Privacy
What ti-me records, exactly
Every tracker says it respects your privacy. This is the specific version: what is recorded, what cannot be recorded, where it lives, and what this website does.
It is enforced by the schema, not by a policy
ti-me does not choose not to store a web address. It cannot. Every event is parsed against a strict schema before it is stored, and a payload carrying a field that is not in the contract fails to parse and is rejected at the boundary.
That matters because of what it costs to change. Capturing something new is not a setting somebody can relax quietly. It means editing the contract, which breaks tests and appears in a diff. Policy protects data until someone is in a hurry. A schema protects it afterwards.
What is recorded
Each entry below is an event, written once. Every event carries when it happened, when ti-me saw it, and the calendar context it happened in, so a day can be replayed exactly on any machine.
| Event | What it holds |
|---|---|
| Application focus changed | The platform, the application name and identifier, and the window title where the operating system provides one. |
| Idle started and ended | How long you were away from the keyboard. |
| Screen locked and unlocked | How long the screen was locked. |
| System suspended and resumed | How long the machine was asleep. |
| Tracking paused and resumed | The reason: you paused it, or a day was verified, or a day was reopened, or the app started. |
| Manual entry recorded | The start and end of the work, and the label you typed. |
| Manual entry revoked | Which entry you withdrew. The original stays in the record. |
| Calendar entry observed (off by default) | The calendar name, the entry's own identifier, its title, its start and end, whether it is all day, how many people were invited, and whether you accepted. |
What cannot be recorded, at all
None of the following is representable in the event contract, which is a stronger statement than saying it is not collected today.
What you write stays yours
The labels and descriptions you type are stored exactly as you wrote them, and they are never parsed, classified, tokenised or learned from. They exist for your own invoice, not as material for the software to draw conclusions with. Any future feature that wants to read them has to argue against this line explicitly.
The calendar, if you turn it on
Calendar capture is off until you switch it on, and it is the first thing ti-me records that describes other people, who did not consent to your time tracker.
So it keeps the number of attendees and not their identities. A one to one and a twelve person workshop are genuinely different signals about where an hour went, while a list of who you met is none of ti-me's business. Names, email addresses, the organiser, the location, conference links, dial-in details, the body, the notes and the attachments are all unrepresentable. The title is optional, so a calendar can be connected with redaction on, in which case the title never reaches storage rather than being stored and hidden.
Where the data lives
In one SQLite file on your own disk.
Windows%APPDATA%\Ti-Me\ti-me-v3.sqlite
macOS~/Library/Application Support/Ti-Me/ti-me-v3.sqlite
To back it up, quit ti-me and copy the file. There is no other copy anywhere.
Exports go wherever you save them, and they contain only the scope you chose.
The network
There is no account, no server, no sync and no telemetry. Nothing about your day is transmitted, because there is nowhere for it to be transmitted to.
What you control
- Capture is disclosed before it beginsThe first run explains what is recorded and waits for you, and the same disclosure stays readable in settings afterwards.
- Pause whenever you wantPausing is a recorded event with a reason, so a gap in the day is never unexplained.
- Your rules decide how activity is groupedRules match on the application and the window title, and you write them.
- Erase everythingSettings can close the database, remove the file and start clean.
This website
These pages are static files. There are no cookies, no analytics, no tag manager, no session recording and no embedded anything. The two typefaces are served from this domain rather than from a font provider, so loading the site tells nobody else that you were here.
Two forms collect anything at all. The early access form takes an email address, used for one thing: a short message when there is something to run. The contact form takes an address and whatever you write in it. Neither adds you to a list, shares anything or profiles you. Both arrive in one mailbox, hello@stanleydesign.co.za, read by one person.
Ask through the contact form and your address and anything you sent are deleted.
Last updated 22 September 2026. Questions about anything on this page are welcome through the contact form.