# Stuđiô v0.7.0 privacy notes

There is no Stuđiô server or analytics SDK. App data is in Chrome extension-local storage, without application-level encryption. Optional website tracking estimates foreground browser use, not whole-device screen time or other apps. Neither timer nor website records prove attention or productivity.

## Optional website tracking

Off by default, requiring a click and optional **tabs** and **idle** access. Tab metadata is used to obtain the active HTTP(S) site's hostname in the focused normal browser window. No Chrome history API, historical visit import, website host permissions, or content scripts are used. Private tabs/windows and browser/file pages are excluded.

The separate local store contains daily hostname totals (subdomains included) and a hostname/time/session cursor for recovering from service-worker suspension. Full URLs, query strings, paths, titles, content, and screenshots are never persisted. Up to seven local-calendar days are retained and pruned on the next tracker check, capped at 100 distinct hostnames per day; overflow contributes only to an aggregate total. A random recovery-session ID lives in Chrome session storage and prevents backfilling a new browser session.

Website data is not sent to Gemini and is excluded from learned memory, task/timer evidence, diagnostics (including opted-in debug text), and app backups. Tracking is independent of focus timers and makes no network requests.

Pause stops collection and keeps saved totals, discarding the unfinished interval. Clear tracking data asks for confirmation, permanently removes all website totals, and pauses tracking. Erase local data clears them too. Backup restore pauses tracking without importing or deleting local website totals. Optional permission grants remain until revoked through Chrome; revoking access stops collection. Previously exported tasks and memory are unaffected.

The display is an estimate: samples occur on browser events and about once a minute. No input for 60 seconds reports idle and stops further counting, so passive reading/video may be undercounted. Browser UI use can remain attributed to the active website. Long gaps over 90 seconds are skipped. No inference of attention, productivity, or health is made.

## Data sent to Gemini

All AI requests use Google's Interactions API with `store: false`. Assistance requires a named user action. **Learn from my activity**, off by default, separately authorizes background memory requests.

| Operation | Request data |
| --- | --- |
| Connection/model test | Small fixed prompt; no instructions, tasks, or memories. |
| Single capture | Entered note and prompt time/default duration context. |
| Multiple-block capture | Note, timezone/time, focus/workday settings, buffers, and nearby busy intervals; no existing task records directly. |
| Plan explanation | Proposal and task titles, estimates, deadlines, priority, and energy. |
| Reflection | Aggregate timer/task statistics; no task records directly. |
| Guide me brainstorming | Submitted reflection, up to 20 active tasks with short notes, upcoming blocks, timer totals. |
| Suggest my next step | Current task/schedule/timer snapshot. |
| Opted-in learning update | Up to 40 pending evidence events, all saved-memory texts/status/topics, enabled Custom Instructions. |

Saved enabled Custom Instructions accompany assistance and learning updates, in full up to 10,000 characters. Unsubmitted drafts are not sent. Task details you write there are consequently sent too.

**Use saved memory in assistance** defaults on and selects up to eight relevant explicit/confirmed/supported entries with up to 4,000 text characters. Expired, tentative, and conflict entries are excluded. Reflection selects only explicit/confirmed preferences. Memories can contain task details even when raw task records are excluded.

Disabling saved memory in assistance does not disable the updater's access to existing memories. Turn learning off to stop updates too. Saving the local guided form, manual memory edits, settings, exports, local scheduling, and timer operations make no direct AI call. Eligible task/timer evidence may later be sent if learning is enabled.

## Evidence and user control

Learning starts with new activity after opt-in: saved task titles/estimates, changed-field names and before/after durations, reviewed block-duration edits, task completion, recorded timer outcomes, and notes explicitly submitted for learning (up to 1,600 characters). Historic activity, old feedback, diagnostics, unsubmitted forms, and planning-chat text are not imported.

Accepted Gemini drafts, user edits, and timer events have distinct provenance. The model is instructed not to infer health, personality, motivation, attention, or measured device usage. Local count thresholds do not prove an observation true; inspect and correct entries.

Updates can change only the separate learned store. They cannot overwrite Custom Instructions or explicit/confirmed entries; conflicts wait for review. Inferred preferences remain tentative until confirmed. There is no model-weight training.

Pausing learning invalidates in-flight results, deletes unprocessed evidence, and keeps saved entries/supporting history. Re-enabling starts with future events. Data already sent cannot be recalled.

Forget purges the entry, its memory revisions, and supporting learning evidence. Non-text fingerprints suppress exact regeneration. This does not delete original tasks/timer history, other entries, previous exports, opted-in debug copies, or provider-held data. New evidence could support a similar inference.

Clear learned data removes entries, evidence, memory history, and context traces, and pauses learning. Quota/backoff counters remain to avoid unintended repeated calls. Custom Instructions and tasks remain. Erase local data additionally clears app tasks/history, instructions, diagnostics/text consent, and credentials.

Retention is bounded: 100 memories, 500 evidence events, 40 memory changes. Old evidence/history can age out. Context explanations reference memory IDs, not extra copies of text, and edits invalidate them.

## Keys, quotas, and provider terms

Keys live in Chrome session storage unless Remember on this device is selected. A remembered key is stored in extension-local storage. It is sent only to the configured Gemini host in the `x-goog-api-key` header, never a URL, and excluded from backups as a credential field.

Free-tier availability/billing depend on the Google project. A free-tier model does not make a paid project free. `store: false` disables Interactions storage, not other data handling. Google's [pricing page](https://ai.google.dev/gemini-api/docs/pricing) states that free-tier content may be used to improve its products. Submit content only if you accept applicable terms.

The memory updater allows at most three requests per local day, including failures, and at most one automatic batch. Other explicit Gemini actions have no app-enforced daily cap. The counter does not know remaining project quota. There is no automatic model switching.

## Diagnostics and backups

The last 20 attempts are kept locally. By default reports include technical metadata/counts, not text.

Include prompt and custom instructions in debug reports is off by default. When on, future reports can include prompts (30,000 characters), instructions (10,000), selected-memory context (10,000), and provider errors (4,000). Learning-update prompts can contain activity evidence and existing entries. Truncation is marked.

Active and recognizable Gemini keys are redacted on logging/export. Complete provider bodies, request headers, and model output are excluded. Turning debug text off purges text and blocks in-flight restoration of it. Clearing diagnostics does likewise. Previously downloaded reports are separate files.

Export downloads JSON, uploads nothing, and makes no API call. Inspect optional text before sharing. Diagnostics are never learning evidence.

App backups include tasks, schedule, settings, instructions, task/timer history, feedback, memories, and evidence. They exclude credentials, diagnostics/settings, updater jobs/quota, memory undo history, and context traces. Restore writes app/memory together, pauses learning, and retains device quota/backoff. Imported memory-use choices are retained, so enabled memories can accompany the next assistance request.

Arbitrary text in tasks, feedback, and Custom Instructions is not automatically scrubbed for credentials in backups. Do not paste keys there. Memory/debug redaction is a best-effort guard, not encryption or data-loss prevention.

This is evaluation software. It imports no external conversation history or user profile automatically.