Legal

Privacy Policy

Effective October 1, 2026

This policy explains how Ritual, the browser extension for Chrome and Firefox (“Ritual”, “the extension”), handles information. Ritual is made by Ruth Thomson (“I”, “me”). If you have a question that isn’t answered here, see Contact.

1. Information stored on your device

Ritual saves what you create and configure so it’s there the next time you open a tab. This includes:

• Your tasks, subtasks and journal entries
• Check-in entries and the name you choose to be greeted by
• Your blocked-site list, per-site exceptions, where each site should send you, and Recolor settings
• Counts shown in the app, such as times you turned back, unlocks and completed focus sessions
• Layout and display preferences, such as your background, theme and Focus Bar contents
• If site time is on: the name of each site you spend time on (for example figma.com) and how many minutes it was in front, for the last 21 days

This information is stored using the browser’s extension storage and the extension’s local storage on your computer. It is never sent to me or to any server I operate (I don’t operate any).

Browser sync: your tasks, saved links and blocked-site list are saved with the browser’s sync storage. If you’re signed in to your browser with sync turned on, it copies them to your other signed-in computers through your Google account, under Google’s Privacy Policy. Ritual does not have access to that copy, and your journal is never synced.

2. The websites you visit

To block and redirect distracting sites, show the sidebar, and apply Recolor, Ritual needs permission to run on the pages you visit. It uses that access only to:

• Compare the address of the page you’re opening with your blocked-site list, so it can show the turn-back screen or send you where you chose
• Add Ritual sidebar to the left edge of the page
• Apply a grayscale or desaturated filter if you’ve turned on Recolor
• Show meeting reminders and the end-of-block card on the page you’re on
• Add up time per site for Your time, if site time is on

Ritual does not read the content of pages or keep a list of the pages you visit. For Your time, it notes only the name of the site in the active tab and how long it stayed in front, never full addresses, page titles or what’s on the page. These totals stay on your computer unless you turn on time sync (section 4), and you can turn site time off or clear it in Settings → Data. Blocking is handled by the browser’s built-in rule system (declarativeNetRequest) on your computer.

3. Google Calendar (optional)

If you choose Connect Calendar, you sign in with Google and allow Ritual to see your calendar events. Ritual requests only the read-only scope https://www.googleapis.com/auth/calendar.readonly. It cannot create, change or delete anything in your calendar.

• What’s accessed: events from your primary calendar for the day you’re viewing (title, time, and meeting link if there is one).
• How it’s used: only to display those events in Ritual Focus Bar and calendar panel.
• Where it goes: your browser requests events directly from Google’s Calendar API. They are not sent to me or to any other party, and are not used for advertising, profiling or training AI models.
• Storage: the temporary access token Google issues is kept in the extension’s local storage so you stay connected. Events are not saved beyond displaying them.
• Disconnecting: use the disconnect button in the calendar panel, and you can revoke access at any time from your Google Account permissions.

Ritual’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Google Drive backup (optional)

If you choose Sign in with Google (in Settings, Task settings, Journal settings or the toolbar menu), Ritual backs up your tasks, journal, check-ins, blocked sites and settings to your own Google Drive, so they survive reinstalling the extension and follow you to other computers.

• Scope: Ritual requests only https://www.googleapis.com/auth/drive.appdata. This lets it create and read a single hidden file in an app-only folder of your Drive. It cannot see, open or change any of your other Drive files.
• Where it goes: your browser sends the backup directly to your Google Drive. It is not sent to me or to any other party, and is not used for advertising, profiling or training AI models.
• Journal: you can leave the journal out of the backup in Journal settings. It then stays on that computer only.
• Time across computers (optional): if you turn on time sync in Your time, Ritual also keeps a second hidden file, ritual-time.json, in the same app-only folder. It holds site names and minutes from each of your computers, so Your time can add them up.
• Turning it off: choose Sign out in the toolbar menu. To delete the backup itself, go to Google Drive settings → Manage apps and choose “Delete hidden app data” for Ritual.

5. Todoist and Google Tasks (optional)

If you connect Todoist or Google Tasks in the toolbar menu, Ritual keeps your tasks in sync with that app in both directions: tasks due today appear in Ritual, and tasks you add, edit, complete or delete in Ritual are changed there too.

• Todoist: you paste your personal Todoist API token. It is stored only in this browser and used only to call Todoist’s API directly from your browser.
• Google Tasks: Ritual requests the https://www.googleapis.com/auth/tasks scope to read and update the tasks in your default task list. Its use of this data adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Where it goes: task text and completion status travel directly between your browser and Todoist or Google. Nothing is sent to me or to any other party.
• Disconnecting: choose Disconnect in the toolbar menu. Your tasks stay in Ritual and in the other app, and stop syncing. You can also revoke Google access in your Google Account permissions, or reset your Todoist token in Todoist’s settings.

6. Break down for me (on-device AI)

When you ask Ritual to break a task into steps, the task text is processed entirely on your computer:

• If Chrome’s built-in AI model is already available on your device, Ritual uses it.
• Otherwise Ritual uses a small open-source language model (Qwen2.5-0.5B-Instruct). The first time you use the feature, your browser downloads the model files from Hugging Face (huggingface.co) and caches them, so later uses work offline. Only the model files are downloaded; your task text is never uploaded.

7. Other services your browser may contact

Ritual has no servers of its own, but some features load content from third-party services. When that happens, those services receive the standard information any web request includes, such as your IP address and browser type, under their own privacy policies. No personal content from Ritual is included.

8. Permissions, explained

9. What Ritual never does

• Sell, rent or share your data
• Use analytics, tracking pixels or advertising
• Transfer your data to anyone for purposes unrelated to the features described here
• Use your data to determine creditworthiness or for lending

10. Deleting your data

Because your data lives in your browser, you’re in control of it. Removing Ritual from your browser deletes everything it stored on that device. To remove synced tasks and blocked sites, delete them in Ritual before uninstalling, or clear Chrome sync data from your Google account. To remove your Drive backup, see section 4. To remove calendar access, disconnect in Ritual and revoke it in your Google Account permissions.

11. Children

Ritual is not directed at children under 13 and does not knowingly collect information from anyone, including children.

12. Changes to this policy

If this policy changes, the updated version will be posted on this page with a new effective date. If a change affects how your data is handled, it will also be noted in the extension’s Chrome Web Store listing.

13. Contact

Questions about privacy or this policy: your-email@example.com