Privacy Policy

Last updated: October 24, 2026

Pop Focus is a desktop application published by Laudenslager Software, LLC, a Pennsylvania limited liability company ("we", "us"). This policy explains what Pop Focus accesses, how it is used, where it is stored, and whether it is shared. The short version: your calendar data stays on your computer, and we do not receive it.

1. Summary

• Pop Focus reads your calendar events on your computer to show reminders.
• We do not operate any server that receives your calendar data, Google sign-in tokens, or Google account email address. If you sign up for release updates, we receive the email address you type into that form (section 11).
• Entering a license key performs an activation that sends our licensing server the license's ID, a one-way hash of your computer's identifier, and one-way hashes of a few of your computer's hardware identifiers, so a seat stays with your computer when you reinstall or replace a part. It sends nothing about your calendars (section 12).
• Pop Focus checks for new versions only when you press Check for updates or switch on the daily check, and a check is an ordinary web request to popfocus.lauden.dev that carries nothing about you (section 13).
• We do not sell, share, or transfer your Google user data to anyone, and no person at our company can see it.
• We collect no analytics, advertising identifiers, or crash reports.
• Your sign-in tokens are encrypted by your operating system, all communication with Google uses HTTPS, and event data is kept in memory only (section 5).
• You can disconnect and delete everything at any time (section 9).

2. Google user data Pop Focus accesses

If you choose "Sign in with Google", Pop Focus requests these permissions. Each is read-only.

Pop Focus cannot create, change, or delete events or calendars, and does not access Gmail, Drive, Contacts, or any other Google service.

3. How the data is used

Google user data is used only to provide the features visible in the app: detecting upcoming meetings, showing the reminder, and letting you pick calendars. It is not used for advertising, profiling, analytics, or training any machine learning model.

4. Where the data is stored

• Sign-in tokens are stored in your operating system's secure credential store (Windows Credential Manager, macOS Keychain, or the Linux Secret Service).
• Settings, including your connected account's email address and which calendars you selected, are stored in a configuration file in your user profile on your computer.
• Event data is fetched about once a minute and held in memory while the app runs. Pop Focus does not keep a long-term copy of your events.
• License and trial files are stored in the Pop Focus configuration folder in your user profile: your license key, the fingerprint the licensing server accepted, the hardware hashes that activation used, and your free trial record, a signed token from our licensing server (section 12).
• Logs kept on your computer stay on your computer and are never uploaded. They may contain error messages returned by Google, Microsoft, Apple or Zoho.

5. How we protect your data

Pop Focus treats your calendar data and sign-in credentials as sensitive data and protects them as follows.

• No servers of ours. Pop Focus connects directly from your computer to Google (and to Microsoft, Apple or Zoho, if you connect an Outlook, iCloud or Zoho calendar). Your calendar data, sign-in tokens, and Google account email address are never sent to, stored on, or processed by any server operated by us.
• Encryption in transit. All communication between Pop Focus and Google, Microsoft, Apple or Zoho uses HTTPS (TLS 1.2 or later).
• Secure sign-in. Sign-in uses the OAuth 2.0 flow for installed applications with PKCE (Proof Key for Code Exchange, S256). The sign-in response is received on a temporary listener bound only to your own computer (127.0.0.1), which closes when sign-in completes. Pop Focus never sees or stores your Google, Microsoft or Zoho password. Apple works differently; see section 8.
• Encrypted credential storage. The only credential kept between sessions is the OAuth refresh token. It is stored in your operating system's secure credential store (macOS Keychain, Windows Credential Manager, or the Linux Secret Service, such as GNOME Keyring or KWallet), which encrypts it at rest and restricts it to your user account. Short-lived access tokens are kept in memory only and are never written to disk.
• Calendar data kept in memory only. Event details (titles, times, and meeting links) are held in memory only while Pop Focus is running and are never written to disk or to logs. The settings file contains only your preferences, your connected account's email address, and the IDs of the calendars you selected.
• Least privilege. Pop Focus requests only the read-only permissions listed in section 2. It cannot create, change, or delete events or calendars.
• Minimal logging. Diagnostic logs stay on your computer, never include event titles or other calendar content, and mask email addresses.
• No third-party code with access to your data. Pop Focus contains no analytics, advertising, or tracking components, and no person at our company can see your Google user data.
• Deletion. Removing an account in Settings deletes its sign-in token from your operating system's credential store and its email address and calendar choices from your settings file (section 9).
• Reporting a security issue. Email hello@lauden.dev. We investigate every report and will notify affected users of any incident involving their data as required by law.

6. Sharing and transfer

Pop Focus communicates directly between your computer and Google's servers. We do not transfer, sell, or share Google user data with any third party, and we do not receive a copy. The app contains no third-party analytics, advertising, or tracking components.

7. Google API Services User Data Policy

Pop Focus's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Microsoft (Outlook), Apple (iCloud), Zoho and .ics calendars

If you connect a Microsoft account (Outlook.com, Microsoft 365 work or school), Pop Focus requests read-only permissions: Calendars.Read to read upcoming events on the calendars you choose in Settings, User.Read to read your account's email address so the account can be labeled in Settings, and offline_access to stay signed in. Events are fetched directly from Microsoft's calendar service to your computer; sign-in tokens are held in your operating system's credential store; nothing is sent to us. The protections in section 5 apply to Microsoft data in the same way. You can revoke access at any time in your Microsoft account's app permissions, or with Remove in Pop Focus Settings. If you load an .ics file, it is read locally and nothing is sent anywhere.

If you connect an Apple (iCloud) calendar, Apple offers no sign-in window for calendars, so you enter your Apple ID and an app-specific password that you create at appleid.apple.com. Pop Focus uses the standard CalDAV protocol, only to read the titles, times and meeting links of upcoming events from your iCloud calendars; it never creates, changes or deletes anything. Events are fetched directly from Apple's servers to your computer. Pop Focus stores the app-specific password (never your main Apple ID password) in your operating system's credential store and sends it only to Apple's iCloud servers. You can revoke it at any time at appleid.apple.com under Sign-In and Security, App-Specific Passwords, or remove the account in Pop Focus Settings. The protections in section 5 apply in the same way.

If you connect a Zoho account (Zoho's US data center), Pop Focus requests read-only permissions: ZohoCalendar.calendar.READ and ZohoCalendar.event.READ to read your calendars and upcoming events, and AaaServer.profile.READ to read your account's email address so the account can be labeled in Settings. Events are fetched directly from Zoho's calendar service to your computer; sign-in tokens are held in your operating system's credential store; nothing is sent to us. You can revoke access at any time in your Zoho account's connected apps settings, or with Remove in Pop Focus Settings.

9. Your choices: revoke and delete

• In the app: open Settings and choose Remove next to the account. This deletes the stored sign-in token and that account's saved calendar choices from your computer.
• At Google: visit myaccount.google.com/permissions, choose Pop Focus, and select "Delete all connections". This revokes access immediately.
• Uninstalling Pop Focus removes the program; you can also delete its configuration folder to remove any remaining settings.

Because we hold no copy of your data, there is nothing on our side to delete.

10. Website

This website does not use cookies or analytics. It has two forms: the Buy form sends the number of devices you choose to shop.lauden.dev when you press Buy, and the update sign-up form sends the email address you enter (section 11). Our web host may keep standard server logs (such as IP address and requested page) for security and operations. Purchases are handled at shop.lauden.dev, which has its own notices for order information.

11. Release and update list

If you enter your email address in the update sign-up form on our homepage, we store that address, the time you signed up, and that you signed up for Pop Focus. We use it only to send you a confirmation email, and then to tell you about new Pop Focus releases and updates. We do not sell or share it, and we do not combine it with any Google user data. Google user data never enters this list.

• Confirmation. You are added to the list only after you click the link in the confirmation email.
• Where it is stored. In the database behind our shop at shop.lauden.dev, which is operated by Laudenslager Software, LLC.
• Service provider. Our email delivery provider, Resend, processes your address only to deliver our emails.
• Unsubscribe or delete. Every announcement includes an unsubscribe link, which stops all email to that address. To have your address deleted entirely, email hello@lauden.dev.

12. License key and activation

Pop Focus is sold with a license key. The key is checked on your computer against a public key built into the app. Pop Focus includes a 14-day free trial, one per computer, described below.

When you start the free trial in Settings, Pop Focus contacts our licensing server at quartermaster.lauden.dev once. The request contains:

• the product code (POPF);
• the same fingerprint described below: a one-way SHA-256 hash of your operating system's machine identifier combined with the product code; and
• if you are updating from a version that kept the trial only on your computer, the date that local trial began.

When you start a free trial, Pop Focus reads a few identifiers of your computer's hardware: on Windows the system UUID and the serial numbers of the system and mainboard from the firmware's SMBIOS table, on macOS the hardware UUID and serial number, and on Linux the names of your internal disks and the system UUID when it is readable. If a computer offers none of these, Pop Focus uses the operating system's machine ID instead. Each identifier is combined with the product name and turned into a one-way SHA-256 hash on your computer, and only the hashes are sent, so we never receive the identifiers themselves. The server records the product, those hashes (at most 16 per trial), the trial's start and end dates, and the time of the record, and returns a signed trial token. Pop Focus saves the token and the hashes on your computer and checks them there. This is how we offer one free trial per computer: reinstalling Pop Focus or your operating system, or replacing a part, brings back the original trial instead of starting a new one. Pop Focus contacts the server again only if the computer's hardware changes and it needs to register the new identifiers. Our server's logs record the trial's number and how many hashes were sent, not the hashes, and like any web server they see the IP address that connects. No calendar data, Google data, name, or email address is part of the request. Trial records made by Pop Focus 0.1.11 and earlier used a single fingerprint of the computer; we delete them once those versions have updated. We keep a trial record for as long as it is needed to enforce one trial per computer. To have it deleted, email hello@lauden.dev; deleting it means that computer could start a new trial.

When you enter a license key, Pop Focus performs an activation by contacting our licensing server at quartermaster.lauden.dev. The request contains:

• your license key, which encodes a license ID, the product, and the version it covers (it does not contain your name or email address);
• a fingerprint: a one-way SHA-256 hash of your operating system's machine identifier combined with the product code. We cannot reverse it to recover the identifier; and
• one-way hashes of a few hardware identifiers of your computer, made as described for the free trial above.

The hardware hashes are made on your computer exactly as for the free trial: from the same identifiers, each combined with the product name and turned into a one-way SHA-256 hash, and only the hashes are sent (at most 16 are kept per seat). We never receive the identifiers themselves.

We store the license ID, the fingerprint, the hardware hashes, and the activation time for as long as the license exists, to enforce the number of devices your purchase includes. Each hardware hash is combined once more with the license ID in a further one-way hash before it is stored, so it cannot be matched against free-trial records. The hashes are also how a seat stays with your computer: reinstalling your operating system or replacing a part keeps the seat as long as some of the hardware identifiers are unchanged, and a different computer cannot take it. Our server's logs record the license ID and fingerprint of each activation request and how many hashes were sent, not the hashes, and like any web server it sees the IP address that connects. No calendar data, Google data, or email address is part of the request.

After you enter your key, Pop Focus contacts the licensing server again only in these cases: once in the background after an update to a version that sends hardware hashes, if your key was activated by an earlier version; when your computer's hardware changes and the new identifiers need to be registered; and when you choose "Deactivate this device" in Settings, which sends the same items to free the seat, and removes the seat together with its hashes. If you need a seat reset, for example after replacing your whole computer, email hello@lauden.dev; resetting deletes the seat record along with its hashes.

The Lauden launcher, an optional downloader published at github.com/laudendev/launcher, sends two of those items (your license key and fingerprint, without hardware hashes) to quartermaster.lauden.dev to download your installer, and that request counts as the activation for the computer it runs on; Pop Focus sends the hardware hashes when you enter your key in it. It also sends the name of your operating system (Windows, macOS or Linux) so the right installer is returned, and saves the downloaded file in your Downloads folder.

Your purchase itself (email address, payment, and tax) is handled at shop.lauden.dev by Stripe and our store under that site's notices. Our email provider, Resend, delivers your receipt and license key.

13. Checking for new versions

Pop Focus never checks for new versions on its own unless you switch that on. In Settings, Software updates, the Check for updates button checks when you press it, and a switch, off by default, makes Pop Focus check once a day in the background and show one notice for each new version. Nothing is downloaded or installed without your click.

A check asks popfocus.lauden.dev for two small files: the list of released versions and its digital signature. The request does not contain your license, your computer's hardware or fingerprint, your calendars, or the version of Pop Focus you run. Like any web request it shows our web host your IP address and the time, and the host may keep standard server logs (section 10). Pop Focus verifies the signature on your computer against a public key built into the app and ignores a list that does not match.

When you choose a version, Pop Focus downloads that version's installer from popfocus.lauden.dev, checks its size and SHA-256 hash against the signed list, and deletes it if they do not match. Before an update or a switch to another version, Pop Focus copies the files in its configuration folder (settings, license and trial files) into a backups folder inside that folder and keeps the three newest copies; calendar sign-in tokens are stored elsewhere and are not copied. Leftover downloads are deleted the next time Pop Focus starts once they are an hour old, and before each new update. On Linux, installing asks for administrator permission through your system's usual prompt. The background switch is saved in your Pop Focus settings file.

14. Children

Pop Focus is not directed at children under 13 and we do not knowingly collect their information.

15. Changes

If Pop Focus changes how it handles Google user data, for example by adding an optional sync service, we will update this policy before the change takes effect and post the new date above.

16. Contact

Laudenslager Software, LLC, Pennsylvania, USA. hello@lauden.dev.