Privacy & Data Boundaries

drifty is local-first: the tracker and the complete activity timeline live on your Mac. Any cloud use is a separate, narrow feature that you turn on.

Local Source of Truth

• Local SQLite database: Installed builds store captured activity in ~/Library/Application Support/so.drifty.mac/tracker.sqlite3.
• Local source of truth: The timeline is read from that local database. It is not published to a profile, leaderboard, team, or analytics surface.
• Explicit exceptions: AI classification can send selected, minimized fields to the provider you choose. The paid device-sync preview can copy raw segments into your private, account-scoped sync storage when you enable it on a Mac.

What AI Classification Sees

When AI classification runs, its request is built from a reduced set of fields rather than a screen recording or raw timeline row. App name, site domain, and duration are required. Page address, window title, content context, and work profile are optional controls in Drifty’s AI privacy settings.

A typical minimized item could contain:

• appName: Visual Studio Code
• domain: github.com
• windowTitle: Pull request · drifty
• durationSeconds: 180

Tip

If Page address is enabled, Drifty can send protocol, host, and path, capped at 300 characters. Query strings, fragments, and credentials are removed first. Window titles are capped at 160 characters. Raw page text, document bodies, message bodies, provider keys, and a replayable timeline are excluded.

AI Route Comparison

Route	Where inference runs	Data leaves Mac?	Quota / Cost
Drifty Cloud	Drifty-hosted provider route	Selected minimized fields	Uses the quota shown in the app
Local AI	Managed model on this Mac	No classification request leaves the Mac	No provider fee; download and memory depend on the model
OpenRouter BYOK	Your OpenRouter account	Selected minimized fields	Billed to your API key
Custom Endpoint	The endpoint URL you configure	Sent to that endpoint	Set by the endpoint operator

Public Profile & Leaderboard

If you opt in, Drifty publishes only the public profile fields you choose and aggregate focus totals. It does not publish the apps, sites, window titles, categories, or sessions behind those totals.

Device Sync Preview

Device sync is separate from public sharing. It is off by default and must be enabled for a signed-in account on each Mac. The paid preview mirrors raw activity segments into private, user-scoped sync tables only to merge that account owner’s Macs. Synced rows must not feed a public profile, leaderboard, team, or other shared surface.

Turning sync off does not change the local database’s role as the source of truth. Use the in-app device-sync controls to review, pause, or purge the remote copy.