Security & Privacy
This guide applies to the TimeCamp AI Time Tracker for macOS and Windows. It does not cover the general TimeCamp web platform.
Activity history stays on your device. AI features send selected context to configured AI services. You can pause tracking and review suggestions, while workspace rules can restrict the OCR text and website addresses sent to AI.
What the app captures
The desktop app records active application names, window titles, visited website addresses, timestamps, and durations. It can also use project and task names and descriptions from a connected time tracking account. With optional screen analysis enabled, it extracts text visible in the active window.
The app does not record keystrokes, audio, or camera input. You can pause activity tracking from the tray or menu bar. Screen analysis is disabled by default on new installations.
What stays on your computer
The app stores computer activity history, including application usage, URLs, and extracted screen text, in a local database. It does not upload this database to TimeCamp's central time tracking servers. Accepted time entries, projects, and tasks follow the normal synchronization rules of your connected account.
When screen analysis is enabled, the app temporarily captures the active window and runs optical character recognition, or OCR, locally using Apple Vision on macOS or Windows OCR. It does not send automatically captured screenshot images to AI models or TimeCamp servers.
The app normally deletes screenshots after recognition. If OCR fails, a screenshot may remain locally until the associated activity is deleted, for at most 90 days.
What can be sent to AI
For time entry suggestions, AI receives selected context relevant to the task, rather than a full copy of the activity database. This may include:
- Application names and window titles.
- Website addresses permitted by workspace rules.
- Activity times and relevant tasks and projects.
- Selected OCR text, when screen analysis is enabled and sharing is allowed.
The Assistant may also process chat messages, attachments, time entries, and results from tools it is permitted to use.
The app selects and truncates OCR text for suggestions and checks AI-generated time entry proposals against available tasks. Full URL query strings can contain sensitive identifiers, so organizations should choose an appropriate URL-sharing level.
Workspace AI privacy rules
Organizations can centrally control which captured data desktop apps send to AI models. These rules control AI transmission. They do not determine whether activity continues to be recorded locally.
OCR text sharing
- Send OCR text allows selected, locally extracted screen text to be sent to AI models.
- Do not send OCR text makes AI suggestions and the Assistant rely on other allowed information, such as application names, window titles, and website details.
Local screen analysis and workspace permission to send OCR text are separate settings. Allowing OCR sharing does not turn on local screen analysis.
Website address sharing
| Setting | What is sent to AI |
|---|---|
| Full URL | The complete address, including its path and query parameters. |
| Without query parameters | The address and path, with query parameters and fragments removed. |
| Domain only | Only the website domain. |
| Do not send | No website address. AI may still receive the browser application's name. |
Window titles and other permitted context may still contain confidential information.
Administration and enforcement
When the Privacy page is visible in the TimeCamp AI billing portal, authorized workspace administrators can change these settings. When the page is hidden, TimeCamp Support manages them. Saved rules apply regardless of whether the page is visible.
Compatible desktop clients typically pick up changes within approximately 10 minutes. Enforcement requires AI Time Tracker version 1.11.25 or newer. Older versions ignore workspace privacy rules.
If no workspace rules have been customized, the defaults permit OCR text sharing and full URLs. These defaults do not enable local screen analysis. The Privacy panel also shows a change history with the configuration, editor, and change time.
Where AI requests go
| Configuration | Request path |
|---|---|
| AI disabled | No requests go to an AI provider. New installations start with AI disabled, although connecting a supported time tracking account may activate the TimeCamp AI setting. |
| TimeCamp AI | Your device → TimeCamp AI gateway at lmp.timecamp.io, hosted on Google Cloud in the EU → selected upstream model provider. |
| Your own OpenRouter key in the desktop app | The desktop app sends AI requests directly to OpenRouter. TimeCamp servers are not in this model-request path. |
TimeCamp AI may use any AI subprocessor listed in TimeCamp's current List of Sub-Processors.
The TimeCamp AI gateway is hosted in the EU. This does not guarantee that all model inference stays in the European Economic Area. Upstream providers may process requests in the United States. The Privacy Policy and the subprocessor list describe the applicable cross-border safeguards.
Workspace Bring Your Own Key
Workspace Bring Your Own Key, or BYOK, lets authorized administrators configure their own AI-provider credentials and model choices separately for the Mini and Pro tiers through the billing portal. BYOK requests do not use TimeCamp AI credits and do not require a paid TimeCamp AI plan.
Disabling workspace BYOK preserves saved keys and model settings but stops subsequent BYOK requests. It does not automatically switch them to TimeCamp-managed models. Requests already admitted for processing may complete.
The selected provider's terms, retention, and training policies apply. BYOK alone does not promise EU-only processing or zero retention.
Model training, retention, and deletion
TimeCamp does not use customer data to train AI models. The TimeCamp AI configuration uses zero data retention arrangements for model processing. With your own OpenRouter configuration or workspace BYOK, your provider agreements and settings must be considered separately.
| Data | Retention |
|---|---|
| Local activity history, URLs, and extracted OCR text | Automatically deleted after 90 days. |
| Temporary screenshots | Normally deleted after OCR. If OCR fails, they may remain locally for up to 90 days. |
| AI suggestions, correction history, Assistant chats, memories, and usage records | Retained locally without automatic expiration. Removal requires deleting the app data directory. |
| Product analytics session replay | Retained for 30 days. |
Zero retention for model inference does not mean zero retention on your device or in separate operational telemetry. Uninstalling the Windows app does not automatically delete its local data directory.
AI suggestions and human control
AI time entry suggestions are proposals you can accept or dismiss. Automatic acceptance of suggestions from earlier days is an optional setting, disabled by default. Review AI-generated information before use. The app does not make automated employment decisions with legal or similarly significant effects.
The optional AI Assistant has broader permissions. In its default Safe mode, it can read available context, add time entries, and start or stop the timer without individual approvals. It requires approval before changing or deleting existing entries, writing files, or running shell commands. You can select more permissive settings.
Scheduled jobs can run without you present, but they do not automatically receive approvals required by Safe mode.
Local MCP and external assistants
The optional local MCP server is off by default. It listens only on 127.0.0.1 and rejects browser-origin requests. It gives external assistants tools for entries, tasks, timers, activity, and screen text. It does not provide general shell or file tools.
MCP write operations can run without a separate approval in the app, relying on the external assistant's controls. The server does not use an authentication token, so organizations should enable it only when necessary.
Application safeguards and limitations
Connections to TimeCamp services and AI providers use HTTPS/TLS. Desktop builds use code signing, with Apple notarization on macOS. The app isolates its Electron renderer and validates AI outputs, including task identifiers.
When the Assistant reads screen text, the app masks sensitive patterns such as passwords, tokens, payment-card numbers, and identifiers. This masking does not cover every suggestion workflow.
Excluded screen-text settings can prevent AI suggestions and memory blocks from using OCR text from specified apps and sites. Window titles and URLs from those sources may still be used. Exclusions do not yet cover every Assistant, scheduled-job, or MCP path.
The app does not encrypt the local activity database or settings file. Protect devices with individual user accounts and operating-system full-disk encryption, such as FileVault or BitLocker.
Product analytics and diagnostics
Local activity history is separate from operational telemetry:
- PostHog, hosted in the EU cloud, processes app-use events, interface click capture, and sampled session replay. Replay may show visible task names and time entry descriptions. Text fields are masked, and recordings are kept for 30 days.
- When you rate an Assistant response, the response and your comment may be sent.
- Sentry error reports are hosted by TimeCamp in the EU. The app removes several sensitive fields before transmission.
Frequently asked questions
Are screenshots uploaded to TimeCamp or AI models?
Automatically captured screenshot images are not uploaded. With optional OCR enabled, selected recognized text can be sent to models if workspace rules permit it. Images or files you deliberately attach in Assistant chats are a separate category.
Can we prevent sensitive website details from being sent?
Yes. Workspace privacy rules allow full URLs, URLs without query parameters, domains only, or no website addresses. Window titles and other permitted context may still contain confidential information.
Can administrators enforce privacy settings for everyone?
Yes, on compatible desktops running version 1.11.25 or newer. Administrators manage settings through the billing portal when the Privacy page is visible, or through TimeCamp Support when it is hidden.
Does our data train AI models?
TimeCamp does not use customer data to train AI models and applies zero data retention for TimeCamp AI model processing. With your own provider credentials, the provider's contract and settings govern its handling of requests.
Is all AI processing located in the EU?
There is no EU-only inference guarantee. The TimeCamp AI gateway is hosted in the EU, while upstream providers may process requests in the United States.
Does the app automatically send all activity to TimeCamp?
The app does not upload the local activity database to central TimeCamp servers. Accepted time entries synchronize normally. Separate analytics and diagnostics transmit limited application-related information.
Can we use AI without TimeCamp AI credits?
Yes. Workspace BYOK supports customer-managed provider keys for Mini and Pro without consuming TimeCamp AI credits or requiring a paid TimeCamp AI plan.