Security & Data

This page explains, in plain language, how Focus-OS stores, processes, and protects what you write. For the legally authoritative statement of how personal information is handled, see the Privacy Policy; this page explains the mechanics behind it.

1. Where your content lives

Your ideas, Idea Sheets, and uploads are stored in a managed database and private file storage, encrypted at rest with AES-256. Every connection — your browser to Focus-OS, and Focus-OS to its database — is encrypted in transit with TLS. Uploaded images are never publicly addressable: they sit in a private bucket, and every access uses a signed link that expires within the hour.

2. AI processing

AI features send what you wrote — your idea text, and the Idea Sheet built from it where a feature needs it — to OpenAI's business API, a separate service from ChatGPT with contractual data protections. When an idea has visuals attached, we send a signed link to each one and OpenAI fetches the image through it; visuals travel with most AI features, not only the one that reads a visual back to you. Your account, email, and payment details are never sent to OpenAI — only what you put into the idea itself.

Our OpenAI account is configured for Zero Data Retention. Your content is not used to train OpenAI's models, and on the single endpoint Focus-OS uses (Chat Completions), OpenAI does not retain your prompts or the model's replies — neither as stored application state, nor in the 30-day abuse-monitoring logs a standard API account has. Two documented limits survive Zero Data Retention, and we would rather name them: a temporary encrypted cache may sit on the machine that served a request and expires within 24 hours, and every image sent to the API is screened for child sexual abuse material — if that screening flags one, OpenAI keeps it for human review.

3. Who can see your ideas

Access rules are enforced by the database itself, not just by application code: every request runs under your own identity, and row-level security decides what it may read or write. You see your own ideas, ideas explicitly shared with you, and your workspace's ideas according to your role. A public share link exposes exactly one idea, read-only, and can be turned off at any time.

4. Team isolation

Each workspace is isolated by those same database-level rules — membership is checked on every read and write, so one team's ideas are invisible to another's even if application code has a bug. Within a team, owners and admins manage everything; members get the permission level the team sets (view, comment, edit, or full access); guests see only what is explicitly shared with them.

5. What we don't do

• No passwords stored. Sign-in is by Google or an emailed magic link, so there is no password database to breach.
• No card numbers stored. Payment is processed by Stripe; we never see or hold full card details.
• No content in logs or analytics. Application logs contain operational metadata only — identifiers, statuses, counts — never your ideas or AI outputs. Site analytics are anonymous.
• No selling of data. We do not sell your data or share it with advertisers.

6. Deletion

Deleting an idea is a permanent database delete — its shares and public links are removed with it, attached images are purged within 30 days, and encrypted platform backups rotate out within roughly 7 days. To delete your account and everything in it, email support@focus-os.ai and we will take care of it.

Questions

If your organization has security questions this page doesn't answer, write to support@focus-os.ai — we answer them directly.