Privacy
Carve is a beta focus app (Pentastell). Last updated 13 August 2026.
Straight talk
We do collect and store data. Some of it lives only on your device. Some is stored on our servers — either as encrypted ciphertext we cannot read, or as account / anonymous product metrics described below. That is normal for a syncing app. We do not pretend otherwise.
How we operate (stakeholder / ESG posture)
- Environment — Core Focus is local-first (less default cloud). No ad trackers.
- Social — Focus-as-wellbeing, not hustle. Mood + enjoyment checks are optional anonymous product signals, never tied to task titles.
- Governance — Plain language here. Sync ciphertext we cannot read. Depth features unlock with use, or you can unlock early — Focus stays free either way.
What we collect & store
- On your device — tasks, goals, notes, session history (browser local storage). Your Export backup file is yours to keep.
- Encrypted sync (when you sign in and turn sync on) — data is encrypted on your device first (AES-256-GCM). We store only ciphertext in our database. We cannot decrypt your tasks. Lose your passphrase and we cannot recover it; an optional recovery code is shown once when you set sync up.
- Account — if you join / sign in, we store the email (and name if you provide it) to authenticate you and send login / beta email.
- Anonymous product metrics — on by default in the beta (one-tap opt-out). Content-free numbers only: time spent, mood scores, done/not-done counts, day-of-week, similar signals. No task titles, no notes, no name linking those events to your account. Used to improve Carve.
What we don’t do
We don’t sell your data, run third-party ad trackers, or read synced task content (we only hold ciphertext). Signup bot checks use Cloudflare Turnstile when configured.
Who processes it
App hosting and API: Cloudflare (Pages, Workers, D1). Transactional email: Resend and/or Cloudflare Email Sending (when configured), for magic links / beta mail only.
Your choices
- Turn “Share anonymous insights” off in Account → Preferences (full app).
- Delete synced cloud data in Account → “Delete cloud data”.
- To remove your email from the beta list, email help@pentastell.com.