Your privacy

What the app and extension can see

The Mac app measures active app time and switching. The Safari and Chrome extensions check website domains against your block list and, when collection is enabled, record active domains and tab changes. This lets the app block distractions and show your attention patterns.

Detailed activity is kept locally per account for up to 30 days. We don’t record page contents, page titles, full browsing URLs, URL query strings or activity from private tabs. Idle and locked time are excluded. Detailed history and locally cached website icons are excluded from ordinary cloud sync.

Either browser extension may keep encrypted pending activity while the desktop is closed, for up to 30 days. It sends these records to your desktop locally and removes them after the desktop acknowledges saving them.

The Mac checklist’s no-phone-in-bed and no-phone-at-meals items are your commitments, not observed behavior. They are saved privately per account on this Mac and are not synchronized with your phone’s commitments.

What reaches our server

Your username, any account email and display name, blocking settings, schedule and streak support your account and blocking policy. Passwords and expiring session credentials are stored as hashes.

While signed in with sync enabled, the app sends connection status roughly once a minute. A private administrator dashboard holds installation identifiers, app and operating-system versions, recent running status, Chrome companion version and connection information. This does not include detailed activity history or measure time spent interacting with the app.

To show your phone’s setup in the Mac checklist, the Mac can read a recent protection report from another signed-in device on your own account. It contains whether phone protection is configured and when that report expires. It contains no selected apps or activity history; it is a device report, not independent verification by the operating system.

Account and sync data are kept while your account exists. For account deletion or security questions, contact alexander.chisler@gmail.com. Deleting local activity does not delete your account.

What other people can see

Map visibility is on by default. People in your signed-in community can see your display name, approximate location, block hours, streak and latest attention battery when you have a saved location and a started schedule. Older battery readings are labelled. Group boundaries and visibility settings determine the audience.

We use ipwho.is to suggest an approximate location from your public IP address, without sending it account credentials or activity. Saved coordinates are rounded to one decimal degree. There is no GPS tracking. You can move the pin or hide your map profile.

If you previously enabled anonymous app totals, they appear as “Mystery App 1”, “Mystery App 2” and so on. App names, identifiers, sites and timelines are excluded. Only the latest summary is kept, and readings expire after 24 hours. Hiding your profile also removes the shared reading.

If you previously enabled weekly sharing, people who add you can see weekly doomscrolling totals and recording coverage, without app names, sites or daily records. Older clients’ detailed sharing remains restricted to mutual friends.

The current app does not offer new activity-sharing opt-ins. Previous choices remain in effect until you turn them off in Settings → Privacy & security → Stop previously enabled activity sharing. This stops both anonymous app totals and weekly sharing. Remote removal completes when the app connects.

Before login, the public signup map combines eligible participants into broad 10-degree regions and only shows a region with at least three people. It exposes no names, individual pins, account IDs, groups, activity measurements or participant counts. Hiding your profile excludes you from this view.

Invitations and devices

An invitation records the inviter, recipient, any associated group and acceptance time on the server. Administrators can see these records; members can see their own invitation links and acceptance counts. Each member has one reusable link with a limited number of places. Anyone holding it can see the inviter’s display name and join while a place remains. Reopening a link or repeating an accepted request does not use another place. Invitation pages are excluded from search indexing and do not display account identifiers or private groups. Accepting a group invitation joins that group without adding friends or enabling optional sharing; invitations without a group leave your membership unchanged.

If an invitation gate is enabled, joining the waitlist stores your email for access updates. An administrator can remove it on request. Device sync is optional and lives in Settings → Add a Phone. It sends up to 30 days of activity intervals and switching counts, without app or site names, encrypted with a key held by your paired devices. Our server cannot read that timeline. It can still see device IDs, platform, dates, revisions, timestamps and encrypted record sizes.

Connecting your own devices

Open Settings → Add a Phone → Show QR code to display a three-minute code. Scanning it in the current Android app signs your phone in and connects private activity sync. Older versions may also ask you to confirm on your Mac. Keep the QR private: it contains a temporary pairing secret. Friends and community members cannot see your private timeline.

The history key is protected by macOS Keychain or Android Keystore. The server has no copy and cannot recover encrypted history if every device holding the key is lost. A captured QR and its corresponding encrypted exchange could reveal that exchange; expiry and confirmation cannot retract a key already delivered to a device.

Turning device sync off deletes that device’s server history, preserving its local collection. Other devices remove cached copies on their next successful connection; offline copies expire after 30 days. Disconnecting does not erase a key already held by an offline device. Offline sign-out queues session revocation; if remote history cleanup fails, encrypted records may remain until retention expiry.

How the protections work

Files on your Mac: private desktop settings and activity use authenticated AES-256-GCM encryption, with the key protected by macOS Keychain. If secure storage cannot be unlocked, the app reports the problem and preserves existing files instead of saving plaintext.

Chrome: after secure pairing, pending activity is encrypted for the desktop. The decryption key stays in the desktop’s encrypted storage. Chrome has a separate credential that expires within a day, can only read its own blocking policy and is held in trusted session memory. The cached blocking rules, schedule, public encryption key and queue metadata remain readable locally.

Safari: the extension is included in the signed Mac app. Safari’s native bridge supplies a temporary local connection credential to that specific extension. It is held in session memory, with process memory used when session storage is unavailable. Pending activity uses the same encryption for the desktop; cached blocking rules, schedule, public encryption key and queue metadata remain readable locally. Safari and Chrome have separate connection states.

Connections: HTTPS protects traffic to our server. The desktop and browser extensions communicate locally through native messaging or the computer’s loopback interface; this is separate from cloud traffic. The local bridge restricts extension origins and requires the browser’s connection credential. Signing out revokes the desktop session and its delegated credentials; an offline logout queues that revocation until reconnection.

The boundary: cloud account, policy and shared community data are not end-to-end encrypted. Our server can read them to provide the service. The service uses Heroku and PostgreSQL; hosting infrastructure necessarily processes connection metadata such as IP addresses. Encryption does not protect a compromised, unlocked computer or erase old backups.

Your controls

• Settings → Developer: pause local activity collection or delete its history.
• Settings → Privacy & security: hide your map profile, change your location or turn off previously enabled activity sharing.
• Settings → Add a Phone: connect your phone with a QR code, or turn private device sync on or off.
• Settings → Account: sign out. Offline revocation and sharing changes take effect remotely after reconnection.

A disconnected extension receives collection changes when it next connects locally. Pause, deletion, logout and account changes invalidate pending activity so it cannot restore deleted history or enter another account.

Optional system-filter connection counts, where available under Developer, include background and private browsing traffic but save no domains, URLs or payloads. These counts are local, use the same pause/delete and 30-day retention controls, and are not browsing time.

Apple verification, honestly explained

The Mac download on our installation page is signed with Developer ID and notarized by Apple. The app and installer include verified notarization tickets, and both passed macOS Gatekeeper checks.

Apple’s notarization checks submitted software for malicious content and signing problems. It is not an App Store review, an independent security audit or a certification of these privacy practices.

Apple’s explanation of signing and notarization ↗