Privacy policy
A time tracker sees your working day, so this page is written to be read rather than clicked past.
The short version
The desktop app records to a database on your own computer and sends nothing anywhere. If you create an account and turn on sync, the activity you chose to sync is copied to our server so the dashboard can show it. We do not sell anything, we do not run advertising, we do not use third-party analytics, and no activity data is ever sent to an external AI service.
Three separate things
"Savanna Time" covers three pieces of software with genuinely different privacy behaviour, and lumping them together is how these documents usually become useless:
- This website. Marketing pages and installer downloads.
- The desktop app. Runs on your machine, records locally, works with no network.
- The dashboard and API. Optional. Only involved once you create an account and choose to sync.
This website
No analytics, no tracking pixels, no advertising, and no cookies are set. Fonts are served from this site rather than a font CDN, so loading a page does not tell anyone else that you did.
The site makes exactly one network request beyond its own files: a call to our own API asking which app version is current, so the download links stay correct without a manual edit. It sends no identifiers and we do not log it against you. If you block JavaScript the page still works — the links are in the HTML.
Installers are served from Vercel Blob storage. Downloading one means an HTTPS request to that storage host, which necessarily sees your IP address, as any download does.
The desktop app
What it records
While tracking is running, the app records blocks of time describing:
- the name of the application in the foreground
- that application's window title
- when each block started and ended
- whether you were idle
Window titles are the sensitive part. A title can contain a document name, a client name, or the subject of a page you were reading. We treat it accordingly, and so should you when deciding what to sync.
Where it goes
Into a SQLite database file in your user application-data folder. That file is the source of truth. Nothing is transmitted anywhere unless you sign in and turn on sync. The app works indefinitely with no account and no network.
What it never records
Anything matching your privacy rules is never written to the database at all. This is enforced at the moment of capture, not filtered out for display later — the distinction matters, because the second kind is still in the file.
The app does not log keystrokes, capture screenshots, read file contents, use your camera or microphone, or record the text inside the applications you use.
The account and dashboard
This section only applies if you choose to create an account.
| What | Why it exists |
|---|---|
| Email address | Signing in, and account-related mail you asked for |
| Password | Stored only as a bcrypt hash. We cannot read it or recover it for you |
| Display name, timezone, role | Naming you in the interface, bucketing days into your local calendar, and tailoring the default dashboard |
| Last sign-in time | Showing you unexpected access to your own account |
| Synced activity blocks | The app name, window title, timings and productivity level for the activity you chose to sync |
| Device records | A device name and reported timezone, so you can see what is syncing and disconnect it |
| Your own configuration | Productivity rules, privacy rules, projects, goals, schedules and saved views |
| Integration credentials | If you connect WakaTime, that API key — stored encrypted, not in plain text |
Server logs
The API writes one line per request recording the method, the matched route pattern, the response status and how long it took. It deliberately logs the route pattern rather than the address you actually requested, so record identifiers and query values never reach the log. This service handles personal activity data, and a log aggregator is not somewhere we are willing to send it.
Teams
If you join a team, nothing is shared until you choose to share it: a new member's share level starts at none, and only that member can raise it. Teammates never see your window titles at any share level.
We send email only when you ask for it. The weekly digest is opt-in, can be previewed in the app before you subscribe, and every message includes a link that stops it without logging in. The other messages are transactional — invitations and sign-in codes you triggered. There is no marketing list.
Artificial intelligence
No activity data is sent to any external AI provider, and this is an architectural commitment rather than a setting. Every score, category and insight is computed with deterministic arithmetic on our own infrastructure. Should local machine-learning features ever be added, they would run on your own machine, and this page would say so before they shipped.
Who else is involved
Running the hosted half means other companies necessarily process data on our behalf. The complete list:
| Provider | What they do |
|---|---|
| Vercel | Hosts this website, the dashboard and the API, and serves the installer downloads from its storage |
| Neon | Hosts the PostgreSQL database behind the dashboard |
| Resend | Delivers email, where email delivery is configured. Only involved for messages you asked for |
| WakaTime | Only if you connect it yourself, and only to read your own coding statistics |
We do not sell personal data, share it with advertisers, or hand it to data brokers. If we are ever legally compelled to disclose something, we will tell you unless we are prohibited from doing so.
How long things are kept
Synced activity is kept until you delete it or your account. Raw activity is deliberately never thinned out or aggregated away, because every derived number is recomputed from it — which also means it does not quietly decay into something you can no longer inspect.
Deleting your account removes your activity, devices, rules, projects and everything else attached to it. Your local database is not touched by that, because it was never ours.
Your choices
- Do not sync at all. The tracker is fully functional with no account. This is the strongest privacy control available and it is the default.
- Exclude before capture. Privacy rules stop specific apps and sites from ever being recorded.
- Disconnect a device so it stops syncing.
- Delete individual records — projects, goals, entries and rules — from the dashboard.
- Stop the digest from any digest email, without signing in.
- Get a copy of your data, or have it all deleted, through the contact page. There is no self-serve button for either yet; a person does it by hand.
Depending on where you live you may have additional rights over your personal data, including access, correction, deletion and portability. The same form handles all of it.
Security
Traffic is HTTPS throughout. Passwords are bcrypt-hashed and integration credentials are encrypted at rest. Every request to the API is scoped to the signed-in account. Update packages for the desktop app are cryptographically signed and verified before they install.
First-run installers are not yet signed with Windows or Apple code-signing certificates, so the operating system may warn you on the first open. No system is perfectly secure.
Children
Savanna Time is intended for working adults and is not directed at children. We do not knowingly collect data from children.
Changes
If this policy changes materially, the date at the top changes and account holders are told before the change takes effect. We will not quietly widen what we collect.
Contact
Privacy questions and data requests go through the contact page.