Is Dayflow safe? What a screen-recording time tracker can and can't see

Short answer: yes - and you should not take our word for it, because you don’t have to. Dayflow is open source under the MIT license, so every claim below is verifiable in the public source code (6,600+ stars on GitHub).

An app that records your screen deserves a skeptical look. Here is exactly what Dayflow does with what it sees.

Where the recordings live

Dayflow captures your screen at about one frame every 10 seconds and stores those recordings, plus the timeline database built from them, locally on your Mac. There is no Dayflow cloud, no account, and no sign-up. Delete the app and its data folder and the record is gone.

What leaves your Mac (and what never does)

The one nuance worth understanding is AI processing. Dayflow needs a language model to turn screen activity into readable summaries, and you choose where that model runs:

• Local mode (Ollama or LM Studio): analysis happens on your Mac. Nothing - not recordings, not summaries, not metadata - leaves your machine. This is the configuration to pick if “airgapped from everyone including us” is your bar.
• Bring your own key (Gemini, ChatGPT, or Claude): periodic screenshots are sent to that provider for analysis under your own API agreement with them. Recordings still live only on your Mac.
• Dayflow Pro: the same as bring-your-own-key, except Dayflow’s key does the work so there is no setup.

That choice is yours at setup and reversible at any time in settings.

What Dayflow can see - and what it can’t

With macOS screen-recording permission, Dayflow sees what is on your screen while it runs, which is what makes the timeline honest. It does not log keystrokes, does not read files, does not capture your camera or microphone, and stops seeing anything the moment you pause it or quit. Sensitive session? Pause it. It is your journal, not a compliance tool - there is no admin, no employer dashboard, and no one to report to. That difference is the entire subject of time tracking without surveillance.

How the claims stay honest

Closed-source trackers ask you to trust a privacy policy. Dayflow’s architecture is inspectable: the recording pipeline, the storage paths, and the network calls are all in the open repository, and a community of thousands of developers has eyes on it. “Audit the code yourself” is a real option, and for the rest of us, the fact that anyone can is the deterrent that matters.

The practical footprint

Safety also means “safe to leave running”: Dayflow uses roughly 100MB of RAM and under 1% CPU, because one frame every 10 seconds is a trickle, not a video stream. Battery impact is negligible - the full battery breakdown is here.

If your question was “is it safe to let this thing watch my screen,” the honest summary is: it watches locally, it forgets nothing but shares nothing, and the code that proves it is public.