Automated Processing Notice
What changed in v1.1 (2026-09-09). Two corrections, both already shipped in the product. (1) Section 4 said the app never read a web address beyond what the title bar showed. It does read one — it asks the browser for the address of the tab in front of you — so Section 4 now describes that read, what is kept from it, and the condition under which it happens. (2) A diagnostic recorder in the desktop app had been writing raw window titles and website names to a file on the worker's own computer, keeping them for 30 days. Nothing left the device and nothing was transmitted, but no version of this notice disclosed it and Section 9 said the opposite. That recorder is now off unless the worker switches it on, TimerOS Desktop deletes records left by earlier versions the first time it starts, and Section 9 describes it.
Issued by: Vezoft EOOD, trading as "Vezoft" Applies to: the on-device two-layer activity classifier in the TimerOS desktop application Companion documents: Privacy Policy Section 3, AI Transparency Notice, Model Card, Subprocessors
One-paragraph summary for workers. TimerOS decides whether your current window is "productive" or "idle" entirely on your own device. Classification uses a built-in list of well-known work and non-work apps and websites, combined with a small on-device classifier that runs locally inside the desktop app — there is no cloud AI service, no model download, and no large language model involved. Your raw window titles and application names are never sent off your device for classification, and any corrections you make to teach the system are stored only on your machine. The system improves itself privately on your computer as you use it; nothing about what you read, write, or watch leaves the device through this feature. No decision with legal or significant effects on you is taken solely on the basis of these labels.
1. Purpose of this notice
This document is a standalone transparency notice about automated processing performed by the activity classifier in TimerOS Desktop. It is published to satisfy:
- Article 22 GDPR — the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you;
- Articles 13 and 14 GDPR — the right to information about automated decision-making and the logic involved;
- Article 5(1)(a) GDPR — the principle of transparency;
- Articles 13 and 50 of the EU AI Act — provider transparency obligations for AI systems that interact with natural persons;
- equivalent provisions of the UK GDPR, the CCPA/CPRA (California), and the comprehensive state privacy laws of Colorado, Connecticut, Utah, Virginia, Texas, and Oregon.
It is written in plain language for end-users (workers using TimerOS at work) and for the privacy, security, and works-council reviewers of B2B customers evaluating the product. A more technical companion is the Model Card; the broader feature-level write-up is the AI Transparency Notice.
2. What the classifier does, in one paragraph
While the timer is running, the TimerOS desktop app reads the title of your foreground window and the name of the application that owns that window, feeds those two strings into an on-device classifier, and produces a single label — typically productive or idle — together with a confidence score. The label is used to update the colour of the timer bar, to break your tracked time into "productive" and "idle" buckets in your timesheet, and to drive your live "is active now" status visible to your manager. The inputs are discarded from memory after each classification. The label and the aggregate hour totals are the only outputs that may leave your machine, and only to your employer's TimerOS workspace.
3. The two layers, in plain language
The classifier runs in two layers, both of which execute on your own computer inside the TimerOS desktop application. There is no separate inference server and no network call made by either layer.
3.1 Layer 1 — Scored rule engine
The first layer is a deterministic pattern matcher. It compares the app name and window title against built-in lists of well-known work apps and titles (IDEs, design tools, ticketing systems, repository hosts) and well-known non-work ones (video streaming, social media, gaming). Each signal is weighted, with higher weight given to exact app-name matches and lower weight to window-title matches (the latter being the main signal for browsers, where the application name says nothing about the open tab). The engine also takes into account overlap between the window title and the names of your assigned projects or current tasks, and meaningful words from your job title (with a stopword filter so generic words like "manager" or "senior" don't dominate).
The engine sums the weighted signals and returns a label, a confidence score, a source tag, and a short human-readable reason string. If no signal matches at all, the engine returns nothing confident and the second layer takes over.
3.2 Layer 2 — Small on-device statistical classifier
The second layer is a small on-device statistical classifier — productive vs idle — that runs as a fallback when the rule engine has no confident signal. It is not a large language model, not generative AI, and not a downloaded third-party model. The model file is only a few tens of kilobytes in size.
- Inputs. A small set of weights over tokens from the app name and the window title. All tokens are lowercased.
- Training. The model is trained on your device from a built-in seed dataset (compiled into the desktop application) plus any corrections you record.
- Local adaptation. Any correction you record through the desktop UI is appended to a bounded local-only list of your corrections, and the model is retrained on seed plus corrections, so it adapts to your workstation over time without ever sending those corrections anywhere.
- Output. A label, a source tag indicating the model layer produced it, and a confidence score so the timer bar always has something to display.
The trained model and your corrections are stored only locally on your computer.
We maintain a model card and an EU AI Act applicability assessment for the classifier, available to competent authorities on request.
4. What the classifier reads, and what it does not read
| Input read by the classifier | Where it comes from | What happens to it |
|---|---|---|
| The title of the currently foreground window | Your operating system | Held in memory for the duration of one classification, then discarded |
| The name of the application that owns that window | Same | Same |
| The address of the active tab, when the foreground window is a supported Chromium-based browser | Requested from the browser itself through the operating system's accessibility interface. This is a real read of the address, not of the title bar | Reduced immediately to the site name (e.g. nova.bg) and the first section of the path (e.g. console), and the section only when it looks like a word rather than an identifier. The rest — deeper path, query string, fragment — is dropped at the moment of reading: never classified, never stored, never transmitted |
| Your assigned projects, current tasks, job title | The TimerOS API, fetched when you log in and refreshed periodically | Held in memory as context for the rule engine; not derived from the window |
When the browser address is read at all. Only while the timer is running, only outside Manual mode, never while your workstation is locked, never during a break you have declared, and only when at least one of the following is true:
- your employer has configured at least one website classification rule — a rule that marks a site as productive or idle by its domain; or
- automatic task assignment is switched on for you, which uses the site as a hint about which task you are on. This is on by default, so on a fresh install this second condition is met until you change it. You can switch it off at any time in Settings → Activity Detection → Automatically assign tracked time to tasks; it is your setting, not your employer's. With it off and no website rule configured, the read never happens.
Browsers outside the Chromium family are not read at all.
| The classifier does not read, capture, transmit, or store | Confirmation |
|---|---|
| Screenshots or video of your screen | Not implemented anywhere in the classifier code path |
| Audio from your microphone, or video from your camera | Not implemented |
| Keystrokes, the content of what you type, or clipboard data | Not implemented |
| The body or content of documents, emails, chats, web pages, or PDFs | Not implemented — only the window's own title bar is read |
| Your browsing history or your bookmarks | Not implemented — the browser is asked only what the tab in front of you is showing right now. Where you have been is never queried |
| The full web address of anything you visit | Not retained — see the address row above. The address is reduced to site name plus first path section at the moment of reading and the remainder is dropped in memory. It is never written down and never sent anywhere |
| The address of any tab that is not in the foreground, or of any other browser window | Not implemented |
Browser-internal pages (chrome://, edge://, devtools://) and local files (file://) |
Not implemented — these are rejected before anything is extracted, because a page such as chrome://settings/passwords is browser maintenance and not work |
| Files on disk, network shares, or environment variables of other processes | Not implemented |
| Anything from any process other than the one currently in the foreground | Not implemented |
There is no large language model, no downloaded model, no GPU dependency, and no outbound network call from the classifier. The earlier exploratory design that contemplated a locally-running large language model has been removed; the current architecture is strictly stronger for privacy and auditability.
5. Where the processing happens and what leaves your device
| Stage | Location | Leaves your device? |
|---|---|---|
| Read window title and app name | Your computer's memory | No |
| Run the rule engine | Your computer, in-process | No |
| Run the on-device classifier fallback (if active) | Your computer, in-process | No |
| Store the trained model | Locally on your computer | No |
| Store user corrections | Locally on your computer | No |
| Emit the resulting label and confidence | Sent to the TimerOS API only as part of time-entry telemetry — never the raw title or app name | Yes (label only) |
The classifier code itself never opens a network socket. Other parts of the desktop app may separately transmit the result (a category label such as productive and its confidence) to your employer's TimerOS workspace, because the label is what your timesheet is made of — but the underlying window title and application name remain on your device.
6. Determinism and reproducibility
For a given installed version of TimerOS Desktop, both layers are deterministic. The same (app name, window title) input — with the same project/task context for the rule engine — always produces the same label, the same confidence, and the same reason string. This matters in three ways:
- Auditability. If you or your employer ever question how a particular minute of your time was classified, the answer is reproducible. We can re-run the classifier against the same input and get the same output without depending on a remote service whose behaviour may have drifted.
- No silent change. The model weights ship inside the installer. We cannot quietly update the classifier's behaviour from a server. New behaviour requires a new desktop release with its own version number and its own changelog entry.
- Explainability. Every result carries a source tag and a short reason string, so even non-technical reviewers can see why a label was assigned.
7. Article 22 GDPR — no solely-automated decision with legal or significant effects
The classifier does not, by itself, produce any decision about you that has legal or similarly significant effects within the meaning of Article 22(1) GDPR.
- The classifier outputs a descriptive label about your current foreground window, not an evaluative judgement about you as a worker.
- Decisions about your employment, pay, working hours, discipline, promotion, performance rating, or continued engagement must, under the TimerOS Terms of Service and the Customer Data Processing Agreement, be taken by a human manager based on broader evidence — not on the classifier's output alone. This is a contractual restriction on every TimerOS customer.
- The classifier does not aggregate labels into a "productivity score" that is then used to rank, sort, or compare workers. Such a feature is not implemented.
- The classifier does not feed any external HR, payroll, or workforce-analytics system without your employer's deliberate configuration of an integration, and any such integration is documented in your employer's monitoring notice (see the internal monitoring-notice templates maintained by Vezoft for Customer reference).
If your employer were to use the classifier's output as the sole basis for a decision that produces legal or significant effects on you — for example, terminating your contract because a daily idle percentage crosses a threshold, with no human review — that would be a use outside the contractual scope of TimerOS and would also be a likely breach of Article 22 by your employer. You can complain to your employer's privacy contact, to TimerOS at privacy@timeros.ai, and to your local data protection authority.
8. Legal basis for the on-device processing
The processing performed by the classifier on your device falls into the broader workplace-monitoring lawful basis chosen by your employer (the controller) and disclosed in your local monitoring notice. The two bases relied upon in practice are:
- Article 6(1)(b) GDPR — performance of a contract to which the data subject is party (your employment or services contract), where time tracking is part of the agreed deliverable (typical for hourly contractors and remote workers); or
- Article 6(1)(f) GDPR — legitimate interests of the employer in accurate time tracking, project costing, and client billing, balanced against your rights and freedoms through the safeguards listed below.
TimerOS, as processor, does not select the lawful basis — the controller does, and discloses it in the monitoring notice it gives you. The safeguards that make the legitimate-interest balancing test defensible include: on-device processing, no content capture, no screenshot or keystroke logging, the rights listed in Section 10 below, the determinism property in Section 6, and the contractual prohibition on solely-automated decisions in Section 7.
No special categories of personal data (Article 9 GDPR) are intentionally processed by the classifier. If a window title incidentally reveals a special category — for example, the URL of a health-related article in a browser tab — the title is held in memory for one classification cycle and discarded; it is not sent off device, and not used to train any model except your own local corrections list if you choose to record a correction. It is written to disk only where you have switched on Diagnostic recording (Section 9), which is off unless you do.
9. Retention
| What | Where stored | How long | How to delete |
|---|---|---|---|
| The raw window title, the app name, and the browser site name and path section | Process memory only | Discarded immediately after each classification cycle (a few milliseconds) | Already discarded; nothing to do |
| A running count of minutes per application and per website name for the current session — names and totals only: no titles, no times of day, no sequence | Process memory only. Used to offer you a list of the apps and sites the timer has seen when you set up a project's detection signals | Cleared when the timer stops, and when the app closes | Stop the timer |
| Diagnostic recording, where you have switched it on: one line per check holding the raw window title, the site name and path section, what the classifier decided and why, and how long you had been idle | A file on your own computer, in the TimerOS application-data folder. Never transmitted to anyone | Off unless you switch it on. While on: 30 days, then removed automatically | Switch it off in Settings → Activity Detection → Diagnostic recording. That deletes the records immediately — it does not merely stop adding to them. Uninstalling TimerOS Desktop also removes them |
| The trained on-device model | Locally on your computer | Until you uninstall TimerOS Desktop | Switch Tracking mode to Rule-based or Manual to stop using it; it is removed when you uninstall TimerOS Desktop |
| Your local corrections | Locally on your computer, as a bounded list (older entries are removed as new ones are added) | Until you uninstall TimerOS Desktop | Removed when you uninstall TimerOS Desktop |
| The resulting label sent to your employer's workspace | The MongoDB Atlas cluster operated for your employer's tenant | Per your employer's retention policy, typically the statutory payroll-record period (typically 5–10 years in the EU) | Contact your employer; TimerOS will support a verified erasure or rectification request |
The locally-stored model, corrections and any diagnostic records never leave your device. Uninstalling TimerOS Desktop removes them.
A correction about earlier versions. Until desktop v1.19.2, the diagnostic recorder described above ran for everyone, with no setting to switch it off, and neither this notice nor the Privacy Policy disclosed it — both said the raw window title was held in memory only. The records never left the worker's computer and were never transmitted to Vezoft, to any employer, or to anyone else, and they were already capped at 30 days. From v1.19.2 the recorder is off unless the worker turns it on, and the app deletes records left by an earlier version the first time it starts. If you want to know whether your machine held such a file, or you have one and want it explained, write to privacy@timeros.ai — this material falls under the access right in Section 10.
10. Your rights, and how to exercise them
You have, at minimum, the following rights with respect to the classifier:
- Right to be informed — this notice, the Privacy Policy, and your employer's monitoring notice.
- Right to human intervention (Article 22(3) GDPR). You may ask, at any time, that any assessment about you that referenced the classifier's output be reviewed by a human — typically your manager or your employer's HR contact. TimerOS will assist if asked.
- Right to express your point of view and contest the result (Article 22(3) GDPR). If you disagree with a label, you can record a correction directly in the desktop app. The correction takes precedence in any aggregation, is stored only on your device, and is used to retrain your local model.
- Right to opt out of the AI layer. In Settings → Activity Detection → Tracking mode, you can switch from Automatic to Rule-based — the on-device AI/ML layer is turned off and only the deterministic rule engine classifies your activity — or to Manual, where there is no automatic classification at all and you set your own state. The timer bar continues to function in every mode.
- Right to stop monitoring temporarily. Stop the timer. While stopped, the classifier is not running, no window titles are read, and no labels are produced.
- Right to rectification (Article 16 GDPR) of any labels that have already been sent to your employer's workspace. Contact your employer; TimerOS will support the request.
- Right to erasure (Article 17 GDPR) of stored labels, subject to your employer's statutory retention obligations.
- Right to lodge a complaint with your local data protection authority. A list is at edpb.europa.eu/about-edpb/about-edpb/members_en. You do not need to contact us or your employer first.
To exercise these rights with respect to TimerOS as a service provider: privacy@timeros.ai. With respect to your employer (the controller of your workplace data): contact the privacy or HR contact named in your local monitoring notice.
11. How to correct a classification
If the classifier labels something incorrectly — for example, a code-editor window labelled "idle" because you were reading on screen and not typing, or a video tutorial labelled "idle" when you were watching it as part of your work — you can correct it:
- Open the dashboard window and go to Settings → Activity Detection.
- Under Current Activity, review the current app/window and its label.
- Click Mark Productive or Mark Idle to correct it.
The correction is stored only locally on your computer. The next time the on-device classifier retrains in the background, it incorporates your correction so the same app and title will be classified correctly in future. Corrections train the on-device AI model, so they apply in Automatic mode; they never leave your device, and are erased when you uninstall TimerOS Desktop.
12. How to turn off the AI layer
The on-device AI/ML layer is optional. You can turn it off without disabling the rest of TimerOS:
- Open the dashboard window.
- Go to Settings → Activity Detection → Tracking mode.
- Choose Rule-based (deterministic rules only, AI off) — or Manual (no automatic classification; you set your own Productive/Break state).
In Rule-based mode:
- The classifier uses only the deterministic scored rule engine.
- When the rule engine has no confident match, the activity is left unclassified rather than guessed — it is not recorded as
productive. - Your on-device model and corrections remain stored locally (they simply aren't used) and are removed when you uninstall TimerOS Desktop. You can switch back to Automatic at any time.
13. Storage sub-processor for the resulting label
The label produced by the classifier, once transmitted as part of your timesheet, is stored in the MongoDB Atlas database operated for your employer's tenant. The relevant facts for transparency:
- Sub-processor legal entity: MongoDB, Inc., 1633 Broadway, 38th Floor, New York, NY 10019, USA; EEA contracting via MongoDB Ltd (Ireland).
- Data Processing Agreement: the MongoDB DPA is auto-incorporated into the Cloud Terms of Service, with the EU 2021 Standard Contractual Clauses (Module 2 controller-to-processor and Module 3 processor-to-processor), the UK IDTA addendum, Swiss FADP modifications, and EU-US Data Privacy Framework certification.
- Region pinning. For EU customers, the Atlas cluster is a dedicated tier (M10+) pinned to an EU region —
aws-eu-central-1(Frankfurt) oraws-eu-west-1(Ireland) — with AES-256 encryption at rest, so data at rest does not leave the EU. Atlas does not auto-route based on caller geography; the region is selected in the tenant-provisioning code path. - Operational access. MongoDB operates "follow-the-sun" support through the affiliate entities set out in MongoDB's published affiliate list. The SCCs cover those transfers.
- Downstream chain. Our EU Atlas clusters run on top of AWS in the EU (Frankfurt / Ireland). The current full sub-processor list is maintained at timeros.ai/legal/subprocessors and changes are notified via the DPA's change-notice mechanism with a 30-day objection window.
A dated PDF snapshot of the current MongoDB DPA is archived in legal/vendors/ for the Article 30 records of processing.
14. Where this notice is surfaced
This notice is linked from:
- the Privacy Policy (Section 3, "About the AI activity classifier");
- the desktop app's Settings → Activity Detection panel (a "Learn more" link opens the published version of this document);
- the desktop app's first-run onboarding screen (a "How is my activity classified?" link);
- the AI Transparency Notice for B2B customers;
- the Model Card for technical reviewers.
15. Changes to this notice
Material changes to the classifier — adding a new input signal, changing what the classifier reads, changing where it runs, adding a new layer, changing the lawful basis — are notified to Customers via the DPA's change-notice mechanism with at least 30 days' advance notice, and to end-users via the desktop app's onboarding screen on first run after the change. Non-material changes (clarifications, formatting, typo fixes) are published with an updated version line at the top.
16. Contact
- Privacy and data-subject requests: privacy@timeros.ai
- Security incidents: security@timeros.ai
- General support: support@timeros.ai
- Postal: Vezoft, with registered office in Kardzhali, Bulgaria (see Imprint for the full registered address)
- EU Representative: Not required — Vezoft is established in Bulgaria (EU Member State).
- Data Protection Officer: Not appointed — Vezoft is below the thresholds in GDPR Art. 37(1)(b) and (c).