1. Introduction & Core Philosophy
Welcome to FinishIt ("we", "us", or "our"), available at https://finishit.xlabs.au. FinishIt is built to help individuals maintain daily discipline, execute priority tasks, and avoid online distractions across their browser and mobile devices.
Our guiding philosophy on privacy is straightforward: Your tasks and browsing habits belong exclusively to you. FinishIt is engineered from the ground up to minimize data collection. We do not sell personal data, we do not track your browsing history, and we do not serve advertisements.
2. Single Purpose Statement
The FinishIt Chrome Extension exists for one single purpose: To keep users accountable to their daily tasks by presenting today's checklist on new tab pages and issuing escalating reminders on user-specified distraction websites until daily tasks are marked complete.
3. Data We Collect and How We Use It
To provide synchronization and distraction alerting, FinishIt collects and processes only the following minimal data points:
- Daily Task Items: The task titles you create (e.g. "Draft proposal", "Workout 45m"), your priority ordering, and their completion status for the current calendar day.
-
Distraction Domains: The hostnames you explicitly add to your personal distraction list (e.g.,
reddit.com,youtube.com). -
Authentication & Device Identifiers:
- An 8-character account Sync Code generated for your habit partition.
- A salted, cryptographically hashed representation of your 4-digit security PIN (we never store or see your PIN in plaintext).
- A cryptographically secure random Device Token generated during device pairing to authenticate API synchronization requests without re-transmitting credentials.
- A single-use Emergency Recovery Key generated at signup to restore access if your PIN is forgotten.
4. Chrome Extension Permissions & Browsing Data Handling
The FinishIt Chrome Extension requests specific browser permissions in strict adherence to Google's Limited Use Policy. Here is exactly what each permission does:
storage: Used to locally cache your sync code, device authorization token, and daily
task checklist in chrome.storage.sync so your checklist loads instantly offline or in new tabs.
tabs: Used to inspect the hostname of the active browser tab (e.g.,
reddit.com) to determine if it matches a domain on your personal distraction list.
scripting: Used strictly to inject a non-intrusive notification toast (at 45 seconds)
or a focus lock screen overlay (at 3 minutes) directly into tabs matching your configured distraction
domains.
alarms: Used to schedule periodic 15-second background timers while you are actively
browsing a designated distraction domain.
Host Permissions (<all_urls>): FinishIt allows each user
to define their own custom distraction websites. Because any domain can be designated as a personal
distraction, broad host permissions are technically required to display alerts on whatever websites you
select.
The extension evaluates website domains locally in browser memory. We never record, transmit, store, or analyze your browsing history, page contents, keystrokes, form submissions, search queries, or personal interactions.
5. Information Sharing and Disclosure
We adhere to strict data protection standards:
- No Sale of Data: We do not sell, rent, license, or trade your personal information or task data to any third party for any reason.
- No Third-Party Advertising: We do not integrate advertising SDKs, ad networks, tracking pixels, or affiliate marketing trackers.
- No Lending or Credit Checks: We do not use or transfer user data to evaluate creditworthiness or for lending purposes.
- Infrastructure Providers: Your data is stored on secure, monitored cloud servers operated under strict confidentiality agreements solely for running the FinishIt API and database.
- Legal Compliance: We may disclose information only if required by valid law, regulation, subpoena, or government order.
6. Data Security & Encryption
We implement comprehensive security measures to safeguard your information:
- Encryption in Transit: All communication between the Chrome Extension, the mobile PWA, and our servers is encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS).
- Password & PIN Hashing: All PINs are hashed using industry-standard, one-way cryptographic algorithms with unique cryptographic salts. Plaintext PINs are never persisted.
- SQL Injection Defense: All database operations utilize strictly prepared statements with parameterized queries.
- Partition Isolation: Each user's tasks and distraction lists are siloed by their unique Sync Code and verified against active authorized device tokens.
7. Data Retention & User Control
You maintain full control over your data at all times:
- Task Deletion: You can delete any individual task or clear your daily checklist at any time directly through the extension or PWA interface.
- Distraction List Editing: You can add, edit, or delete monitored distraction websites whenever you choose.
- Device Revocation: You can revoke any paired device's access token directly from the extension options or via the mobile companion.
- Complete Account Purge: You may request complete deletion of your Sync Code, tasks, and historical records at any time by contacting our support team.
8. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect enhancements to our service or changes in applicable legal standards. When revisions occur, we will update the "Effective Date" at the top of this page. We encourage you to review this policy periodically.
9. Contact Us
If you have questions, feedback, or privacy-related requests regarding this Privacy Policy or the FinishIt Chrome Extension, please contact: