The Privacy Model
Privacy isn't a feature of TimeCampus; it's the premise. Time tools have historically forced a false choice: manual timers that give you patchy data and a habit that dies in a week, or monitoring tools that get complete data by surveilling people — screenshots, keystroke logs, idle-time policing — and destroy trust in the process. TimeCampus rejects both. This page is the definitive statement of what that means in practice.
What is deliberately not captured
These are design decisions, not settings you have to find and disable:
| Never captured | What that means |
|---|---|
| Screenshots | TimeCampus never takes images of your screen. There is no screenshot capability to enable. |
| Keystrokes | What you type is never recorded or counted. No keystroke logging, no typing metrics. |
| Idle-time policing | TimeCampus does not measure whether you're "at your desk" or penalise inactivity. Breaks are a first-class, healthy category — not a deficiency to detect. |
| Message and email content | Capture around communication is about time in communication — TimeCampus does not read the content of your messages or emails. Email tracking tracks time spent, not what was written. |
If a time tool's value depends on any of the above, it's a surveillance tool. TimeCampus is built on the position that surveillance is both wrong and — as explained below — bad data.
What is captured
TimeCampus captures contextual activity signal: what kind of work happened, in enough context to categorise it honestly.
- A meeting happened, when, and for how long — not what was said in it
- A stretch of focused work happened — not the keystrokes inside it
- Time went to communication — not the contents of the messages
- A break happened — as recovery, not as an infraction
That signal is what the Timeline assembles into meetings, deep work, communication, and breaks, and what insights like focus ratio and context switches are computed from. It's collected through the channels you connect — and only those.
You control capture and retention
Capture is opt-in and granular, and the data it produces is yours:
- You choose the sources. Nothing is captured except through channels you registered and activated. Turn a channel off and capture from that source stops.
- You control retention. You decide how long captured data is kept — see Data controls for retention, export, and the per-surface privacy settings (location, app usage, email tracking).
- You can correct the record. The platform learns from your corrections; the picture stays yours to keep honest.
Aggregate by default for teams
Team and organization views are built to inform planning without exposing individuals:
- Team-level metrics — capacity, the true cost of meetings, workload trends — are aggregate by design
- No team view drills into an individual's timeline; a manager sees the shape of the team's time, not a teammate's day
- Burnout and workload signals help distribute load fairly using aggregate signal, never individual surveillance
- Sharing beyond that is voluntary — transparency is something a person offers, not something extracted
This is enforced by the platform's access model, not by convention — see Access control.
Why privacy-first is also better intelligence
The privacy model isn't a constraint TimeCampus tolerates; it's why the intelligence works.
Surveillance produces noise. Screenshots and keystroke counts tell you almost nothing about whether real work happened — they measure presence and motion, not work. Worse, people behave differently under surveillance, so the data is distorted at the source, and a timeline you don't trust is a timeline you won't use.
Contextual, consent-based capture produces signal: meetings versus deep work versus communication versus breaks. That distinction is exactly what makes the valuable things possible — focus protection that knows which hours to defend, burnout signals that read sustained workload honestly, and insights that change behaviour instead of decorating a dashboard.
Privacy-first is the foundation that makes the intelligence trustworthy — and being trustworthy is what makes it useful.
Transparent AI
The intelligence layer follows the same principle: AI in TimeCampus is designed to explain itself, and you keep control over what it learns from — including learning from your corrections rather than around them.
TimeCampus is committed to on-device and privacy-preserving processing where feasible, so intelligence doesn't require surrendering control of your data. Advanced on-device intelligence and anonymous, privacy-preserving aggregate benchmarking are on the roadmap; treat them as direction, not shipped behavior.
The privacy boundary, in one paragraph
You control what is captured and how long it is kept. There are no screenshots, no keystroke logs, no idle-time policing, and no reading of your message or email content. Team-level views are aggregate, built to inform planning without exposing individuals. That line is drawn by design, enforced by the platform's access control and audit — it is the product's first principle, not a toggle.
Next steps
- Data controls — retention, export, and per-surface privacy settings
- Access control — roles, workspace isolation, and the audit trail
- Channels — the capture connectors you control