PRIVACY POLICY

Last updated: 27 October 2026 · Website, support, and the v0.2.0 Windows release and companion extension

1. What this policy covers

Two pieces of software:

• Brutal Focus Lock — the Windows desktop application.
• Brutal Focus — Companion — the optional browser extension, which does nothing on its own and only responds to the desktop app.

Sections 9 and 13 cover this website and voluntary support. The software description refers to the v0.2.0 release. For older releases, consult their release notes and bundled notices.

2. App data and online services

The release has no telemetry feature or author-operated account service. Sections 3 to 7 describe its local operation. Websites you open receive normal browser requests under their own policies, separately from app telemetry.

This free release has no payments, advertising or paid upgrades, and the app collects no payment data. No data is requested as a condition of downloading or using it. Support is voluntary (section 8).

3. What is stored on your computer

Use RESET ALL DATA in Settings to erase the app's saved settings and history. Diagnostic and crash logs, plus the hosts-file backup, are separate local files you can delete after confirming no exam session or managed hosts entry remains.

4. The keyboard hook

During an exam session the app installs a Windows low-level keyboard hook. This is the mechanism that stops Alt+Tab, the Windows key, Alt+F4 and Ctrl+Esc from working while you are locked in. Focus timer sessions do not use this hook.

It is not a keylogger. The hook inspects each key event only to decide whether to block that specific combination, and discards it. The hook is designed not to record, store or transmit keystrokes. The only thing kept is a number (how many key presses the hook blocked). It goes only to the local diagnostic log (section 3). The hook is uninstalled the moment the session ends or the app exits.

We are explicit about this because the same Windows mechanism is used by keyloggers, and some antivirus software flags any program that uses it. See section 10.

5. The camera

• It is disabled by default as of v0.1.1. You must turn it on yourself in Settings.
• When enabled, Windows will ask for camera permission. That prompt is the operating system's, not ours.
• The stream is designed for local self-view, without recording, saving or transmitting frames.
• The stream stops and the camera is released when the session ends, so the webcam indicator light goes out.
• The app releases the camera automatically if Windows needs it for a system prompt such as Windows Hello.

6. The hosts file, and admin rights

In exam mode, when your blocklist is nonempty and you approve the Windows prompt, the app writes listed domains into the Windows hosts file. This is the only thing Brutal Focus does with elevated privileges. Focus timer sessions do not modify the hosts file; their site blocking requires the optional companion extension to be connected.

• Your original hosts file is backed up first (section 3).
• Our entries are wrapped in clearly marked sentinel lines, so you can see exactly what was added.
• The elevated helper normally removes these entries when the session ends or the app exits. Cleanup can fail: reopen the app to check its status, or use Settings → RESET HOSTS FILE NOW and follow the recovery warning.
• The RESET HOSTS FILE NOW button requests cleanup and may require Windows administrator approval. Check the resulting status; an unknown status does not confirm that cleanup succeeded.
• The blocklist is yours. The app is designed not to read it from, or send it to, any server.

7. The companion extension

The extension is optional. It receives your session state from the desktop app. After an unexpected connection loss, browser rules remain until the original session deadline, an idle update from the desktop app, a full browser restart, or you disable the extension. Browser alarms can be delayed while the computer is asleep.

• It is designed to connect only to the desktop app on your own computer (ws://127.0.0.1:8080), a loopback address that stays on your computer.
• It requests declarativeNetRequest, alarms, and storage, plus host access to all sites and the local desktop connection. Broad host access is required because your blocklist is defined by you at runtime and cannot be known in advance.
• It is designed not to read, collect, modify or transmit the content of any page. It matches navigation requests against your blocklist and redirects the ones you asked to block.
• Blocking uses session-scoped rules, which Chrome discards when you close the browser. The latest blocklist, mode, and deadline are held in browser session storage to recover after a service-worker restart. This storage is cleared when the browser session ends.
• The extension cannot end an exam session. As with any browser extension, disabling or removing it stops its browser-side blocking.

8. Free software and voluntary support

Brutal Focus is free, Exam mode included. There are no paid licences, no licence keys and no activation. The free build is designed to send no licence or payment data and not to read your computer's machine ID; automated tests and a hardware network check on the release-candidate build cover this.

After some completed sessions the app may show a message inviting you to support its development. That message is shown and remembered on your computer only: whether it was shown, when, and whether you said you already support the app are stored in the app's local storage (section 3) and erased by RESET ALL DATA. It is designed not to send anything about it to us. Its button opens a web page or copies the website's address; nothing else.

Support is voluntary. If contributions are ever accepted, it will be through a third-party platform you visit in your browser. That platform, not the app, handles any payment and personal data you give it, under its own privacy policy, and this section will name it before it is used. Any future change in the app's data practices will be described before that version is offered and will not change the licence of a version you already installed.

9. This website

This static site's code sets no cookies, stores no demo inputs and includes no analytics, advertising, tracking pixels, accounts or newsletter signups. Fonts and scripts are served locally. The phrase demo runs in your browser and does not submit what you type.

Hosting: Cloudflare receives technical request data, such as IP address, URL, request time and browser information, to deliver and secure this site. The publisher relies on legitimate interest in providing a secure, accessible website (GDPR Article 6(1)(f)). Cloudflare also processes data for its own service/security purposes. Provider retention and international processing are governed by its privacy policy and applicable service terms; no fixed provider retention period is claimed here. The publisher keeps no separate visitor-identity database. Necessary security cookies may be set when a Cloudflare security feature is invoked; see its cookie documentation.

Downloads and issues: these links take you to GitHub, which processes request/account data under its privacy statement. Issue posts may be public. Do not post passwords, exam content, identity documents or private diagnostic details.

Email support: the publisher receives your address, message and any attachments you choose to send through Google, the email provider. Processing is based on legitimate interest in answering requests and maintaining the software. Correspondence is kept only while needed to resolve and follow up the issue or establish, exercise or defend legal claims; irrelevant personal attachments should be removed when no longer needed. Provider backups, security records and international processing follow its privacy policy and applicable safeguards. Do not send sensitive files unless necessary.

10. Why your antivirus may complain

Brutal Focus installs a keyboard hook, edits the hosts file with elevation, blocks task-switching keys and forces its own window on top. Every one of those is what the product does on purpose — and in combination they resemble the behaviour of malware closely enough that heuristic scanners sometimes flag it.

The installer is not code-signed. Windows SmartScreen or antivirus software may warn about it. A checksum verifies that the file matches the published release; it is not a security certification.

We would rather you verified this than trusted us: every release publishes a SHA-256 checksum, and you can submit the installer to VirusTotal for an independent opinion.

11. Children

Brutal Focus is not directed at children under 13. There are no child accounts or advertising profiles. Contact the publisher to request removal of a child's personal information from support correspondence.

12. Changes

If this policy changes, the date at the top changes with it. The app has no account, so checking this page is the only mechanism.

13. Contact

Publisher and controller for the website and support purposes described here: the Brutal Focus project. Privacy, support and confidential security reports: brutalfocussupport@gmail.com. Ordinary bug reports: GitHub issues.

You may request access, correction, deletion, restriction or object to processing of data held by the publisher, where these rights apply. Portability applies only where its legal conditions are met. Privacy requests normally receive a response within one month; lawful extensions will be explained. You may complain to the Garante per la protezione dei dati personali or your competent supervisory authority. Support data is optional; without enough information the publisher may be unable to answer. Website and support data are not used for profiling or automated decisions with legal or similarly significant effects.