Privacy and data collection

The heartbeat schema can include:

• File path and save state
• Project and Git branch
• Language, editor, operating system and machine
• Line, cursor, keystroke and character counts
• Activity category, AI fields and timestamps

There is no field for:

• Source code, diffs or patches
• AI prompts, responses or transcript bodies
• Passwords, environment variables or secrets
• Screenshots or recordings

A file path is the field most likely to say more than you intended. It can carry a client name, an unreleased product, or your own name in a home directory, which is why it is called out separately here rather than filed under "metadata".

• The path is used to derive the project, the language and the file-level breakdown
• It is stored as your editor reported it, and is not parsed for meaning beyond that
• It is never shown to anyone else: analytics are scoped to a single account
• Deleting the account deletes the paths with it

AI heartbeats store the flag, agent name and line counts. Provider-reported token usage may be stored as usage metadata; prompt and response text never is.

Cost coverage

Estimated cost is null when provider pricing is unknown, and coverage metadata explains why.

One path in, one path out. The editor extension does not talk to the server at all: it hands activity to the local CLI, and the CLI is the only thing that makes a network request.

• Editor activity is buffered in memory, then handed to wakaclock-cli on the same machine
• The CLI sends it over HTTPS, authenticated with your API key
• If the request fails the heartbeat is queued in a local SQLite file and retried later
• Heartbeat data is not sent to any third-party analytics or advertising service
• This public website loads Google Analytics in production to count page visits; the dashboard and the heartbeat pipeline do not

Complete history is the product, so heartbeats are kept for as long as the account exists rather than aged out after a window. That is a deliberate trade: you get last year back, and in exchange the data has to be deletable on request.

• Heartbeats are retained while the account is active, not trimmed to a recent window
• Aggregates are derived from the raw data, so deleting the raw data removes them too
• Deletion of an account or its data can be requested by email
• Revoking an API key stops new data immediately without deleting what exists