The short version. HocusFocus routes an enrolled device's internet traffic through a VPN we run, and records which websites it connects to and how much data moves — not the contents of anything. That record produces a Focus Score, which a parent can attach to an allowance. If a parent connects a bank, that runs through Plaid, and we never see their banking password.
This is a monitoring product used on children. We have tried to write down exactly what it can and cannot see, including the parts that are uncomfortable.
HocusFocus ("we", "us") provides a parent-facing service for monitoring and encouraging a child's productive device use. This policy covers the HocusFocus website, the parent and student web applications, and the VPN profile installed on an enrolled device.
The account holder is a parent or legal guardian. They create the child's account, choose which devices are enrolled, and can delete everything at any time.
For each enrolled device: a label the parent chooses, the platform (iOS, iPadOS, macOS, Windows, Android, Linux), the VPN type, the internal tunnel IP address we assign it, a certificate serial or public key, and a last-seen timestamp used to show whether the device is currently connected.
This is the sensitive part, so here is exactly what the VPN records. Enrolling a device sends all of its internet traffic through our server — not just a browser, and not just the child's apps. For each connection we record:
khanacademy.org), taken from the device's DNS lookups and
from the unencrypted server-name field that begins a TLS connection.From that we derive five-minute activity windows, a category for each site (school, social, video, gaming, and so on), and the daily Focus Score.
We want to be direct about what traffic metadata reveals. Knowing that a device connected to a particular domain, at a particular time, and exchanged a particular volume of data can imply a great deal even though we never read the contents. A visit to a health, religious, political, or crisis-support website is visible to us as a domain name, and is visible to the parent on the activity page. If that is not something you want recorded about a person, do not enrol their device.
If a parent connects Canvas or Google Calendar, we store assignment titles, subjects and due dates, and calendar event titles and times. We use these to tell whether a moment was a study block or a deadline. We do not read email, documents, or contacts, and we request read-only access.
We keep structured application logs to operate and debug the service. They are redacted where they are written: values shaped like access tokens, passwords, or API keys are stripped before anything reaches disk. We also keep an audit record of sensitive reads — when a parent's account viewed a child's activity data — so that access is accountable.
Stating this precisely matters more than stating it reassuringly.
youtube.com, not which video. We see
google.com, not what was searched.HocusFocus is sold to and controlled by parents. A child cannot create an account: only a parent can, and doing so is the parent's consent to the collection described here on behalf of their child.
Consistent with the Children's Online Privacy Protection Act (COPPA), we collect the minimum needed to run the service. Specifically, for a child we collect a name, a username, a password hash, and the device activity described in section 2 — and nothing else. We do not use a child's information for advertising, we do not build advertising profiles, we do not sell or rent it, and we do not disclose it to third parties except the service providers listed in section 8.
A parent may review everything we hold about their child, and require its deletion, at any time (section 10). Deleting a child's account does not require deleting the parent's.
Monitoring software that hides itself from the person being monitored is a different and worse product than this one. A child with a HocusFocus account can sign in and see their own Focus Score, their own activity breakdown, their own devices, and what they have earned. They see the same activity data their parent does.
They cannot see or change allowance settings, payment methods, or their parent's bank information.
Attaching real money to an allowance is optional and off unless a parent turns it on.
Bank connections run through Plaid. When a parent links an account, they enter their bank credentials into Plaid's interface, not ours. We never see, receive, or store a banking username or password. What we store is an access token issued by Plaid — encrypted at rest with AES-256-GCM — the bank's name, the account's last four digits, and Plaid's internal identifiers.
When a payout runs we ask Plaid for the account's available balance so we can avoid attempting a payment that would fail, and we record the amount, the date, and the status of each transfer. Plaid's own handling of the data it collects is governed by Plaid's End User Privacy Policy.
We do not sell personal information, and we do not share it for advertising or cross-context behavioural advertising. We do not use activity data to build advertising profiles of anyone, adult or child.
We share data only with providers that make the service work, and only what each needs:
| Provider | What they receive | Why |
|---|---|---|
| Plaid | Bank connection and transfer details | Only if a parent enables real allowance payments |
| Sign-in identity; calendar events if connected | Optional sign-in and schedule context | |
| Instructure (Canvas) | Assignment data if connected | Optional schedule context |
| Hosting provider | Everything, as the operator of our servers | Running the service |
We may also disclose information if we are legally required to, or where it is necessary to protect someone's safety. If we are ever acquired, the data would transfer with the business, and we would give notice before it became subject to a different policy.
| Data | Kept for |
|---|---|
| Account and device records | Until the account is deleted |
| Individual connection records (domain, bytes, timing) | A rolling window on the VPN server; these age out automatically and are not archived |
| Daily Focus Scores and weekly allowance records | Until the account is deleted; these are the durable summary |
| Payment records | Retained as long as financial recordkeeping obligations require, even after account deletion |
| Application logs | Rotated daily and retained short-term for debugging |
These are built into the product, not a request queue:
GET /api/account/export. It excludes password hashes and
encrypted credentials, and says so explicitly rather than leaving the
omission to be inferred.POST /api/account/delete
erases the parent account, every child account, all devices, activity
summaries, allowance records, settings and integrations. It requires the
account password. It is refused while an allowance payment is still
clearing, because a bank transfer in flight needs a record to reconcile
against; those settle within about five business days.Depending on where you live you may have additional rights under laws such as the CCPA/CPRA or the GDPR, including the right not to be discriminated against for exercising them. We honour the requests above for everyone regardless of location.
No system is perfectly secure. If we discover a breach affecting your information, we will tell you.
If we change this policy in a way that materially affects what we collect or how we use it, we will update the date above and notify account holders before the change takes effect.
Questions, requests, or concerns about privacy: privacy@hocus-focus.us.
If you believe we hold information about a child collected without a parent's consent, write to that address and we will delete it.