Last Updated: May 29, 2026
Win 10 Minutes ("we", "our", or "the app") is committed to protecting your privacy. This Privacy Policy explains what information the app handles, where it is stored, and who can see it. By design, most of your data stays on your device. A few optional, opt-in features (the Arena leaderboard, Groups, the Guardian accountability partner, and Focus Reports) store and share a limited amount of data through Apple iCloud so that the specific people you choose to connect with can see it.
By default the following stays on your device (and in your personal iCloud backup if you enable iCloud Backup):
These features are optional. If you turn one on, a limited set of data is stored in Apple's iCloud (CloudKit) and made visible to the specific people you connect with. We do not operate our own database of this content; it is stored in iCloud and associated with your iCloud account identifier.
You stay in control: you can leave the Arena/Groups, unpair your Guardian, and turn Focus Report sharing off at any time.
To deliver Guardian alerts to your partner's lock screen (for example, "your partner is asking to give up"), the app registers a push notification token with Apple Push Notification service and Google's Firebase Cloud Messaging. This token is stored (in iCloud) and used by our notification-relay function to send the alert. The notification contains your display handle and the type of request only; it does not contain your focus content, statistics, or photos. See Google's privacy information: https://firebase.google.com/support/privacy
When you use AI Task Breakdown, the task/goal text you type is sent to OpenAI's API to generate subtasks.
The app uses Apple's Screen Time / Family Controls API to block distracting apps during focus sessions and Daily Limits. This is processed on-device by iOS and does not transmit your app-usage data to us or any third party.
Payments are processed entirely by Apple through their secure system. We never have access to your payment card information.
We recommend using a device passcode, keeping iOS updated, and enabling iCloud Backup for recovery.
Win 10 Minutes is intended for a general audience. Some features (such as a parent acting as a child's Guardian, or receiving a child's Focus Report) are designed to be set up by a parent or guardian. We do not knowingly collect personal information from children under 13 beyond the minimal, opt-in data described above that a user or their parent chooses to share. If you believe a child has provided information without parental consent, contact us and we will delete it.
If you are a California resident, you have the right to know what personal information is collected, request deletion of your personal information, and opt out of the sale of personal information (we do not sell data).
If you are in the EU, you have the rights to access, rectification, erasure, and data portability. Because most data is stored on your device or in your own iCloud, you control it through the app and your device/iCloud settings; contact us for requests involving data shared through the optional features.
We may update this Privacy Policy from time to time. Updates will be posted with app updates, and the "Last Updated" date will be revised.
If you have questions about this Privacy Policy, please contact us at:
The iPhone features described above are separate from Win10min Planner and the Mac companion. The planner is free. You can make an unsaved plan in ChatGPT without a Win10min account. ChatGPT handles the conversation under its own settings and policies.
If you connect a Win10min account and save a goal, we store its title, outcome, milestones, actions, durations and results you report in Google Cloud Firestore. Firebase Authentication handles email/password or Apple sign-in. We use the verified account identity to separate private goal boards. We do not receive your Apple password. Apple can use a private relay email. If Apple does not supply an email, an email address will not be invented.
The sign-in page can remember a Firebase session in browser storage. Each app connection still requires consent. The dashboard can display the verified account email, and the account profile tool can return it to ChatGPT so you can check where a goal will be saved. The email is not added to goal text. Login and API traffic at connect.win10minutes.app passes through Cloudflare to Google Cloud and Firebase over HTTPS.
Mac account credentials are held in macOS Keychain. Imported plans and confirmed results also have local copies. A portable plan is carried in the URL fragment, which is not part of the HTTP request; the transfer page handles it locally. Review the plan and start focus yourself. The hosted planner cannot start the Mac timer, hide apps, read Screen Time or access your calendar or other connected apps.
Saved goals remain until you delete them. Deleting one goal removes its actions and recorded evidence from the saved board. Technical retry records containing operation identifiers, content hashes and dates can remain to prevent a repeated request from recreating deleted data. They are not an extra copy of the evidence text. The account-management page can disconnect app access while keeping goals, or delete the saved goal board and revoke connected grants. Deleting the board also queues removal of its technical retry records; that background cleanup is not instantaneous.
Delete goal data removes only the saved goal board and connected access. Delete my Win10min account removes the Firebase login, saved goals and recorded evidence, connected authorizations, associated AI request history, trial claims and legacy ownership approvals. Cleanup runs in the background after the request is accepted. Purchase links to the deleted account and balances are removed. Minimal transaction identifiers, product/type and processed/refunded markers remain to prevent granting the same purchase twice. These markers remain while the corresponding purchases can be redeemed and may remain for the service lifetime; they are not anonymous data. The retention rule is removal within 30 days after permanent rejection for redemption is enforced. No such retirement or automatic purge is currently implemented; this release keeps these minimal markers. There is currently no fixed expiry for these purchase markers. Minimal inactive/deleted authorization markers remain to prevent old access from reopening the account. Purchases do not automatically transfer to a new account. Local device copies are separate, and deletion does not cancel Apple subscriptions. Contact [email protected] for account/data requests.
The hosted service records tool name, arrival/completion phase, outcome and a restricted error code. Those diagnostic events omit tokens, account and goal identifiers, arguments, goal text and free-form error text. Google project logging currently uses a default bucket configured for 30 days and a required bucket configured for 400 days. These observations do not establish retention for every provider or other account record. Access tokens last one hour; app grants are bounded to 30 days. Expired server records may be removed asynchronously.