Privacy Policy

cura Technologies GmbH ("cura", "we", "us") respects your privacy. This Policy explains what personal data we process when you use the cura app, this website, our online shop, and the cura Block and cura Station, and what rights you have. It is written to comply with both the Swiss Federal Act on Data Protection (FADP / revDSG) and the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller responsible for your personal data is:

• cura Technologies GmbH, c/o Jacob Haider, Agnesstrasse 22, 8004 Zürich, Switzerland
• Commercial register: Handelsregister des Kantons Zürich, UID CHE-459.679.241
• Managing Director: Jacob Haider
• Data-protection contact: legal@cura-focus.com

We have not appointed a Data Protection Officer, as we are not legally required to. As a company established in Switzerland offering services in the EU, we are appointing a representative in the European Union under Art. 27 GDPR; their details will be published here once appointed. No Swiss representative under Art. 14 FADP is required.

2. Scope

This Policy covers the cura app for iOS, this website, our online shop (currently shipping within Switzerland only), and the cura Block and cura Station NFC products. It does not cover third-party services you connect to (such as Apple or Google), which have their own privacy policies.

3. What data we process, and why

Account and authentication. When you create an account we process your email address, a password (stored only in irreversibly hashed form, so we never see your plaintext password), and a system-generated user ID. If you use Sign in with Apple or Google, we receive the basic profile information you authorise that provider to share. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Optional profile. You may optionally add a name, gender, and birth month and year to personalise your experience. You can remove these at any time. Legal basis: your consent (Art. 6(1)(a) GDPR).

cura Block and cura Station. To register and use a tag we process its unique identifier and signature, the name you give it, and the link between the tag and your account. If you share a tag, co-owners can see the email and name on the other linked accounts so you can manage shared access. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Focus sessions and app usage. The core of cura runs on your device. Your blocking profiles, session history, activity records, schedules, breaks and goals are stored locally on your device. So that you can restore your data after a reinstall, on a new device, or by signing in elsewhere, cura keeps an encrypted backup of this data on our own backend (Supabase, in the EU), linked to your cura account. This backup is on by default; you can turn it off and delete the stored copy at any time in the app. (In earlier versions of cura this backup lived in your personal iCloud account; it now sits on cura's servers so it restores anywhere you sign in.) The detailed record of which apps or websites you actually opened during a session stays on your device and is not part of this backup. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) — the backup and restore feature is part of your cura account; you can disable it at any time.

What you choose to block (Screen Time). When you pick which apps or websites to block, Apple's Screen Time framework gives the app only opaque tokens. cura cannot read the names of the apps or websites you select. While your backup is on, these opaque tokens are included in your encrypted cura backup as data we cannot interpret; we never receive a readable list of what you block. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

App analytics. We use PostHog (hosted in the EU) to understand how cura is used. By default analytics are anonymous: events carry no email, user ID, name, or information about what you block. We collect only product-usage signals and coarse technical context (app version, OS version, locale). Session recording is disabled. Legal basis: our legitimate interest in improving the product (Art. 6(1)(f) GDPR); your consent where required.

Website analytics. On this website we use Vercel Web Analytics to count visits and page views. It is cookieless and privacy-friendly: it sets no cookies, uses no local storage, and does not fingerprint you or track you across other websites. It records only aggregate, coarse information about a visit (such as the page viewed, the referrer, an approximate country, and your browser, operating system and device type) using a temporary identifier that is not linked to your identity and is not retained to follow you over time. We never receive your full IP address through this analytics. You can block it with the privacy tools or content blockers built into most browsers. Legal basis: our legitimate interest in understanding and improving the website (Art. 6(1)(f) GDPR).

Push notifications. With your permission, we send notifications via Apple's Push Notification service, using a device token solely to deliver the notification. Legal basis: your consent via the iOS permission, or performance of our contract (Art. 6(1)(a)/(b) GDPR).

Website, shop and messages to us. Our host processes standard technical data (such as IP address and pages requested) in server logs to deliver and secure the site. The site embeds interactive 3D content via Spline and uses the privacy-friendly, cookieless website analytics described above; it carries no advertising or cross-site tracking. If you order a cura Block, we process the data needed to fulfil your order (name, delivery and billing address, contact and payment details). The app also keeps a small technical log on your device to diagnose problems, which stays on your device unless you choose to share it. If you email us, we process your message and contact details to respond. Legal basis: our legitimate interest in running the website and handling your enquiry (Art. 6(1)(f)); performance of the purchase contract and legal obligations for orders (Art. 6(1)(b)/(c) GDPR).

In-app feedback survey (beta). While cura is in beta testing, we may show a short, voluntary feedback survey in the app, for example after a focus break. Your answers are stored anonymously on our backend (Supabase, in the EU), separately from your account: each saved response holds only your answers, the survey id and version, a random response id used solely so a submission isn't counted twice, and a timestamp. We do not store your account, user ID, email, name or any device identifier with your answers, so we cannot link a response back to you. The survey is optional and dismissible. Separately, we record anonymous counts of how the survey performs (shown, started, completed, dismissed) in our analytics (PostHog); no answer content and no free text you write is ever sent to analytics. Please don't include personal details about yourself or others in free-text answers. Legal basis: because the responses are anonymous, on our analysis they are not personal data and data-protection law does not apply; to the extent they are, our legitimate interest in improving the product (Art. 6(1)(f) GDPR), supported by the survey being entirely voluntary.

4. Who we share data with

We do not sell your personal data. We share it only with service providers who act on our instructions under a data processing agreement, and where legally required:

• Supabase: authentication, database, NFC tag registry, backend functions, and your encrypted account backup/restore (EU, eu-west-1).
• PostHog: anonymous product analytics, no personal identifiers (EU).
• Apple (APNs, App Store): push notifications and app distribution (Apple data centres, including the USA).
• Apple / Google Sign-In: optional federated login, only if you use it (USA).
• Vercel: website hosting, content delivery, and privacy-friendly website analytics (global infrastructure).
• Email and payment providers: account emails, and payment processing for shop orders.

We may also disclose data to authorities or advisers where required by law or to establish, exercise or defend legal claims.

5. International data transfers

Your account data, your encrypted app-data backup, and our product analytics are hosted in the EU. Some processing necessarily involves transfers to the United States, in particular Apple services (push notifications, the App Store, and Sign in with Apple) and our website host and analytics provider Vercel. Where data is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (with the Swiss addendum) and/or the provider's certification under the EU-US / Swiss-US Data Privacy Framework. You can request a copy of the relevant safeguards at legal@cura-focus.com.

6. How long we keep your data

• Account and profile data: until you delete your account, then deleted or anonymised without undue delay, subject to statutory retention.
• cura Block / Station links: until you remove the tag or delete your account.
• Focus and usage data: stored on your device; removed when you delete the data or the app. Your encrypted backup is held on our backend (Supabase, EU) until you turn backup off and delete it, or until you delete your account, when it is removed automatically.
• Analytics: app and website analytics are kept in aggregate, limited form and retained no longer than necessary.
• Beta feedback-survey responses: stored anonymously (no account link), kept for up to 9 months from collection, then deleted or aggregated. The survey runs only during the beta.
• Server and hosting logs: a short period for security and troubleshooting.
• Shop and accounting records: for the statutory retention period (Swiss law: generally 10 years).
• Support correspondence: as long as needed to handle your request and any follow-up.

7. Data security

We use appropriate technical and organisational measures, including encryption in transit, hashed passwords, encrypted device storage, strict per-account access controls on your cloud backup, and EU-based hosting for your account data and backup. No method of transmission or storage is completely secure, but we work to protect your information.

8. Your rights

Under the GDPR and the Swiss FADP you have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent at any time. You can also lodge a complaint with a supervisory authority. To exercise any right, email legal@cura-focus.com.

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Bern (edoeb.admin.ch).
• EU/EEA: your local national data protection authority.

9. Deleting your account

You can delete your account directly in the app, which removes your profile, account record, tag links and your encrypted app-data backup from our backend. Your cloud backup is deleted automatically when you delete your account, and you can also delete it on its own at any time in the app. On-device data is removed when you delete the app. We may retain limited data where required by law.

10. Children and minors

cura is intended for users above the applicable age of digital consent. We do not knowingly collect personal data from children below that age without verifiable parental consent. If you believe a minor has provided us data without the required consent, contact legal@cura-focus.com.

11. Cookies and tracking

Any cookies and similar technologies we use are described in our Cookie Policy. The website uses only strictly necessary cookies; our website analytics is cookieless (see Website analytics above), so we do not show a cookie banner. Any future cookie-based or otherwise non-essential tracking will be used only with your prior consent where required.

12. Automated decision-making

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here with a new "last updated" date and, where changes are significant, notify you appropriately.

14. Contact

Questions about this Policy or your data? Email legal@cura-focus.com, or write to cura Technologies GmbH, c/o Jacob Haider, Agnesstrasse 22, 8004 Zürich, Switzerland.