Privacy Policy
Last updated: May 25, 2026
1. Overview
Eylax ("we", "our", or "us") operates the Eylax web application at https://eylax.asia and the Eylax Focus Guard Chrome extension (collectively, the "Service"). This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.
By using the Service you agree to the practices described in this policy.
2. Information We Collect
2.1 Account information
When you sign in with Google or another OAuth provider we receive your email address, display name, and profile picture from that provider. We store these to identify your account.
2.2 Focus & break session data
We record the start time, duration, and mode (Pomodoro / custom / break) of each focus session you complete, as well as break logs and eye-exercise completions. This data powers your personal analytics and weekly recap.
2.3 Chrome extension — blocked-site events
When the Eylax Focus Guard extension blocks a website during an active session it sends a lightweight event to our API containing:
- The hostname of the blocked site (e.g.
facebook.com) - The timestamp the block occurred
- An anonymous session ID generated locally for that session
We deduplicate events per host per session — only the first block for a given site within a single focus session is recorded. No page content, URLs beyond the hostname, cookies, or browsing history are ever collected or transmitted.
2.4 Blocked sites list
The list of websites you choose to block is stored in chrome.storage.sync locally in your browser and synced via Chrome's built-in sync infrastructure. We do not store your blocked sites list on our servers.
2.5 Calendar data
If you connect Google Calendar we read your upcoming events solely to show meeting-aware break reminders. We do not store event content — only the presence and timing of events to schedule notifications.
2.6 Usage & analytics
We use Vercel Analytics and Google Analytics 4 to collect anonymised page-view and performance data (pages visited, country, device type). No personally identifiable information is sent to these services.
3. How We Use Your Data
- To authenticate you and maintain your account
- To display your personal focus history, streaks, and weekly recap
- To generate AI-powered coach insights (if you opt in)
- To send weekly recap emails (if you opt in)
- To schedule break reminders around your calendar meetings
- To improve the product through aggregate, anonymised analytics
We do not sell your data to third parties.
4. Data Storage & Security
Your account and session data are stored in a PostgreSQL database hosted on Supabase (EU region). We use row-level security so your data is accessible only to your own account. All data is transmitted over HTTPS.
The Chrome extension stores your blocked-sites list in chrome.storage.sync. This data is managed by Chrome and subject to Google's Chrome Sync privacy policy.
5. Data Retention
We retain your account and session data for as long as your account is active. You may delete your account at any time from the Settings page, which permanently erases all associated data from our systems within 30 days.
Blocked-site events are retained for 12 months for analytics purposes, after which they are automatically purged.
6. Third-Party Services
| Service | Purpose | Data shared |
|---|---|---|
| Supabase | Database & authentication | Account & session data |
| Google OAuth | Sign-in | Email, name, avatar |
| Google Calendar API | Meeting-aware reminders | Event timing only |
| OpenAI | AI coach insights (opt-in) | Anonymised session stats |
| Vercel Analytics | Performance monitoring | Anonymised page views |
| Google Analytics 4 | Usage analytics | Anonymised events |
7. Your Rights
Depending on your location, you may have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Opt out of non-essential analytics
- Data portability (export your session history)
To exercise any of these rights, email us at [email protected].
8. Children's Privacy
The Service is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated policy.
10. Contact
If you have questions about this Privacy Policy or your data, contact us at: