Security & Data

This page explains, in plain language, how Focus-OS stores, processes, and protects what you write. For the legally authoritative statement of how personal information is handled, see the Privacy Policy; this page explains the mechanics behind it.

1. Where your content lives

Your ideas, Idea Sheets, and uploads are stored in a managed database and private file storage, encrypted at rest with AES-256. Every connection — your browser to Focus-OS, and Focus-OS to its database — is encrypted in transit with TLS. Uploaded images are never publicly addressable: they sit in a private bucket, and every access uses a signed link that expires within minutes.

2. AI processing

AI features send your idea text (and, when you attach visuals, temporary links to them) to OpenAI's business API — a separate service from ChatGPT, with contractual data protections. Your content is not used to train OpenAI's models. OpenAI may retain API inputs and outputs for up to 30 days solely for abuse monitoring, after which they are deleted. Your identity and billing details are never sent to OpenAI.

3. Who can see your ideas

Access rules are enforced by the database itself, not just by application code: every request runs under your own identity, and row-level security decides what it may read or write. You see your own ideas, ideas explicitly shared with you, and your workspace's ideas according to your role. A public share link exposes exactly one idea, read-only, and can be turned off at any time.

4. Team isolation

Each workspace is isolated by those same database-level rules — membership is checked on every read and write, so one team's ideas are invisible to another's even if application code has a bug. Within a team, owners and admins manage everything; members get the permission level the team sets (view, comment, edit, or full access); guests see only what is explicitly shared with them.

5. What we don't do

• No passwords stored. Sign-in is by Google or an emailed magic link, so there is no password database to breach.
• No card numbers stored. Payment is processed by Stripe; we never see or hold full card details.
• No content in logs or analytics. Application logs contain operational metadata only — identifiers, statuses, counts — never your ideas or AI outputs. Site analytics are anonymous.
• No selling of data. We do not sell your data or share it with advertisers.

6. Deletion

Deleting an idea is a permanent database delete — its shares and public links are removed with it, attached images are purged within 30 days, and encrypted platform backups rotate out within roughly 7 days. To delete your account and everything in it, email support@focus-os.ai and we will take care of it.

Questions

If your organization has security questions this page doesn't answer, write to support@focus-os.ai — we answer them directly.