Why your time tracker should be local-only

Most privacy arguments about software are abstract. This one is not, because the thing being collected is unusually specific.

What a time tracker can see

To attribute your hours to a client, an automatic tracker has to read the frontmost window title and, in a browser, the URL. There is no lighter-weight version of this; it is the raw material.

Look at what those strings actually contain over a normal week:

• Acquisition Model v4 — Northwind (a client’s name attached to a project they have not announced)
• github.com/acme-health/patient-portal (a client, their sector, and roughly what they are building)
• Figma — Redesign — Confidential
• mail.google.com/... with a thread subject in the tab title
• The name of every recruiter, prospect and competitor you looked up

Individually these are fragments. As a continuous log across months, they are a fairly complete map of who you work for, what those clients are building, when they are building it, and what you were doing at three in the afternoon on a Tuesday in March.

This is a more sensitive dataset than the one your accounting software holds, and it is usually treated as less sensitive because it is filed under “productivity”.

Why that should not sit on someone else’s server

Not because cloud providers are careless. Because of what is true regardless of how careful anyone is.

You cannot audit it. You have a privacy policy, which is a statement of intent that can be revised. You do not have visibility into who at the vendor can query the database, what is retained after you delete an account, or what the backups contain.

A breach is not hypothetical. Companies with real security teams get breached. The question for any stored dataset is not whether an incident is possible but what it would expose. Here it exposes your entire client list and their project names.

Ownership changes. The company you evaluated is not necessarily the company holding your data in four years. Acquisitions, pivots and policy rewrites all happen to services that were fine when you signed up.

The part specific to freelancers

If you have signed an NDA — and most freelancers have signed several — you have agreed not to disclose your client’s confidential information to third parties.

A running log of Northwind — Acquisition Model sitting in a vendor’s database is not obviously outside that. You almost certainly did not think about your time tracker when you signed, and neither did they. Most clients will never ask. Some will, particularly in legal, health and finance work, and “my time tracker uploads window titles to a service in another jurisdiction” is a bad sentence to have to say in a security review.

The clean answer is to not have the exposure. If nothing leaves the machine, the question does not need a good answer.

What “local-only” means concretely

The phrase gets used loosely, so it is worth being specific about what it means in Tracker.

The database is a file. All of it lives in a SQLite file on your disk. Not a cache of a server copy — the whole thing. It sits with your other documents and behaves like any other file you own.

There is no account. Nothing to sign up for, no email address on file, no password to reset. There is no user record because there is no server holding one.

Deletion is deletion. Delete the file and the history is gone. There is no second copy in a backup you cannot reach and no thirty-day retention window in someone else’s policy.

Exports are yours. A report comes out as a plain CSV, written where you asked for it. Where it goes next is a decision you make, not a default.

The distinction that matters: this is a property of the architecture, not a promise in a document. A tool with no network component cannot leak your window titles regardless of what anyone at the company intends.

What it costs you

Local-only is a trade, and the bill comes in three parts.

No sync. Work on a laptop and a desktop and you have two separate histories. There is no server to reconcile them, which is the same fact as “there is no server”, viewed from the other side.

Backups are your job. No cloud copy means no automatic recovery. The file is covered by Time Machine or any normal backup like any other document — but only if you actually run one.

No web dashboard. No pulling up last month’s hours from a phone in a meeting. The data is where the app is.

For a solo freelancer working mostly on one machine, that is a small price. If you genuinely need your hours on three devices, a local-only tool is the wrong choice and you should pick a cloud one deliberately, with your eyes open about what you are uploading.

Ask the question before you install

Whatever you end up using, the useful questions are the concrete ones: does it upload window titles or URLs, what exactly is retained after deletion, and can you export everything in a format that outlives the app.

A vendor that answers those clearly is worth trusting more than one that answers with the word “secure”. And a tool with nothing to upload does not have to be trusted at all — which is the entire argument, and the reason Tracker has no server.

The mechanics of using a local tracker day to day are covered in how to track billable hours automatically, and the comparison with the mature Mac alternative is in Timing vs Tracker.