Effective Date: March 25, 2026 | Last Updated: May 8, 2026
Mile High Software Solutions LLC ("we", "our", or "us") operates the Focal Point Productivity application ("the App"). This Privacy Policy explains how we collect, use, store, and protect your information when you use our App.
Focal Point is a productivity application designed for individuals, households, families, and small businesses. The App allows users to create tasks, notes, projects, and documents, and to share content with other users.
We limit the collection of personal data to what is necessary to provide and improve the App.
We collect the following categories of information:
When you connect a Google account, we request the following scopes:
https://www.googleapis.com/auth/calendar.readonly) — read-only access to your calendar events: titles, dates, times, locations, and attendee information.https://www.googleapis.com/auth/youtube.readonly) — read-only access to your YouTube subscriptions and video metadata (titles, thumbnails, channel info).Both scopes are optional. You can use Focal Point without either integration. Each scope can be connected or disconnected independently.
How tokens are stored. When you connect, Google issues an OAuth refresh token. We exchange it server-side (via a Cloud Function) and store it in Firestore under your Firebase user ID (users/{your_uid}/integrations/google). The refresh token never leaves our backend — client apps never see it, and it is scoped to your Firebase account, not to your device. Access tokens used to make API calls are generated on demand by a Cloud Function and returned to the app short-lived.
For users in the European Economic Area (EEA), we process your data under the following legal bases:
| Processing Activity | Legal Basis |
|---|---|
| Account creation and authentication | Contract performance |
| Storing and syncing your content | Contract performance |
| Third-party integrations (Calendar, YouTube) | Consent (opt-in) |
| Contacts access (friend discovery, attendee suggestions) | Consent (device permission prompt) |
| Phone number (friend discovery) | Consent (optional, user-provided) |
| Crash reporting and operational usage logging | Legitimate interest |
| Push notifications | Consent (opt-in via device settings) |
| Security and fraud prevention | Legitimate interest |
| Marketing communications | Consent (opt-in) |
We use the following third-party service providers to operate the App. Each provider processes data on our behalf under appropriate data processing agreements:
| Provider | Purpose | Data Processed |
|---|---|---|
| Google Firebase | Authentication, database, storage, hosting | All user data |
| Google Gemini API | AI features (search, chat assistant, receipt scanning, suggestions) | Content you submit to AI features |
| Firebase Crashlytics | Crash reporting | Error logs, device info |
| Apple (App Store) | Authentication, payments | Apple ID, subscription status |
| Google (Play Store) | Authentication, payments | Google account, subscription status |
| Google Calendar API | Calendar integration | Calendar events (read-only) |
| YouTube Data API | Video previews | Video metadata |
Google's Data Processing Terms apply to Firebase services. For details, see Firebase Data Processing Terms.
AI features (Google Gemini API): Content you submit to AI features — including messages you send to the Ask Focal Point assistant and the snapshot of app data needed to answer them — is processed by the Google Gemini API on a paid service tier. Under that tier, Google does not use this content to train or improve its models and retains it only for a limited period solely to detect and prevent abuse. See Google's Gemini API Terms ("How Google Uses Your Data").
Storage Location: Your data is stored on Google Cloud/Firebase infrastructure primarily in the United States (us-central1 region).
International Transfers: If you are located outside the United States, your data will be transferred to and processed in the United States. For users in the EEA, UK, or Switzerland, these transfers are protected by:
For more information, see Google Cloud GDPR Compliance.
| Data Type | Retention Period |
|---|---|
| Account and user content | Until you delete your account |
| Cached integration data | Deleted immediately when you disconnect a service |
| AI usage & cost logs, crash reports | Retained for operational cost analysis and bug fixing; crash data per Firebase Crashlytics defaults |
| Server logs (IP addresses) | Up to 30 days |
| Backups | Automatic infrastructure-level backups are managed by Google Cloud per their standard retention schedule. We do not maintain separate backups beyond this. |
| Inactive accounts | Free-tier accounts with no sign-in activity for 24 consecutive months are permanently deleted. See the Account Inactivity section below for the full policy. Accounts with an active Premium subscription are exempt from inactivity deletion. |
To keep our service efficient and to reduce the personal data we retain, we permanently delete free-tier accounts that have been inactive for an extended period.
Shared projects. A shared project is preserved as long as at least one of its administrators is not subject to inactivity deletion — that is, an administrator who is either a Premium subscriber or a free-tier user who has signed in within the last 24 months. A shared project is only deleted when every one of its administrators has themselves been deleted for inactivity. When you are deleted, references to your account are removed from any project you belonged to, whether the project is preserved or deleted.
Trip expense history. When you participate in a trip's expense tracking, your display name and email at the time of each entry are recorded on that entry. These records are preserved as a historical financial record even after your account is deleted. Past entries continue to show the name you used at the time, with a "deleted account" indicator beside the name. Existing settlement calculations are not recalculated.
When you delete your account (or your account is deleted for inactivity):
https://oauth2.googleapis.com/revoke) with your stored refresh token and deletes our stored credential record. This happens before your Firebase account itself is deleted, so the revoke call has the auth context it needs. After deletion, Focal Point no longer has any access to your Google account, and your cached YouTube data is deleted along with the rest of your account data.To delete your account, go to Settings > Account > Delete Account, or contact us at support@milehighsoftwaresolutions.com.
Focal Point allows you to share projects, tasks, notes, and whiteboard pages with other users.
Individual notes can be shared directly with specific users. Shared notes are read-only for recipients — only the note owner can edit or delete a directly-shared note. To collaborate on a note with edit access, place it inside a shared project and grant Editor permission at the project level.
Whiteboard pages (sticky-note boards) are shared at the page level. Individual sticky notes inherit the page's sharing settings; you cannot share a single sticky note independently.
Warning: Be cautious about sharing content containing sensitive personal information. You are responsible for obtaining appropriate consent before sharing content that contains others' personal data.
When you share content with other users, you are responsible for the personal data contained within that content, including ensuring you have the necessary rights and consents to share such information. We act as a service provider facilitating this sharing and do not control the content users choose to share.
https://www.googleapis.com/auth/calendar.readonly.https://www.googleapis.com/auth/youtube.readonly.users/{your_uid}/youtubeData). This cached data is read only by you. OAuth credentials are handled identically to Calendar (see above): refresh token held in Firestore, accessible only via Cloud Functions; client apps never hold it.You can disconnect integrations at any time in Settings.
Focal Point's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, we affirm that data obtained from Google APIs (including your Google Calendar events and YouTube subscription data) is used solely to provide user-facing features within Focal Point:
You can revoke Focal Point's access to your Google account at any time from within the app (Settings → Integrations → Disconnect Calendar or Disconnect YouTube) or directly at Google Account Permissions. When you revoke access — either in-app or via Google — we delete the OAuth credential record and any cached data associated with that integration within our normal processing window.
You may optionally provide your phone number in your profile to help friends find you on Focal Point. Your phone number is:
If you remove your phone number, you will no longer be discoverable by phone number.
With your permission, Focal Point can access your device contacts for two purposes:
When you use the friend discovery feature:
When you use contacts for calendar attendee suggestions:
You can revoke contacts permission at any time in your device settings (Settings > Focal Point > Contacts on iOS, or Settings > Apps > Focal Point > Permissions on Android). Revoking permission does not affect any other app functionality.
If your Premium subscription lapses and your stored documents exceed the free plan 250 MB limit, you enter a 90-day download grace period:
You can stop the process at any time before day 90 by deleting documents to bring your total under 250 MB, or by resubscribing to Premium. Notes, tasks, projects, bookmarks, and other non-document content are not affected at any stage; your account itself stays fully active.
Inherited overage from transferred content. If another user transfers project ownership to you (for example, when a collaborator deletes their account) and the inherited content pushes you above your storage cap, the same 90-day grace period and day-90 cleanup apply. There is no separate carve-out for inherited content; the limit and the process are the same regardless of how the content arrived in your account.
Documents within shared projects are not counted toward your personal storage quota. See Shared Project Data Access below for details on shared project documents.
Focal Point projects support collaboration between multiple users. Editing project content (tasks, documents, sticky notes, kanban boards, and notes) requires an active Premium subscription.
Editing within a shared project requires at least one project administrator with an active Premium subscription. If all project administrators' subscriptions lapse:
You may always:
Local Sync allows you to sync documents to a folder on your device:
Security Note: Local Sync is provided for convenience. If you store sensitive documents, ensure your device has appropriate security controls (encryption, access controls).
We implement industry-standard security measures:
users/{uid}/integrations/google). The refresh token is never transmitted to the app; client apps receive only short-lived access tokens on demand. You can revoke tokens at any time from Settings, and we also call Google's revocation endpoint when you disconnect a service or delete your account.Note: Documents are encrypted at rest on our servers but are not end-to-end encrypted. We (the service operator) have technical ability to access user content for support and legal compliance purposes, though we do not routinely access user content.
To enable offline use, Focal Point keeps a local copy of your data (notes, tasks, projects, expenses, trip data) on your device. This local cache:
Desktop users: if you keep sensitive content in Focal Point, we strongly recommend enabling full-disk encryption — FileVault on macOS (System Settings → Privacy & Security) or BitLocker / Device Encryption on Windows (Settings → Privacy & security). Sign out on shared machines so the local cache is cleared.
In the event of a data breach that affects your personal data:
Security concerns can be reported to support@milehighsoftwaresolutions.com.
We may disclose your information if required to do so by law, subpoena, or other legal process, or if we believe such action is necessary to:
Focal Point is a general-purpose productivity tool. While you may store various types of content, we recommend:
We collect a limited amount of operational data to keep the App reliable and sustainable:
We do not use Firebase Analytics, advertising identifiers, or any third-party cross-app tracking. This operational data is used only to run and improve the App, never for advertising.
Premium subscriptions are processed through:
We do not collect, store, or process payment card information. All payment processing is handled directly by Apple or Google. We only receive confirmation of subscription status.
We do not knowingly collect personal data from children under 13 (or 16 in the EEA). Users must be at least 13 years old to create an account independently.
Families may share access to Focal Point through Apple Family Sharing or Google Play Family Library, which are managed by the respective platform. Parents or guardians using these features are responsible for supervising their children's use of the App and consent to the processing of their data as described in this policy.
If you believe a child under 13 has created an account independently, please contact us immediately at support@milehighsoftwaresolutions.com and we will delete the account.
Depending on your location, you have the following rights:
You can exercise most rights directly in the App (Settings > Account). For formal requests:
There is no fee for reasonable requests. We may decline requests that are manifestly unfounded or excessive.
If you are a California resident, you have additional rights:
We Do Not Sell or Share Your Personal Information for cross-context behavioral advertising or other purposes that would constitute a "sale" or "share" under California law.
Do Not Track: The App does not respond to "Do Not Track" signals from browsers or devices.
To submit a request, email support@milehighsoftwaresolutions.com with subject line "California Privacy Request."
If you are located in the EEA, UK, or Switzerland:
We may send you marketing communications about new features or offers if you have opted in. You can opt out at any time by:
Opting out of marketing does not affect transactional emails (account confirmations, security alerts, subscription receipts).
We may update this Privacy Policy from time to time. We will notify you of material changes by:
Continued use of the App after changes constitutes acceptance of the updated policy. For significant changes, we will provide at least 30 days notice before the changes take effect.
In the event of a merger, acquisition, restructuring, or sale of assets, user information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice in the App before your personal data becomes subject to a different privacy policy.
If you have questions about this Privacy Policy or our data practices:
Mile High Software Solutions LLC
2057 Arroyo Ct
Windsor, CO 80550
United States