again afterwards, it begins as on first launch. A new guest account is only created when you choose a display name again (see section 3a). Backup copies of the database still contain your data for up to 90 days (see section 7).
Contributions you made to a shared reef remain part of the group's progress (see section 3d). After your account is deleted they can no longer be attributed to you.
Your blocks are deleted together with the account. Reports remain until they are deleted automatically after 12 months (see section 7), but without your user identifier. If you were reported, the display name you had at the time stays in the report for that long.
Deleting your account in the app does not remove the entry at RevenueCat (your identifier and your purchases, see section 3f). The purchase data held by the respective app store is not affected either. On request we delete the entry at RevenueCat (contact: see section 9). For a secured account we can find it through your account for as long as the account exists. For a guest account, and after an account has been deleted, we need the order number from the store's purchase confirmation to find the entry. Without a purchase, the entry of a guest account contains nothing that would let us match it to you. In that case we cannot delete it specifically.
9. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). You can withdraw consent at any time with effect for the future, and consent for advertising directly in the app (see section 3e).
You also have the right to lodge a complaint with a data protection supervisory authority, for example in your own country. The authority responsible for us is the Bavarian data protection authority, Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.
To exercise your rights, a message to focusreef.support@gmail.com is sufficient.
Your right to object
Where we rely on Art. 6 (1) (f) GDPR (legitimate interest), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). This covers the query to RevenueCat before a purchase, the evaluation of purchases and income, keeping purchase data, crash and error reports, technical logs, backup copies, reports, the website and non-personalised advertising. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or we need the data for legal claims. You can object to processing for advertising without giving reasons. A message to focusreef.support@gmail.com is sufficient.
10. Children
FocusReef is intended for users aged 13 and over. Children under 13 may not use the app. If we learn that a child under 13 is using the app, we delete the account.
In Germany you can only consent to personalised ads and to tracking on iPhones yourself from the age of 16. In other EU countries the limit lies between 13 and 16, depending on the country. If you are younger, ask your parents or decline in the consent dialog. You can keep using the app, but reward videos will be available less often or not at all (see section 3e).
Parents can reach us at focusreef.support@gmail.com if they want to withdraw consent or have their child's account deleted.
11. Changes to this privacy policy
We update this privacy policy when the app or the legal framework changes. The current version is available through the app and at this address.
12. This website
This website is hosted on Google Sites (Google Ireland Limited). When you open it, Google processes technical data such as your IP address in order to deliver and secure the page. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in providing the app's legal texts). Google sets its own cookies on this site and points this out at the bottom of the page. We have no influence on this. We do not analyse visits ourselves and do not set any cookies of our own. More in Google's privacy policy: https://policies.google.com/privacy