Privacy policy
A time tracker sees your working day, so this page is written to be read rather than clicked past.
The short version
The desktop app records to a database on your own computer and sends nothing anywhere. If you create an account and turn on sync, the activity you chose to sync is copied to our server so the dashboard can show it. We do not sell anything, we do not run advertising, and no activity data is ever sent to an external AI service. Running the service means we keep what it needs to work — your synced activity, account and device records, and operational logs — and we may use it in aggregate to keep the product running and improve it. Analytics on the marketing site are described below and are separate from any of this.
The mobile app is different in one way worth knowing up front: it needs an account, and on Android, once you allow it, the phone usage it records syncs to your account automatically. It records which app was in front and for how long — nothing on the screen. Details below.
Four separate things
"Savanna Time" covers four pieces of software with genuinely different privacy behaviour, and lumping them together is how these documents usually become useless:
- This website. Marketing pages and installer downloads.
- The desktop app. Runs on your machine, records locally, works with no network.
- The mobile app. Android and iPhone. Shows your dashboard; on Android it can also record phone usage, which syncs to your account.
- The dashboard and API. Optional. Only involved once you create an account and choose to sync.
This website
This marketing site uses Google Analytics to measure which pages people find useful. It sets cookies and records ordinary web analytics — the page, the referrer, an approximate location from your IP address. It is not connected to any account, and if your browser sends a Do Not Track signal we do not load it at all. No advertising, and nothing is sold.
The dashboard at app.savannatime.com uses analytics too, on a separate property, to see which screens get used. What it measures is which page was opened — never what you were working on. No application names, no window titles, no Pulse, no goals: those are your activity, and they are not part of any analytics, here or there.
The desktop tracker and the mobile app send nothing to either. Neither carries any analytics. Fonts on this site are served from here rather than a font CDN, so loading a page does not tell anyone else that you did.
The site makes exactly one network request beyond its own files: a call to our own API asking which app version is current, so the download links stay correct without a manual edit. It sends no identifiers and we do not log it against you. If you block JavaScript the page still works — the links are in the HTML.
Installers are served from Vercel Blob storage. Downloading one means an HTTPS request to that storage host, which necessarily sees your IP address, as any download does.
The desktop app
What it records
While tracking is running, the app records blocks of time describing:
- the name of the application in the foreground
- that application's window title
- when each block started and ended
- whether you were idle
Window titles are the sensitive part. A title can contain a document name, a client name, or the subject of a page you were reading. We treat it accordingly, and so should you when deciding what to sync.
Where it goes
Into a SQLite database file in your user application-data folder. That file is the source of truth. Nothing is transmitted anywhere unless you sign in and turn on sync. The app works indefinitely with no account and no network.
What it never records
Anything matching your privacy rules is never written to the database at all. This is enforced at the moment of capture, not filtered out for display later — the distinction matters, because the second kind is still in the file.
The app does not log keystrokes, capture screenshots, read file contents, use your camera or microphone, or record the text inside the applications you use.
The mobile app
This section applies only if you install the mobile app. It needs a Savanna Time account. On Android it is downloaded from this site; the iPhone app is not available yet.
What it records
On iPhone, nothing. Apple does not let apps send Screen Time data anywhere, so the iPhone app only displays your dashboard.
On Android, only after you allow it in the system’s Usage access setting. From that moment — not before — it records blocks of time describing:
- the name of the app in the foreground, and its package name
- when each block started and ended
There are no window titles on a phone, so the most sensitive field the desktop app handles does not exist here.
Where it goes
Into a database on the phone first, so recording works with no connection. Unlike the desktop app, syncing is not a separate choice: while you are signed in, recorded blocks upload to your account in the background, about every 15 minutes when there is a network. Signing out deletes anything not yet uploaded, so it can never sync under a different account; the app tells you how much before you confirm.
What it never records
Apps matching your privacy rules are never written to the phone, and never-sync rules keep them from uploading. The app does not read screen contents, messages, notifications, files or keystrokes, does not use the camera, microphone or your location, and records nothing from before you allowed it.
Reminders
The daily reminder is off until you turn it on, and is scheduled on the phone itself; no server sends it. The app may also notify you that it was signed out or lost usage access, so tracking does not stop without you knowing. Signing out cancels all of them.
Crash reports
When the app runs into an error, it can send a report to Sentry so we can fix it: the error, where in the code it happened, the app version, and the phone’s model and operating-system version. Each report is stripped on the phone before it is sent: no account or user identifier, no IP address, no screenshots, no record of what you tapped, and web addresses reduced to their shape with record identifiers removed. App names and your activity are never part of a report. The app carries no analytics.
The account and dashboard
This section only applies if you choose to create an account.
| What | Why it exists |
|---|---|
| Email address | Signing in, and account-related mail you asked for |
| Password | Stored only as a bcrypt hash. We cannot read it or recover it for you |
| Display name, timezone, role | Naming you in the interface, bucketing days into your local calendar, and tailoring the default dashboard |
| Last sign-in time | Showing you unexpected access to your own account |
| Synced activity blocks | The app name, window title, timings and productivity level for the activity you chose to sync |
| Device records | A device name and reported timezone, the app version, the operating-system version and, for phones, the model — so you can see what is syncing, recognise each device, and disconnect it. Each install also sends a random identifier it generates for itself, so signing in again does not add a duplicate device |
| Security log | One entry for every sign-in (including failed attempts with your email address), every refused or revoked session, and every change made to your account from any app: what happened, when, whether it succeeded, which app and device, the IP address and the browser or app identifier. It never contains the content of a change — it says a rule was created, not what the rule matches. It exists so you can see unexpected access to your account, and you can read it under Settings |
| Your own configuration | Productivity rules, privacy rules, projects, goals, schedules and saved views |
| Integration credentials | If you connect WakaTime, that API key — stored encrypted, not in plain text |
Server logs
The API writes one line per request recording the method, the matched route pattern, the response status and how long it took. It deliberately logs the route pattern rather than the address you actually requested, so record identifiers and query values never reach the log. When the request comes from one of our apps, the line also notes which app and which version — never the device model or operating system. This service handles personal activity data, and a log aggregator is not somewhere we are willing to send it.
Teams
If you join a team, nothing is shared until you choose to share it: a new member's share level starts at none, and only that member can raise it. Teammates never see your window titles at any share level.
We send email only when you ask for it. The weekly digest is opt-in, can be previewed in the app before you subscribe, and every message includes a link that stops it without logging in. The other messages are transactional — invitations and sign-in codes you triggered. There is no marketing list.
Artificial intelligence
No activity data is sent to any external AI provider, and this is an architectural commitment rather than a setting. Every score, category and insight is computed with deterministic arithmetic on our own infrastructure. Should local machine-learning features ever be added, they would run on your own machine, and this page would say so before they shipped.
Who else is involved
Running the hosted half means other companies necessarily process data on our behalf. The complete list:
| Provider | What they do |
|---|---|
| Vercel | Hosts this website, the dashboard and the API, and serves the installer downloads from its storage |
| Neon | Hosts the PostgreSQL database behind the dashboard |
| Resend | Delivers email, where email delivery is configured. Only involved for messages you asked for |
| Sentry | Receives crash reports from the mobile app, stripped as described above. Never activity data |
| Google and Apple | Distribute the mobile app through Google Play and the App Store once it is published. Installing from a store is covered by that store’s own privacy terms |
| WakaTime | Only if you connect it yourself, and only to read your own coding statistics |
We do not sell personal data, share it with advertisers, or hand it to data brokers. If we are ever legally compelled to disclose something, we will tell you unless we are prohibited from doing so.
How long things are kept
Synced activity is kept until you delete it or your account. Raw activity is deliberately never thinned out or aggregated away, because every derived number is recomputed from it — which also means it does not quietly decay into something you can no longer inspect.
The security log is kept for 400 days and then deleted.
Deleting your account removes your activity, devices, rules, projects, security log and everything else attached to it. Your local database is not touched by that, because it was never ours.
Your choices
- Do not sync at all. The tracker is fully functional with no account. This is the strongest privacy control available and it is the default.
- Exclude before capture. Privacy rules stop specific apps and sites from ever being recorded.
- Disconnect a device so it stops syncing. A disconnected phone stops working with your account at once, and can be reconnected later.
- Stop phone tracking by turning off Usage access for Savanna Time in Android’s settings. The app keeps showing your dashboard.
- Delete individual records — projects, goals, entries and rules — from the dashboard.
- Stop the digest from any digest email, without signing in.
- Get a copy of your data, or have it all deleted, through the contact page. There is no self-serve button for either yet; a person does it by hand.
Depending on where you live you may have additional rights over your personal data, including access, correction, deletion and portability. The same form handles all of it.
Security
Traffic is HTTPS throughout. Passwords are bcrypt-hashed and integration credentials are encrypted at rest. Every request to the API is scoped to the signed-in account. Update packages for the desktop app are cryptographically signed and verified before they install. The mobile app keeps its sign-in in the phone’s secure keystore, tied to that one phone.
First-run installers are not yet signed with Windows or Apple code-signing certificates, so the operating system may warn you on the first open. No system is perfectly secure.
Children
Savanna Time is intended for working adults and is not directed at children. We do not knowingly collect data from children.
Changes
If this policy changes materially, the date at the top changes and account holders are told before the change takes effect. We will not quietly widen what we collect.
Contact
Privacy questions and data requests go through the contact page.