Kosmonia: Focus OS with an RPG mode for your real life

This Privacy Policy explains how Kosmonia ("we", "us"), operated by MoZayed (Cairo, Egypt), collects, uses, shares, and protects personal data when you use our website and application (the "Service"). It is written to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, and Egypt's Personal Data Protection Law No. 151 of 2020 (PDPL).

Data Controller: MoZayed (Kosmonia), Maged Sabar St., Shamal Tura, Maadi, Cairo 11729, Egypt · info@mo-zayed.com

1. Personal data we collect

Account data: email address, display name, avatar URL, authentication identifiers (including Google OAuth subject ID if you sign in with Google).
Profile preferences: theme, experience mode, keyboard shortcuts, custom theme colors, subscription tier, trial state.
Productivity data you create: tasks, quests, campaigns, journeys, focus sessions, reflections, sound profiles, achievements, XP, stats.
Billing data: Polar customer ID, subscription status, plan name, order history (we never see or store your full card number; this is processed by Polar.sh as Merchant of Record).
AI usage data: prompts you submit to AI features and the resulting outputs (stored only as needed to display in your account, e.g. daily briefings).
User-supplied AI API keys (optional, for advanced users): stored encrypted server-side and used only to serve your own requests.
Live session data: session codes, participant display names, join/leave timestamps for collaborative focus rooms you create or join.
Technical data: IP address, browser/device info, language, approximate location derived from IP, log timestamps. Used for security, abuse prevention, and basic analytics.
Cookies & local storage: session tokens (Supabase Auth), preferences (theme, persisted UI state). We do not use advertising or cross-site tracking cookies.

We do not knowingly collect data from children under 16.

2. How and why we use your data (legal bases)

Purpose	Legal basis (GDPR Art. 6)
Providing the Service, syncing your data across devices	Performance of contract (Art. 6(1)(b))
Processing payments and renewals	Performance of contract; legal obligation (Art. 6(1)(b),(c))
Sending account, security, and billing emails	Performance of contract; legitimate interest (Art. 6(1)(b),(f))
Security, fraud and abuse prevention, debugging	Legitimate interest (Art. 6(1)(f))
Improving the product (aggregated, non-identifying analytics)	Legitimate interest (Art. 6(1)(f))
Marketing emails about new features (only if you opt in)	Consent (Art. 6(1)(a))
Complying with tax, accounting, and legal obligations	Legal obligation (Art. 6(1)(c))

3. Sub-processors and recipients

We share personal data only with the following sub-processors, each bound by data-processing terms:

Provider	Purpose	Region
Supabase Inc.	Database, authentication, file storage, edge functions	EU / US
Polar Software Inc.	Payment processing as Merchant of Record	US / EU
Resend, Inc.	Transactional email (auth, billing notifications)	US / EU
Lovable / Lovable AI Gateway	App hosting and default AI inference	EU / US
Google LLC (OAuth & optional Gemini)	Sign-in with Google; AI inference if you enable Google as your AI provider	US
OpenAI / Anthropic (optional)	AI inference if you supply your own API key	US

We do not sell your personal data, and we do not share it for cross-context behavioral advertising.

4. International data transfers

Some sub-processors are located outside the EEA, the UK, or Egypt. Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and equivalent measures under Egyptian PDPL.

5. Retention

Account, profile, and productivity data: retained while your account is active.
After account deletion: removed from our active systems within 30 days; encrypted backups are rotated within 90 days.
Billing records and invoices: retained for up to 7 years as required by tax and accounting law.
Security and audit logs: typically retained 90 days.
Webhook idempotency records: retained for operational integrity, no personal content.

6. Your rights

Subject to applicable law, you have the right to:

Access the personal data we hold about you.
Rectify inaccurate or incomplete data (most fields are editable in Settings).
Erase your data ("right to be forgotten").
Restrict or object to certain processing.
Data portability: receive your data in a machine-readable format.
Withdraw consent at any time (where processing is based on consent).
Lodge a complaint with your local data-protection authority (in the EU, your national DPA; in Egypt, the PDPC under PDPL Law 151/2020).

To exercise any of these rights, email info@mo-zayed.com from your account email. We respond within 30 days.

7. Security

We use industry-standard safeguards: TLS 1.2+ in transit, encryption at rest by our cloud providers, row-level security policies on all sensitive tables, hashed passwords (managed by Supabase Auth), server-side encryption of user-supplied AI API keys, webhook signature verification, idempotency controls, and least-privilege access for administrators. No system is 100% secure; you are responsible for keeping your password and login confidential.

8. AI-specific notes

Prompts and outputs are processed by the AI provider you (or we, by default) configure.
We do not use your prompts or outputs to train AI models, and we contractually require our default AI provider not to do so either.
Do not submit personal data of others, regulated data (medical, financial, legal), or confidential information into AI prompts.

9. Cookies and similar technologies

We use only strictly-necessary cookies and local storage entries (authentication tokens, theme preference, persisted UI state). We do not use advertising cookies, cross-site trackers, or third-party analytics SDKs that profile users individually. Because we use only essential storage, no consent banner is required under ePrivacy for these specific items; if we add optional analytics in the future, we will request consent first.

10. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

11. California residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you additional rights:

Right to know: the categories and specific pieces of personal information we have collected about you (covered in Section 1).
Right to delete and right to correct your personal information.
Right to opt out of sale or sharing: we do not sell your personal information, and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of.
Right to limit use of sensitive personal information: we do not collect sensitive personal information as defined by the CPRA.
Right to non-discrimination: we will not treat you differently for exercising any of these rights.

Exercise these rights by emailing info@mo-zayed.com from your account email. We verify requests against your account and respond within 45 days.

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date reflects the latest version. Material changes will be notified by email or prominent in-app notice before they take effect.

12. Contact

Privacy / data-protection requests: info@mo-zayed.com
Postal: MoZayed (Kosmonia), Maged Sabar St., Shamal Tura, Maadi, Cairo 11729, Egypt

This document was prepared in good faith to reflect the actual data flows in Kosmonia, but it is not legal advice. We recommend you have it reviewed by qualified counsel in your jurisdiction before relying on it commercially.