Almost every “employee monitoring” tool works the same way. It takes a screenshot every few minutes, counts keystrokes and sends it all to a server, where a manager can look through it later. TimerOS works the other way round. It reads a handful of signals, evaluates them on the computer itself, and the raw data never leaves that machine.
That decision shapes everything else: what a manager can see, how much storage a year of data takes, whether the tool meets GDPR’s data-minimisation rule and, above all, how it feels to have it running on your computer. What follows explains how the classifier works, then charts one ordinary day.
The raw data stays on the worker’s computer, where it belongs.
Two ways to measure a working day
Surveillance tools treat the worker as someone to watch, so they capture as much as they can and sort it out on the server. On-device classification captures as little as it can, turns it into a label straight away and keeps the details on the computer.
The signals we read
The TimerOS desktop app runs in the background and looks at three things:
- The active window title, for example “Invoice #1042 — Acme” or “Pull request #88”.
- The name of the application in the foreground, such as your editor, browser or design tool.
- Time since your last input from the keyboard or mouse, which separates active work from idle time.
A fourth signal is read only in certain cases: the domain of the active browser tab. That means the site name, such as example.com, plus the first part of the path when it is a word, such as /console. The app never takes the full address, the rest of the path or the query string. The domain is held in memory for the current tab only and is never sent anywhere. It is saved only if you switch on Diagnostic recording yourself: that setting, which your employer cannot turn on, keeps the raw window title and the address in a file on your computer for 30 days.
Two things can turn this on. One is your employer setting website rules, such as “treat this client’s tool as productive, treat that site as idle”. The other is automatic task assignment, which uses the site as a hint about which task you are working on. That setting is on by default, and it is yours to change in Settings → Activity Detection. If you turn it off and there are no website rules, the domain is never read. Nor is it read while your computer is locked or during a break you have started.
“Reads the domain” can sound like more than it is, so here is exactly what happens. The app asks the browser for the address of the tab in front of you, using the operating system’s accessibility interface. Straight away, in memory and before anything is classified, it discards everything except the site name and that first part of the path. It does not guess from the title bar and it does not read your history. It reads only the tab you are looking at, and only at that moment.
These signals are enough to tell focused work from a coffee break. The app never looks at what is on your screen or which keys you press, the two things a surveillance tool goes after.
How the classifier decides
Classification happens in two steps, and both run on the employee’s own computer. First, a fast, transparent set of rules handles the clear cases: an editor in the foreground with recent input counts as productive, and a long stretch without input counts as idle. Then, for the moments the rules cannot settle, a small optional model on the same computer makes the call.
None of this is hidden. Employers set up Activity Classification rules that decide which apps and titles count as productive for their team, and employees can open a panel to see exactly how their time is classified. Every minute ends up in one of six states:
- Productive: focused work in an app that counts as work.
- Idle: the computer is on, but there has been no input for a while.
- Break: a pause you chose to take, recorded separately from idle time.
- Overtime: work beyond the scheduled shift.
- Off-work: outside working hours.
- Offline: the app or the computer is not running.
What a tracked day actually looks like
Because the result is a set of time states rather than recordings, it is easy to chart. Here is a day from a sample workspace: not customer data, but typical of what the dashboard shows each person about their own time.
Over a week, the same data shows a pattern: a peak on Thursday and little work at the weekend. Not a single screenshot was taken.
The numbers that matter for trust never change:
Privacy built into the design
On-device classification is part of the product’s design, so no setting can change it. There is no “collect screenshots” switch hidden in an admin panel, because that feature was never built. TimerOS is built this way to meet GDPR’s data-minimisation principle and to stay in line with the EU AI Act’s transparency expectations: workers are told what is measured, and they can see the rules used to measure them.
Time tracking is worth having only if the people it records would still install it knowing exactly how it works. We hold TimerOS to that test. More of the thinking behind it is on the features page and in the story behind TimerOS.