Privacy Policy
This policy explains what information the iPhone app “Tiny Voyages” (the “app”) handles and how it is used. The app is provided by foco apps (“we”, “us”). This policy is written in English and Japanese. If the two differ, the English version prevails.
1. In short
- There is no account. We do not collect your name, phone number, location, contacts or photos. We receive your email address only if you contact us.
- Your complete trip records, postcards, goals and settings, and anything you type (what you are working on, category names, goal names), stay on your device and, if you use iCloud, in your own iCloud. We cannot read those records. The app sends only the limited usage events described below, and you can turn them off.
- Anything from Screen Time (the apps and sites you choose to block, and when you open one anyway) is never sent to us or to any other service.
- In the European Economic Area, the United Kingdom and Switzerland, usage data and crash reports are sent only if you agree when the app asks. Elsewhere they are sent unless you turn them off in Settings. They carry a random ID instead of your name. Every feature works the same either way.
- The app has no ads, does not track you across other companies’ apps or websites, and we do not sell your information.
2. Information kept on your device and in your iCloud
| Information | Where it is kept |
|---|---|
| Trips (start and end times, length, destination, how they ended), postcards, the world map | On your device. If iCloud sync is on, also in your own iCloud (Apple’s private database for your Apple Account), so your other devices can show the same records. We and our service providers cannot read it. |
| Text you write: what you are working on, category names, goal names | |
| Goals and weekly plans, the sounds you choose, settings | |
| Block lists you make with Screen Time, and records of opening a blocked app anyway | |
| Backups | The app keeps backup copies of your records inside the app on your device. A file you export goes only where you choose to save or send it. |
Postcards you save to Photos or share go only where you choose. The app adds images to Photos but never reads your photos. Shared postcards never include what you are working on, category names or anything from Screen Time.
3. Information the app sends
Every connection also passes your IP address to the receiving service, from which a rough area (such as a country or city) may be estimated. Automatic requests never include your name, the text you write or anything from Screen Time. Messages you choose to send us are described separately below.
| What is sent | To whom | When | Why |
|---|---|---|---|
| Usage data: major screen views; starting and finishing a trip, its length and mode and catalog destination/moment IDs; paywall views, plan selection, purchase attempts and results, closing or continuing free, legal links and restoring purchases; fixed settings/guide choices and fixed error codes. Events use numbers, yes/no values and fixed types or IDs, with a random pseudonymous app user ID and technical metadata such as app/iOS version, device model, language, time zone, screen size and a session ID. No text you write or Screen Time values are included | PostHog EU | Only while “Share usage data” is on | Learning how the app is used and improving it |
| Crash reports: technical crash logs and stack traces, app/iOS version, device model and an ID made for crash reports on this device. We do not attach your text, Screen Time values, the analytics user ID or logs of your actions | Google (Firebase Crashlytics) | Only while “Share usage data” is on | Fixing bugs |
| Settings check: app/iOS and SDK versions, language, country, time zone, app identifiers and a Firebase installation ID, with technical SDK diagnostics | Google (Firebase Remote Config) | When the app checks for updated settings | Delivering adjustable settings, such as pausing a destination, without an app update |
| Purchases: what you bought, its price and currency, purchase and renewal dates, free trial status, a pseudonymous random ID made by the app (the same ID used for experiment assignment), app/iOS version and store metadata. We never receive your payment details; Apple handles payment. | RevenueCat | At app startup and when recording or restoring StoreKit transactions and updating purchase status. Not set up on a device where the app knows the user is under 13 | Recording purchases and analyzing trials, paid conversion, cancellations, renewals and refunds. Apple’s StoreKit handles buying and determines Pro access |
| Time check: a request for the current time. Nothing about you or your records is sent. | Our server on Cloudflare | Around trips | Counting focus time and days correctly even if the device clock is changed |
| Messages to us: the kind of message you choose (problem, idea or something else) and what you write; your email address only if you enter one for our reply; the app version, iOS version, device model and language; and, only while “Share usage data” is on, the app’s random ID (so that we can find data sent from your device if you ask). The app shows these details before you send. | Our contact service on Cloudflare, which forwards it to our email inbox | Only when you send a message in the app | Answering you |
| Email: your email address and what you write | Our email inbox | Only when you email us | Answering you |
PostHog EU receives the same random pseudonymous ID that RevenueCat uses for purchase records. We use it to compare usage data (only from people who share it) and purchase history to understand conversion and retention, including destinations and trips before cancellation. We do not create person profiles, record sessions, automatically capture screens or small interactions, estimate location from IP addresses, or use PostHog feature flags. These IDs are not advertising identifiers and are not linked to other companies’ app data. Firebase Analytics is not included; Firebase is used only for Crashlytics and Remote Config. We do not collect uninstall events, individual small taps or scrolling, or how much of a scene or postcard you look at.
Apple also handles App Store purchases, iCloud and app distribution under its own policy. If you agree to share analytics with app developers in your iPhone settings, Apple may share summary data with us.
Your message goes through our server on Cloudflare, which forwards it to our support inbox by email and does not store it. To stop automated abuse, the app also sends a one-time Apple DeviceCheck token, which proves only that the message came from the app on a real Apple device; it does not identify you. We never attach your trips, tasks, category or goal names, or anything from Screen Time. If the app cannot reach our server, it may open a draft email instead; your email provider then handles the message under its own policy.
4. Your choices
- Share usage data: in the European Economic Area, the United Kingdom and Switzerland, the app asks during the first setup, before your first trip, with “Share” and “Don’t share” shown the same way. Nothing is sent unless you agree. Before you answer, only the events from your first opening and your first trip are held on your device, for up to 7 days; if you agree they are sent, and if you say no or do not answer within 7 days they are discarded. Everywhere else, the app does not ask: usage data and crash reports are sent from the start, and you can turn them off. We decide which applies from your App Store country, or, if it is not available, your device’s region setting. In every country, you can change this anytime in Settings → Data and backups → Share usage data, and your choice applies on all your devices that use the same iCloud. When sharing is off, the app stops authorizing new usage-data and crash-report sends and discards queued events. Crash reports not already authorized are discarded; an upload already authorized earlier in that app session cannot be recalled. The settings check and purchase records described above are separate functional requests.
- iCloud: turn sync off in iPhone Settings → your name → iCloud. Deleting the app does not delete the copy in your iCloud; use Erase all data first, or delete it in iPhone Settings → your name → iCloud → Manage storage.
- Screen Time: remove the app’s Screen Time permission anytime in iPhone Settings → Screen Time.
- Export: Settings → Data and backups lets you export all of your data as a file.
- Erase: Settings → Data and backups → Erase all data removes your data from this device and from your iCloud, and the app starts a new random ID. Pro stays with your Apple Account and comes back with Restore purchases.
- Data already sent: to have usage data, crash reports or purchase records deleted, contact us before you use Erase all data, because that starts a new random ID and we can find your data only by the old one. Your app’s random ID is shown in Settings → Data and backups → App ID, and messages you send in the app include it while “Share usage data” is on. We then ask each service to delete the data.
5. Service providers and where information is processed
We use the following providers only for the purposes above. We have confirmed through their terms and data processing terms that they protect information to the same or an equal standard as this policy.
| Provider | Role | Their policy |
|---|---|---|
| PostHog Inc. (United States; EU Cloud in Germany) | Usage data, sent to the EU service | PostHog Privacy Policy |
| Google LLC (United States) | Firebase Crashlytics (crash reports), Firebase Remote Config (settings) | Google Privacy Policy, Privacy and Security in Firebase |
| RevenueCat, Inc. (United States) | Purchase records and subscription analysis | RevenueCat Privacy Policy |
| Cloudflare, Inc. (United States) | The time check, forwarding messages and email to us, and hosting this website | Cloudflare Privacy Policy |
| Apple Inc. (United States) | App Store, payment, iCloud | Apple Privacy Policy |
Information may therefore be processed outside your country, including in the United States and the European Union. We do not give information to any other third party except where the law requires it.
This website uses no cookies, analytics or web fonts. The only script switches between English and Japanese pages in your browser and sends nothing.
6. How long we keep it
- Data on your device: until you delete it, delete the app, or use Erase all data. Data in your iCloud: until you use Erase all data or delete it from iCloud yourself; deleting the app does not remove it.
- Usage data: up to 7 years (PostHog’s retention period). Totals that cannot identify anyone may be kept longer.
- Crash reports: 90 days.
- Purchase records: as long as needed to manage purchases and to keep records the law requires.
- Messages and email to us: until your question is resolved, and then up to one year so that we can follow up.
- The time check: we do not keep records of requests.
7. Children and age
- The app is rated 13+ and is not directed at children under 13. We do not knowingly collect information from children under 13. If we learn that a user is under 13, we stop sending usage data and crash reports from that device, do not ask to share usage data, discard unsent events/reports, do not set up purchase records with RevenueCat, and arrange deletion of records already received with the service providers. Every feature still works. A parent or guardian can contact us to ask for this.
- In places where the law requires it (such as some US states), the app asks iOS for your age range using Apple’s Declared Age Range feature. The app receives only an age range, never your date of birth. It uses the range on your device to apply age-appropriate settings. The age range is not sent to us or to any other service.
- In the European Economic Area, the United Kingdom and Switzerland, “Share usage data” is off unless you turn it on. Elsewhere it is on until you turn it off. It is always off for a user the app knows to be under 13. The app has no ads, no location and no profiling for marketing.
- If you are a minor, please get permission from a parent or guardian before purchasing.
8. Legal bases and your rights
Where data protection law asks for a legal basis (such as the EU GDPR, UK GDPR or Switzerland’s Federal Act on Data Protection), we rely on your consent for usage data and crash reports, which is why the app asks first in those places; on performing our contract with you for recording purchases and answering your messages; on our legitimate interest in understanding trials, renewals and cancellations from purchase records; and on our legitimate interest in keeping the app working correctly and securely for the settings check and the time check. You can withdraw consent, or turn sharing off where the app did not ask, anytime in Settings; this does not affect what was sent before.
Depending on where you live (for example, under Japan’s Act on the Protection of Personal Information or UK GDPR), you may ask us to tell you what information we hold about you, to correct or delete it, or to stop using it. Please contact us at the address below. Because we do not hold names, we can find your information only by the app’s random ID, and we may be unable to act if we cannot find it. You can always export or erase the data on your device yourself. If you live in the UK, you may also complain to the Information Commissioner’s Office; in the European Economic Area or Switzerland, to your local data protection authority.
9. Security
Information is sent over encrypted connections. The app is designed not to send information that directly identifies you, and access to the data we receive is limited to us.
10. Changes to this policy
When we change this policy, we update this page and the date above. If a change affects what the app sends, we tell you in the app before it applies.
11. Contact
foco apps (run by an individual; the operator’s name and address are provided without delay on request)
Email: [email protected]
In the app: Settings → Contact us