Last updated: September 25, 2026
The experiment ("we", "the app") includes a macOS desktop application, a Chrome browser extension, and a sync server. This policy explains what data we handle and why.
Website icons are obtained from Chrome and cached locally with your usage history. They are not uploaded or included in shared statistics.
Accounts appear on the signed-in community map by default, showing their display name and approximate location. The desktop app looks up its public IP through ipwho.is to suggest a city; it sends no account credentials or activity to that service. Coordinates are rounded to one decimal degree before saving, and no IP address is included in the saved map location. The pin is saved once: you can move it, use your current IP again, or hide yourself in Settings → Community. This uses no GPS or precise device location. Only participants with a saved location and a started schedule appear on the map. Test accounts are excluded. When hidden, your own marker remains visible only to you.
Your latest recorded attention battery is visible on the map by default while your profile is visible. Older readings are labelled with their measurement time. A separate, off-by-default setting shares today’s whole-minute app totals as Mystery App 1, Mystery App 2 and so on. App names, identifiers, website names and activity timelines are not sent. Only the latest summary is stored; readings expire after 24 hours. Turning anonymous activity sharing off removes the app totals while retaining the battery. Hiding your map profile removes the shared reading. Offline changes retry when a connection returns. Weekly sharing remains separate.
Admins can grant single-use invitations to community group members. Accepting one records the inviter, recipient, group and acceptance time on the server and joins the recipient to that group. It does not add friends or enable optional activity sharing. Group members see their available invitation links and the number accepted; administrators can see the referral records. Anyone holding an unused link can use it, so share each link with one intended recipient. Invitations are not login credentials.
The app is free by default. If invitation-only access is enabled for new accounts, you can optionally leave an email address on the access waitlist. That address is stored for access updates and can be removed by an administrator. Existing accounts keep access.
The signup screen can show an anonymous world map before login. Only map-visible, active participants with a saved location contribute. Locations are combined into broad 10-degree areas; an area appears only when at least three eligible participants are there. This public view contains no names, account identifiers, exact locations, group memberships, participant counts, or activity measurements. Hiding yourself from the community map excludes you from this view as well. Pulsing dots represent regions, not individual events or live connections.
In the updated desktop app, weekly sharing is off until you explicitly enable it. Other signed-in participants can then see your total doomscrolling for each shared local Monday–Sunday week and recording coverage. Weekly sharing sends no app or website names, individual daily records, or day phases. Disabling sharing removes the shared summary when the app next connects. Previous consent to sharing with mutual friends is not reused for this wider audience: the updated app asks you to opt in again. Legacy sharing from older clients remains visible only to mutual friends.
Account and session data is stored on our sync server (hosted on Heroku with PostgreSQL). Passwords are hashed and never stored in plaintext. Communication with the production cloud sync server uses HTTPS. The extension also communicates with the desktop app over HTTP on the loopback interface (127.0.0.1), which stays on your computer, or through Chrome native messaging.
The security update encrypts desktop account settings, schedules and detailed activity files with AES-256-GCM. The encryption key is protected by the operating system's keychain through Electron safeStorage. If this storage cannot be unlocked, the app preserves the files and reports the problem instead of saving plaintext. Older local files are migrated in place. This does not erase copies in operating-system backups or provide protection from a compromised, unlocked computer.
The server stores only hashes of new, expiring session credentials. Desktop sessions and browser credentials are separate. Browser credentials can only read that account's blocking policy, expire within one day and are held in Chrome's trusted in-memory session storage. A desktop session expires after 30 days. Signing out revokes that session and its delegated browser credentials; an offline logout queues revocation in encrypted storage until the app reconnects. Older exposed keys are revoked as part of the security rollout, requiring users to sign in again.
After secure pairing, new pending browser activity records are encrypted to the desktop's public key. The private key remains in the desktop's encrypted storage. The current browser observation is held in session memory. Queue sequence numbers, expiry timestamps, collection identifiers and the public key remain visible in local storage, as do the blocked-site policy and cached schedule needed for blocking. Old pending records are encrypted or removed after acknowledged delivery when the updated extension reconnects. A restarted browser needs the desktop to reconnect before obtaining another cloud credential; its cached blocking policy still works.
HTTPS protects communication with the cloud server. This is not end-to-end encryption of cloud account, policy or shared community data: the server must read those fields to provide the service. The local desktop bridge restricts requests to the official or explicitly enrolled extension IDs; it does not expose the desktop account credential.
Your account and sync data is kept as long as your account exists. You can request deletion by contacting us.
Local usage statistics are retained for up to 30 days per account. You can pause collection or delete these statistics in the desktop app under Settings > Developer. A disconnected extension receives changed collection preferences when it next connects locally. Pause, deletion, logout and account changes invalidate pending records, preventing them from restoring deleted history or entering another account.
The sync server runs on Heroku (Salesforce) with a Heroku Postgres database. No other third-party analytics, tracking, or advertising services are used.
If we make material changes, we will update the "Last updated" date at the top of this page.
Questions or deletion requests: open an issue on GitHub or email the developer directly.