Privacy, in plain English
Last updated: November 2026
Whatcha Doing runs on your computer. Your logs and your goals are plain text files sitting in a folder you chose. This page explains exactly what the app stores, what leaves your machine, and when, without making you read a contract.
The short version
- Your logs and goals never leave your computer on their own.
- The only time anything is sent anywhere is when you run a weekly analysis. Then that week's log and your goals go to the AI provider you picked (Anthropic, DeepSeek, Google Gemini or Perplexity), using your API key, or through my server if you have no key of your own (below).
- I run no servers. There is nowhere for your data to go, even by accident.
- On Monthly, and for your trial report when you have no key of your own, that week's log and goals pass through my server to be graded, and it stores none of it. Otherwise I run no server for your data.
- If you use a Gemini key on Google's free tier, Google may use what you send to improve its products. On a paid key it doesn't. Details in section 4.
- No analytics, no telemetry, no crash reporting, no advertising identifiers in the app. This website sets no cookies; see section 5 for what it does count.
- I have never seen your logs and I have no way to.
- I have never seen your logs. My server passes them through to be graded and keeps none of them.
What the app keeps on your computer
All of this lives in the app's folder. You can open it right now, read every file with Notepad, and delete anything you don't want.
├── logs/ ← what you typed, week by week, as .txt
├── reports/ ← the weekly analyses, as .md
└── config.json ← your goals, settings and API key
- Activity logs: the sentences you type when the app interrupts you, saved to a weekly text file.
- Your goals: the monthly, weekly and daily plans you set, saved in
config.json. - Settings: your interval, sound, severity setting and preferences.
- Your AI provider's API key, if you add one, stored in
config.jsonso the app can call the API on your behalf. It is stored on your machine only and is never sent to me. - A computer id: when your trial starts and when the app asks for your trial report, it sends a scrambled (salted and hashed) form of the id your operating system already keeps for this computer. It can't be turned back into that id or matched with any other app, and it is used only so my server can give each computer one trial week and one trial report. If your computer has no such id, the app makes a random one instead and keeps it in
config.json. - Generated reports: every weekly analysis and the monthly archive.
config.json is a plain file, which means your API key is stored in plain text on
your own disk, the same way most desktop developer tools store credentials. If your
computer is shared, use a key with a spending limit, and remove it in Settings when you're done.
I'd rather tell you this than let you find out later.
When something leaves your computer
Exactly three situations. There is no fourth.
Exactly three situations, plus a fourth when your report is written on my server.
- You run a weekly analysis. When you press Grade now, or when the scheduled analysis runs, the app sends that week's log and your goals to the API of the provider you picked in Settings (Anthropic, DeepSeek, Gemini (Google) or Perplexity), using your own API key, and gets the report back. It goes directly from your machine to that provider. It does not pass through me. If you never run an analysis, your logs never leave your computer at all.
- You activate a licence. The app sends your license key to Gumroad to check that it's valid. That's the key only. No logs, no goals, no activity data of any kind.
- The app checks for a new version. When it starts, and every few hours while it runs, it asks GitHub, where the downloads live, for the newest version number. GitHub sees your IP address, as any website does. Nothing about you, your logs or your goals is sent, and I never see the request. Switch it off in Settings under "Tell me when a new version is out".
- Your report is written on my server. That happens on Monthly (Managed in Settings), with an access code from me, and for your trial report when you have no key of your own. The app sends that week's log and goals to my server (on Cloudflare). On Monthly it sends your licence key and the server checks it with Gumroad. For the trial report it sends the scrambled computer id instead, which says nothing about you, and only the week's log, goals and tone. The server passes the log and goals to Gemini (Google) on my paid account, or DeepSeek (based in China) or Anthropic if Gemini is down, returns the report, and stores none of it. It keeps a hashed form of your licence key, a count of reports this month, and a licence check for up to six hours. For the trial it keeps a hashed form of the computer id with the date the trial started, so each computer gets one week and one report, and a hashed form of your network address with a count of trial reports from it this month, so nobody can take thousands. If I gave you an access code, the app sends the code and the scrambled computer id, and the server keeps the code with a hashed form of that id and the date the code ends on your computer, so the code works on the computers it was meant for.
Separately, if you buy a plan, that purchase happens on Gumroad's website, not in the app. Gumroad collects your email and payment details as the seller of record and handles the payment and any tax. I receive your email address and the fact that you bought a licence. I never receive your card details.
If you pay in naira, the payment happens on Paystack's checkout instead. Paystack collects your payment details. My server receives your email address, the pass you picked, the amount and Paystack's payment reference, and keeps them with the access code it gives you, so I can help if you lose the code. It never receives your card or bank details.
What I can't see
This is the part worth being concrete about. I do not operate a server that receives your data.Apart from Monthly and the trial report, I do not operate a server that receives your data, and those pass your week through without storing it. The app has no account system, no sign-in, no sync, and no phone-home check (the version check goes to GitHub, not to me). It doesn't report that you installed it, doesn't report that you opened it, and doesn't report that you stopped using it.
That means I cannot read your logs, cannot see your goals, cannot see your reports, and cannot tell you what you did last Tuesday if you delete the file. It also means I can't recover anything for you. That tradeoff is deliberate.
The companies involved
When the situations in section 2 happen, your data is handled by those companies under their own policies:
- Your AI provider: Anthropic, DeepSeek, Google Gemini or Perplexity, whichever you picked, receives your weekly log and goals when you run an analysis. Because you're using your own API key, this happens under your account and your agreement with them. Their policies are on their own websites; Anthropic's is at anthropic.com/legal/privacy.
- Gemini (Google): if you use a Gemini key, the terms depend on the key. On Google's free tier, Google may use what you send to improve its products, and people may review it. On a paid (billed) key it does not. If your log is private, turn on billing for the key before you run an analysis. Google's terms: ai.google.dev/gemini-api/terms.
- Gumroad: handles the purchase and the licence check. Their policy: gumroad.com/privacy.
- Paystack: handles naira payments. Their policy: paystack.com/privacy.
If any of those matters to you, read their policies before you run an analysis or buy a licence. I'd rather point you at them than summarise them badly.
This website
This website sets no cookies and does not track you across the internet. It loads a web font from Google Fonts, which means Google's servers see your IP address when the page loads, the same as on most websites.
It runs no analytics.
It counts page visits with Umami Cloud, which sets no cookies and stores no personal data: which pages were visited, which link sent you here, and your rough country. Umami's policy: umami.is/privacy.
The email lists on this site (the First Week emails, the Sunday letter and the template files) are optional and run on Kit. If you sign up, Kit stores your email address, and it may record whether you open an email or click a link in it. You can unsubscribe from any email in one click. Kit's policy: kit.com/privacy. The app never asks for your email.
The Coach Quiz and the Available-Hours Check run in your browser. What you pick or type there is never sent or saved; reloading the page clears it.
Purchases happen on Gumroad, as described in section 2.
If you sign up as a beta tester on the beta testers page, the form sends your name, email address, phone number, which computer you use and your answer about what you hope the app will do for you to my server (on Cloudflare). They are kept there until the beta is over or you ask me to delete them. Only I can see them, I use them only to run the beta, and I never share or sell them.
The feedback page works the same way. It sends your name, your message and, only if you add them, your email address and phone number to my server. When you open it from the app, it also sends the app's version number and your system (Windows, Mac or Linux), never your logs or reports. I keep feedback until I delete it, and I use it only to read and answer you.
Deleting your data
Because it's all just files, you don't need to ask me for anything:
- Read or edit it: open any file in
logs/orreports/. - Delete it: delete the files, or uninstall the app. There is nothing to delete on my side, because I never had it.
- Stop anything leaving: turn off the weekly analysis in Settings, or just remove your API key.
- Data held by your AI provider, Gumroad, Paystack or Kit: contact them directly, because they hold it and I don't.
If you're in the UK, EU, or another region with data rights, the practical answer is that I hold almost nothing to give you: your email address, if you bought a licence, your beta tester sign up and any feedback you sent. Ask me and I'll delete it.
How long things are kept
Your files stay on your computer until you delete them. The app never expires them, rotates them, or cleans them up behind your back. Your AI provider, Gumroad and Kit keep what they keep under their own policies.
Children
Whatcha Doing is a general productivity tool for adults and is not directed at children under 13. I don't knowingly collect anything from anyone, of any age.
If this changes
The date at the top changes whenever this page does. Anything that materially changes what leaves your computer will also appear in the release notes, because a policy update you didn't read isn't consent.
Asking me about any of this
Email me. The address is on the contact page. A real person reads it, because there's only one of us.