Privacy

“What was I doing?” records what you do on your computer and keeps it all with you. The program has no servers of its own, no accounts, no telemetry and no analytics. Nothing leaves your computer until you turn on something that needs it (the list is below).

What is recorded

The active window: the application, the title and a snapshot of that window (not the whole screen). The idle time without keyboard and mouse is also recorded. Windows of password managers (recording.exclude_apps) and windows whose titles contain words from recording.exclude_titles are not recorded; recording can be paused.
Connectors you turned on:
- git: your commits;
- browser: addresses of open pages, without the query string and the #fragment unless keep_query is on, without the login and password from the address, without sites from exclude_hosts;
- activitywatch: events from your aw-server;
- Mattermost, GitHub, GitLab, Jira, YouTrack: your own actions in these services;
- claudecode: spans of work with Claude Code taken from its logs on this computer — time, project, branch, number of requests and changed files, the first request (not with keep_prompts = false) and a one-line summary from the AI;
- external connector processes and wtf emit: whatever you pass to them.
AI answers: a category, a description of the activity and a task for each snapshot. With ai.ocr.enabled the text on the snapshot is recognised on this computer (Tesseract) and passed to the AI together with the snapshot.

Where it is stored

	Linux	macOS	Windows
Data: SQLite database, snapshots	`~/.local/share/wtf-im-doing`	`~/Library/Application Support/wtf-im-doing`	`%LOCALAPPDATA%\wtf-im-doing`
Settings: `config.toml`, `rules.toml`	`~/.config/wtf-im-doing`	`~/Library/Application Support/wtf-im-doing`	`%APPDATA%\wtf-im-doing`

The folders can be moved with the WTF_DATA_DIR and WTF_CONFIG_DIR variables.

Snapshots are encrypted (AES-256-GCM) and deleted after screenshots.ttl_days (30 days). The records of activities stay.
Tokens, passwords, the API key and the snapshot encryption key are kept in the system keychain when there is one.
The built-in web interface and wtf serve listen only on 127.0.0.1 and require a token.

What leaves the computer, and only when you turned it on

When	Where to	What
Installing the built-in AI (button or `wtf ai install`)	github.com (llama.cpp), huggingface.co (model)	ordinary download requests; after that the AI runs on this computer. The full installer downloads nothing
`ai.provider = "external"`	your AI server	the window snapshot, the title, the application, recent context and recognised text. A server that is not on this computer is accepted only with `ai.external.allow_remote = true`
`claudecode` with an external AI on another computer and `allow_remote_ai = true`	your AI server	the requests from the Claude Code span, the list of changed files and the agent's last answer, to get the one-line summary. Without `allow_remote_ai` only the AI on this computer writes the summary
Connectors Mattermost, GitHub, GitLab, Jira, YouTrack, ActivityWatch	the address you gave	requests with your token. The service returns your actions, and the program writes nothing there
`[sinks.clickhouse] enabled = true`	your ClickHouse	copies of the records and of the AI answers; the snapshots themselves are not sent, only the file name. A remote server is accepted only with `allow_remote = true`
Update check (`[updates] check`, on by default)	api.github.com	once a day, a request for the latest release of this repository, with no data about you (as with any request, GitHub sees the IP address). The installer is downloaded only when you press the button
MCP (`wtf mcp`)	your MCP client on this computer	whatever the client asks for. After that the client and its model process the data under their own rules. The client can change settings only if this is turned on in “AI → AI agents (MCP)” (off by default)

How to delete everything

Uninstall the application.
Delete both folders from the table above: the uninstaller does not touch them.
Delete the wtf-im-doing entries from the keychain:
- macOS: Keychain Access;
- Windows: Credential Manager;
- Linux: Seahorse or secret-tool clear service wtf-im-doing.

If you turned on autostart, turn it off first in “Settings → Window”.