Privacy Policy &
Terms of Service

What We Collect

Undistracted Me is designed to keep your data on your device.

Data that stays on your device

• Widget layout, sizes, and positions.
• Widget-specific settings (clock timezones, weather city, stock tickers, etc.).
• Focus Mode preferences (background choice, enabled widgets, panel settings).
• Nepali calendar preferences and display language.
• Any notes you write in the Notes widget.
• Pomodoro and timer history.

Data passed through our Vercel proxy

Some API calls are routed through our backend at undistractedme.sarojbelbase.com.np so that secret API keys are never embedded in the extension bundle. These calls are:

• Unsplash photos — a random background photo is fetched. No personal data is sent. The response is a photo URL.
• Google token exchange (Firefox only) — the OAuth authorisation code is exchanged for tokens server-side so the client_secret never leaves our server. The token is returned to your browser immediately and not stored by us.
• Favicon proxy — a website domain name is sent to fetch its icon. No session or identity data is included.

Our proxy does not log user-identifiable information. Standard web-server access logs (IP address, timestamp, HTTP method) may be retained for up to 30 days by our hosting provider (Vercel) for security and abuse-prevention purposes.

Geolocation

The Weather widget can optionally use your location to show local weather. The browser prompts you for permission before any coordinates are read. Coordinates are sent directly to Open-Meteo (a privacy-respecting, open-source weather service) and are never stored or sent to us. If you decline, you can enter a city name manually.

As a last resort when neither browser geolocation nor a manual city is available, the extension may call a public IP-based geolocation service (freeipapi.com for extension origins; ipapi.co additionally in website mode). Only your IP address is sent; no personal identifier is stored. Both domains are declared in the extension’s host_permissions and are only contacted for this fallback purpose.

Third-Party Services

The following external services are contacted when you use specific features. No service is contacted until you enable or use the corresponding feature.

Google Integration

Undistracted Me can optionally connect to your Google account. No Google feature is active until you explicitly sign in.

Permissions requested

What we do with Google Tasks

• Read tasks from all of your task lists (up to 100 tasks per list, including completed).
• Create new tasks in your default task list.
• Update a task's title when you double-click to edit it (in its specific list).
• Mark a task completed or un-completed via the checkbox.
• Permanently delete a task when you click the trash icon.

Revoking access

In addition to disconnecting within the extension, you can revoke the extension's permissions entirely at any time from myaccount.google.com/permissions. Revoking access does not delete any data from Google's servers — it only removes our application's ability to read or interact with your Google data.

Chrome vs. Firefox auth path

On Chrome, authentication uses chrome.identity.getAuthToken() — token management is handled entirely by the browser. No client secret is needed.

On Firefox, a PKCE OAuth flow is used. The authorisation code is exchanged for tokens via our Vercel endpoint, which injects the client_secret server-side. The secret is never present in the extension bundle.

Spotify Integration

The Spotify widget is entirely opt-in and requires explicit sign-in.

Spotify authentication uses the standard PKCE flow. Only the client_id and a locally-generated code_verifier are sent — no client secret is involved. Token exchange goes directly to accounts.spotify.com/api/token and never through our servers.

• Tokens are stored in chrome.storage.local (extension) or sessionStorage (website mode — cleared when the tab is closed).
• Your Spotify display name and account tier (Free/Premium) are persisted in localStorage so they display on return visits. Your avatar URL is not persisted — it is held in memory for the current session only and re-fetched on reconnect.
• The extension reads your currently playing track and controls playback (play, pause, next, previous, seek).
• No listening history or personal data is collected by us.

Browser media sessions (SoundCloud & others)

A content script is injected into SoundCloud pages (*://*.soundcloud.com/*) only. It polls navigator.mediaSession for track metadata and sends it to the background service worker so it can be displayed in the Focus Mode media panel. No data is sent to any external server. The content script does not modify the SoundCloud page.

Data Storage

All user data is stored locally in your browser.

Security Measures

• Storage Isolation: Sensitive data (like Google events and contacts) is sandboxed in chrome.storage.local, which cannot be accessed by other websites. Less sensitive UI preferences use standard localStorage.
• Web Mode Security: When using the web version, OAuth tokens are strictly stored in sessionStorage, guaranteeing they are permanently wiped from your browser the moment you close the tab.
• Minimal Persistence: Only non-identifying data (display name, account tier) is persisted in localStorage. User-identifying artefacts such as avatar URLs are held in memory only and never written to persistent storage.
• Server-Side redirect_uri Validation: The Google token-exchange endpoint validates redirect_uri against a server-side allowlist, preventing stolen authorisation codes from being exchanged via a forged redirect.
• API Key Obfuscation: We employ build-time cryptographic obfuscation for internal API keys (like the Google OAuth client ID) to prevent automated scrapers from extracting them from the codebase.

No data is synced to the cloud via chrome.storage.sync. Data does not leave your device except for the API calls described in Section 2.

Browser Permissions

Undistracted Me declares only the permissions necessary for its features.

Children, Changes & Contact

Children's privacy

Undistracted Me is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided personal information, please contact us and we will remove it.

Changes to this policy

We may update this policy when we add new features that affect data handling. The "Last updated" date at the top will change. Significant changes will be noted in the extension's changelog.

Contact

Questions, concerns, or data requests: hey@sarojbelbase.com.np
Website: https://undistractedme.sarojbelbase.com.np

Terms of Service

By installing or using Undistracted Me, you agree to these terms.

1. Use of the extension

Undistracted Me is provided free of charge for personal, non-commercial use. You may not reverse-engineer, redistribute, or create derivative works that misrepresent their origin as official Undistracted Me releases.

2. Third-party accounts

Features that connect to Google or Spotify are governed by those services' own terms:

• Google Terms of Service
• Spotify Terms of Use

You are responsible for complying with the terms of any third-party service you connect to through the extension.

3. No warranty

Undistracted Me is provided "as is" without warranty of any kind. We do not guarantee uninterrupted availability, accuracy of third-party data (weather, stock prices, etc.), or compatibility with future browser versions.

4. Limitation of liability

To the maximum extent permitted by law, we shall not be liable for any indirect, incidental, special, or consequential damages arising from your use of the extension, including but not limited to data loss, service interruptions, or reliance on displayed information.

5. Acceptable use

You agree not to:

• Use the extension to automate requests in a way that violates any third-party service's terms.
• Attempt to extract, scrape, or abuse the proxy API endpoints for purposes other than personal extension use.
• Misrepresent the extension's functionality in reviews or publications.

6. Open source

The source code is publicly available. Community contributions are welcome under the terms of the project's licence. Using the source code in your own project must comply with that licence.

7. Changes to terms

We may revise these terms at any time. Continued use of the extension after changes are posted constitutes acceptance of the updated terms.

8. Governing law

These terms are governed by the laws of Nepal. Disputes shall be resolved in the courts of Kathmandu, Nepal.