Privacy Policy

Locus, also called we, our, or us in this policy, provides the Locus web app and related services. You can contact us at developer.shahadat@gmail.com. For security reports, use developer.shahadat@gmail.com.

We collect information in these categories:

• Account information: email address, first and last name, password status, connected sign-in methods, account settings, and internal user IDs.
• Google sign-in information: if you choose Google login, Google sends us an ID token. We verify it and may use the Google account ID, email, name, and profile details included in that token to create or connect your Locus account. We never receive your Google password.
• Content you add: tasks, notes, areas, projects, expenses, savings, lends, watch items, games, file attachments, comments, activity records, and any other data you choose to put in Locus.
• Technical and usage data: request metadata, device/browser information, approximate location inferred from IP address, error logs, and security events.
• Support information: anything you send us when asking for help, reporting a bug, or making a privacy request.

• To create accounts, sign users in, and keep sessions secure.
• To show, sync, search, import, export, and update your app data.
• To prevent abuse, troubleshoot errors, and protect the service.
• To respond to support, privacy, and security requests.
• To comply with legal obligations when they apply.

We do not use your personal content for advertising. We do not sell your data or share it with data brokers.

Locus uses Google Identity Services on the web. The Google button lets Google authenticate you, then Locus receives a signed ID token and sends it to our backend. Our backend verifies the token with Google, creates or finds your Locus user, and issues a Locus session.

If Locus also offers mobile apps, those apps may use native Google sign-in for Android or iOS. The mobile app should still send the resulting Google ID token to the same Locus backend so the same Locus account is used across web and mobile.

Locus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

This section explains exactly how Locus accesses, uses, stores, shares, and deletes Google user data.

• Google data we access: when you choose Google Sign-In, Locus receives a Google ID token. After verification, that token may provide your Google account ID, email address, name, and profile picture if Google includes those claims.
• How we use Google data: we use this data only to verify your identity, create or connect your Locus account, sign you in, prevent account abuse, and help you manage your sign-in methods.
• How we store Google data: we store the Google account ID and basic profile details needed to maintain your Locus account and sign-in connection. We do not store your Google password, and we do not store the Google ID token as long-term content.
• How we share or transfer Google data: we do not sell Google user data, use it for advertising, share it with data brokers, or transfer it to third parties except to service providers that operate Locus under our instructions, or when required by law.
• How we delete Google data: you can disconnect Google from account settings when another sign-in method is available, or request account deletion by contacting us. Account deletion removes or de-identifies the Google account connection from active systems, subject to backup retention, security logs, and legal obligations described in this policy.

Locus uses essential authentication storage so the app can keep you signed in and protect your account:

• Refresh-token cookie: an HttpOnly cookie used by the backend to refresh your session. In the web app this is read as refreshToken.
• Access token: a short-lived token held in memory by the web app and attached to API requests.
• Local preferences: client-side settings such as theme, recent searches, or interface preferences may be saved in browser storage.

We do not use advertising cookies. If we add optional analytics, marketing, or personalization cookies later, we will update this policy and provide consent controls where required.

Locus uses service providers only to operate, secure, improve, and support the app. These may include hosting, database, object storage, email, and logging providers.

• Google: provides Google Identity Services when you choose Google login.
• Infrastructure providers: host the app, API, database, file storage, logs, and backups.
• Email providers: may send transactional email, such as account or support messages.

Providers process data for us under their own security and data protection terms. We do not permit them to use your Locus content for their own advertising.

We share personal information only in limited cases:

• With service providers that help us run Locus.
• With your permission or at your direction.
• To comply with valid legal requests or protect rights, safety, and security.
• As part of a merger, acquisition, financing, or asset transfer, if one happens.

If we receive a legal request for your data, we will try to notify you unless the law prevents us or the request involves an urgent safety or security issue.

We keep account and app data while your account is active. When you delete content, we remove it from active product surfaces. When you delete your account, we delete or de-identify your account and user-owned content from active systems, subject to:

• short backup retention windows,
• security, abuse-prevention, and audit logs,
• records we must keep for legal, tax, or dispute reasons,
• shared workspace data that may need to remain visible to other collaborators.

Backup copies are overwritten on their normal cycle. Support messages and security logs may be retained longer when needed to resolve a request, prevent abuse, or satisfy legal obligations.

We use reasonable technical and organizational safeguards, including encrypted transport, server-side authorization checks, password hashing, protected session cookies, access controls, and operational logging. No service can guarantee perfect security. If we learn of a security incident affecting your personal information, we will notify affected users and regulators where required by law.

Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to processing of your personal information. We honor reasonable privacy requests even when a specific law does not require it.

• Use the app settings to update profile and account details.
• Delete individual records from the relevant app screens.
• Request account export or deletion by contacting us or using the account deletion request page.
• Disconnect Google from account settings when you have another sign-in method.

To make a request, email developer.shahadat@gmail.com. We may need to verify your identity before acting on the request.

Locus and its service providers may process information in countries other than where you live. When required, we use appropriate safeguards for those transfers, such as contractual protections provided by our vendors.

Locus is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to Locus, contact us and we will take appropriate steps to delete it.

We may update this policy as Locus changes. The date at the top shows the latest update. If a change materially affects your privacy, we will provide additional notice where appropriate.

For privacy questions or requests, email developer.shahadat@gmail.com. For security issues, email developer.shahadat@gmail.com.