A time tracker that takes no screenshots

The trackers that record your hours without a timer mostly pay for it in surveillance: screens grabbed on an interval, keystrokes counted, a productivity score attached to your name. BillNotch records the same hours from a much smaller observation — which window is in front of you, and for how long. It is not a screenshot feature left switched off. The capability is absent from the app.

no screenshots · no keystrokes · no webcam

Is there really no screenshot anywhere?

There is nothing to disable. The desktop app has no screen-capture path, no image encoder and nowhere to put an image if it had one — no bucket, no viewer, no “screenshots” tab in anyone’s dashboard. An account owner cannot enable it for the team, and support cannot enable it for an account, because the feature was never built.

One honest wrinkle, because you will see it and deserve the explanation: on macOS the app asks for the Screen Recording permission. That is Apple’s doing. Since macOS 10.15 the titles of other applications’ windows sit behind that one permission, and titles are exactly what the tracker reads — without it every entry collapses to a bare app name. BillNotch asks for it once, at the moment tracking actually starts, reads a string, and never takes a frame. On Windows and Linux no such permission is involved.

What it records instead

That is a smaller record than a screenshot by an enormous margin, and it is enough to bill from. How the automatic capture works follows one afternoon from the window title to the PDF invoice.

Where the window titles go

A window title is not nothing. “Q3 layoffs — Google Docs” tells a story, and a tracker that shipped every title upstream by default would have replaced one surveillance problem with a quieter one. So the sync mode is a per-device setting, and a fresh install starts on the careful option rather than the convenient one.

The default is smart: a matcher runs on your own machine against your own project list, and anything it can place is redacted before upload to whichever of your own words it matched — the keyword that hit, or the project name when the name itself is what matched. The bulk of a normal day is known work, so the bulk of a normal day never leaves as raw text. Only the windows it could not place still carry their title, so the server has something to sort them by. Full sends every title, which you choose deliberately if you want the categorization to be as sharp as possible. Local only is the strict version of smart: a matched stretch still uploads the matched label and its project, and an unmatched stretch uploads only the application’s name — “Chrome”, “Slack”, or “Unknown app” when even that is unavailable. No raw window title ever crosses the wire in that mode.

The same instinct governs the browser extension: it reports github.com and the seconds you spent there, with the path and query string discarded on your machine before the segment is even written down. Full URLs and tab titles each have their own switch, both off until you turn them on. With them off those fields are not blanked — they are absent from the request.

Does an AI model read all this?

This is where most privacy pages get vague, so here is the mechanism, including the part that involves a model. Sorting activity into projects runs in stages, and the early stages make no external call at all. The on-device keyword matcher stamps a project before upload when it is confident. A learned rule — your own past correction, replayed — settles anything you have decided before. What is left goes to a similarity check against the entries you already confirmed, using a local embedder that turns a string into a vector by hashing its features: deterministic, no credentials, no network. Your titles are matched against your own history, on the server that already holds them.

Only genuinely novel activity — work none of that recognises — can reach a large language model, and only in the suggestion pass you trigger from the Review screen, never in the upload path the desktop app uses. The model is an adapter: on billnotch.com one is configured, and self-hosted with no API key it is absent from the chain entirely and a deterministic keyword matcher takes its place, which is the path the test suite exercises on every commit. If you want the question settled rather than trusted, local-only mode means the strings that would reach it are the ones you named yourself.

Be equally clear about what is a draft and what is not. The on-device matcher and a learned rule both write a project straight onto the entry — that is the point of them, and both are your own words applied to your own work. The similarity stage and the model do not: their guesses land as drafts on the Review screen, and stay drafts until you confirm them.

What a manager can and cannot see

In a team workspace this is the question that actually matters, and the answer starts with a deliberate gap in the permission model: the plain member role does not carry the permission to view anyone else’s time. A member sees their own entries, reviews their own drafts, and reports on their own hours. Seeing the whole workspace is a separate permission an owner has to grant.

And when it is granted, what it opens is a timesheet: hours by project, by client, by day, with utilization on top. There is no screenshot gallery to scroll, no video to scrub, no activity percentage next to a person’s name. Management here means reading a total, which is the thing a manager needed in the first place.

The tools that do take screenshots

Worth naming plainly, because they are honest about it and you should be able to compare. Hubstaff sells a time tracker with screenshots taken on an interval, with blurring and frequency controls for the administrator. Time Doctor documents a screencasts feature that captures screens or short videos at random intervals, and shows keyboard and mouse activity counts beside them. Both can be configured down, and both are configured by whoever runs the account rather than by the person being recorded.

That is a real product, sold to a real buyer: an employer who needs an evidentiary record of a workforce. BillNotch is built for the other buyer — the freelancer or small studio where the person tracked and the person billing are the same person, or trust each other enough that a picture of the screen would be an insult rather than a control.

What it will not do for you

Be clear about what “no screenshots” is not. It is not “no capture”. On the machine you install it on, BillNotch records the foreground application and its window title, continuously, for as long as tracking is on — that is how passive tracking works, and any tool claiming to fill a timesheet by itself without observing something is claiming something else. The promise here is narrower and checkable: no images of your screen, no keystrokes, no webcam or microphone, and a per-device choice about whether the title text ever leaves you.

Nor is it an anti-surveillance guarantee for employees of someone else. If you are a member of a workspace whose owner grants the workspace-wide view permission and whose devices sync titles, an admin can read your entries and the titles attached to them. That is a smaller exposure than a screenshot reel, and the permission is visible in the role editor rather than buried — but it is real, and pretending otherwise would be the kind of claim this page exists to avoid.

The rest of the list: it is hosted software, not something you run on your own server; the tracker only ever sees the machine it is installed on; there is no mobile app; and there is no free tier — 14 days, then $9 a month.