Privacy first architecture
What DoneThat captures, what it never captures, and every switch you have over it.
Complete control over when tracking happens. Pause at any time to ensure sensitive work or personal time is never captured.
Tracking
Active during work hours
Granular control over which applications are tracked. Excluded tools are "greyed out" in the screenshot before sending for processing.
Common exclusions:
Excluded windows are greyed out locally before processing.
Prefer not to capture your whole desktop? Install the Chrome extension to record only what happens in the browser, leaving everything outside Chrome untouched.
It is a lighter-weight option for people who do most of their work in the browser or want to strictly limit what DoneThat can see.
Your browser workspace
DoneThatBrowser capture
Only Chrome tabs
Want complete control over raw data processing? You can bring your own LLM for the initial sensitive parts of the processing pipeline.
When you enable BYO AI, your raw activity data goes directly to your chosen provider, not through our AI partners. We support:
Inspect the source code to verify all promises made here. Use Claude to audit the code if you are not technical yourself.
If you want to inspect how the BYO LLM flow works end to end, start with the public desktop repository.
Add custom instructions for what Don should look out for when summarizing your activity.
These instructions live under Recording settings and can be managed by your organization.
Custom instructions
…/500Saved
All DoneThat data storage, compute, and default AI processing runs in the EU on Google Cloud and Google Vertex AI. This boundary is part of the architecture, not a setting you can switch.
This is always the case for the default DoneThat pipeline. See our subprocessors for more details.
After daily processing, you can permanently redact activity titles, activity descriptions, and stored task descriptions independently.
Redaction reduces what future features can work with, so each layer has its own explicit setting.
Redact activity titles
Redact activity descriptions
Redact task descriptions
Full control over your summaries. Review, edit, or delete any entry at any time, before or after finalization.
Push to SlackShared views report how your time was split as relative percentages, not absolute hours. Others see where your focus went without seeing exactly how long you worked.
Share time as relative percentages
Applies to every shared summary
Half the week was other people's calendars.
Half the week was other people's calendars.
Choose who can see your feed and summaries. Visibility is one overall account setting, not something configured separately for each day.
Audience
Only you and approved followers can see your summaries.
We run regular AI-assisted penetration tests with Loki Intelligence across the end-to-end data flow, including summary sharing and team visibility.
This gives us an outside check on the privacy and security assumptions described here, not just an internal review of the architecture.
DoneThat EUdatacenterScroll through the complete flow. Raw input is short-lived; you stay in control of the useful result.
Screenshots and activity logs are captured locally when tracking is not paused. Raw inputs are processed in real time and discarded rather than stored. If you only want to capture browser activity, you can record with the Chrome extension instead.
The journey starts on your laptop. Before anything is sent for analysis, excluded apps are redacted as configured in app exclusions.
If you have access to your own LLMs, the app can send raw activity data and our default prompt to your Gemini or OpenAI-compatible model instead. Only the resulting structured activity data reaches our servers. See BYO LLMs and prompting.
You can verify the full BYO LLM flow in our open source desktop section above. The local capture layer is the part you should be able to inspect directly.
By default we use our AI providers to process raw data. They do not store it, do not use it for training, and run behind our privacy-focused prompting. The default pipeline is European. Provider details are listed in Subprocessors.
Structured activity data is stored on our EU-hosted servers. That enables summary review, editing, sharing, and the rest of the product.
Every day, either when you click "Finish Day" or around midnight, we generate a raw summary from that day's activity data.
Each raw summary is made of bullet points representing tasks with a title, short description, and classification.
After generation of the bullet points, we optionally redact all activity descriptions if you chose to redact as configured in redactions.
If you generate the summary with the "Finish Day" button, you can review all bullet points before finalizing.
Midnight summaries are automatically finalized, but you can still edit summaries later or delete both summary elements and activity data.
Once finalized, summaries are visible only to the people you allow via visibility, such as followers or your team. You can also share only relative percentages rather than absolute time.
We also cover this end-to-end data flow with regular security testing.
DoneThat is designed to comply with privacy and data protection regulations worldwide.
Enterprise-Grade Security Standards. While we are currently working towards formal ISO 27001 certification for the coming year, our infrastructure is already built on these industry best practices:
Infrastructure:
Hosted on ISO 27001-certified Google Cloud Platform servers in Europe.
Encryption:
All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
Authentication:
Secure OAuth-based authentication with Google.
API Security:
All API keys (including BYO LLM keys) are encrypted locally before transmission and storage.
Vetted Partners:
We strictly vet all AI subprocessors for security and privacy compliance.
Models Used:
We utilize industry-leading Large Language Models (LLMs) via API, including Gemini 2.5 Flash and Gemini 2.5 Flash Lite. We do not train our own foundational models.
Input Data:
Screenshots and activity logs are captured locally and processed in real-time. Raw data is never stored, only derived insights are kept.
Accuracy:
We run continuous evals to ensure accuracy and regularly sense-check with users.
Known Limitation:
Multitasking during the five-minute timeframes can get lost, however sampling at this iteration should still give accurate info.
Verification:
Users review and finalize all AI-generated summaries. The system is non-deterministic, meaning results vary slightly for the same input.
Optimization:
We employ best practices in prompting and use strict output schemas to minimize variance and force predictable results.
Your Data, Your Control. We designed our architecture to minimize risk from day one.
Low-Risk Transfers:
We process raw data (screenshots) in real-time and immediately delete it. Because we don't store the sensitive raw inputs, the risk of international data transfer is drastically reduced.
Full Ownership:
You have the absolute right to access, edit, or delete your data at any time.
Clear Roles:
We clearly define our role as a "Processor" acting on your behalf, with standard EU protections in place.
Responsible AI by Design. We take a "safety-first" approach to AI regulation.
Proactive Compliance:
Regardless of technical classification, we voluntarily follow high-risk standards for data governance and risk management to ensure maximum safety.
Human in the Loop:
AI never has the final say. Users always review and approve summaries, ensuring no automated decisions affect you without oversight.
Transparency:
We are 100% open about when and how AI is used to process your activity.
Meeting the "Objective, Reliable, and Accessible" Standard.
Objective:
Our system captures work hours automatically, reducing human error and forgotten timesheets.
Reliable:
We combine automation with human review. You can manually add offline work or correct AI misclassifications, ensuring the record is always accurate.
Accessible:
Every employee has instant access to their own time records, fulfilling the court's requirement for transparency.
Employee-First Privacy. Built to respect the world's strictest worker protection laws.
Works Council Ready:
We support the mandatory co-determination process. The tool cannot be rolled out for monitoring without Works Council agreement.
Ferngeheimnis Safe:
Our "App Exclusion" feature ensures private apps (like WhatsApp or Webmail) are never recorded, protecting your private communications.
We spell out what stays local, what gets processed, and what you share. Download the app and run it on your terms.
