Automatic time tracking on a Mac: how it works and what it sees
· 6 min read
Automatic time tracking on a Mac works by listening for which application is in front, and optionally asking macOS for more: window titles, browser URLs, keystrokes, or screenshots. Each extra layer needs a separate permission, and each one sees considerably more of your life than the last. Knowing the tiers tells you what a given tracker can know about you, and what it cannot.
The one signal every tracker starts with
macOS announces it whenever the frontmost application changes. Click from the editor to the browser and the system tells any app that has asked to be notified: the browser is now active. This needs no permission at all. Any app can subscribe to it, and this single signal is the foundation of every automatic tracker.
From that stream of “X became active at 9:14, Y became active at 9:31,” a tracker builds a timeline. Add up the gaps and you get time per app. That is the whole mechanism at the first tier. It knows the app’s name and nothing else: not which file, not which site, not what you typed.
This is where Punchcard stops, deliberately. It records app names only, asks for zero macOS permissions, and at your closing time prints a receipt of the day itemized by app. The rest of this post is about what other trackers add on top, so you can see what you would be trading for it.
Tiers two and three: window titles, then URLs
The next thing a tracker usually wants is the window title, because “Safari” is less useful than “Quarterly budget, Google Sheets.” To read another app’s window title on macOS, an app must be granted Accessibility permission in System Settings, under Privacy & Security.
Accessibility is a broad grant. It was designed for assistive technology, so it lets an app read the text of controls and windows across the whole system and also send synthetic clicks and keystrokes. A tracker that uses it for titles has the same access as one that uses it for anything else; macOS does not offer a “titles only” version. Window titles themselves leak more than people expect: email subjects, document names, the names of people in a chat, the title of every web page.
Time trackers that ask for Accessibility permission goes into what this means in practice.
The third tier adds URLs. Window titles get a tracker most of the way to knowing which website you are on, but some want the actual address. There are two common routes. One is a browser extension that reports the active tab. The other is asking the browser directly through Apple Events (the mechanism behind AppleScript), which triggers an Automation permission prompt the first time for each app being asked.
Either way, the tracker now holds a list of every site you visited while it was running, with timestamps. For a work tracker that is meant to categorize “research” versus “social,” that is the feature. For your privacy, it is a browsing history stored by a third party, and it is worth asking where it is stored and who else can read it. The post on why most time trackers want your window titles covers the storage question.
Tier four: input monitoring, for idle detection
A tracker that wants to know whether you are actually at the keyboard has to watch for keyboard and mouse activity. On macOS this is the Input Monitoring permission. With it, an app can observe keystrokes and pointer movement system-wide. Most trackers that use it say they only look at whether any event happened, not which key, and that is usually true, but the permission itself does not enforce that distinction.
Idle detection is genuinely useful for timer-based tools, which otherwise run on through lunch. It matters less for a tracker that records the frontmost app, since a sleeping Mac has no frontmost app. Punchcard has no idle detection settings; if you leave an app in front and walk away, that app is what the receipt will show, and the fix is to lock the screen when you step out.
Tier five: screenshots, via Screen Recording
At the top of the stack are trackers that take periodic screenshots. These need Screen Recording permission, which allows an app to capture the contents of the whole display at any time. This is the category of software employers install on company machines, and it is the one a personal tracker should never need. A screenshot contains everything on screen: the message you had not sent yet, the bank tab, the private window. Why a time tracker should never need Screen Recording makes the case at length.
How to tell which tier a tracker is in
You do not have to take anyone’s word for it. macOS shows you.
- Open System Settings, then Privacy & Security.
- Check Accessibility, Input Monitoring, Screen Recording, Automation and Full Disk Access in turn. Any tracker listed under one of these has asked for that access.
- If the tracker was installed recently, watch for the permission prompts at first launch. A prompt is the app asking; you can decline and see what still works.
- For network activity, look for the app in the Network tab of Activity Monitor after it has run for a while. Bytes sent mean something is leaving the Mac.
A tracker that appears in none of these lists and sends no bytes is tier one: app names, kept locally. Punchcard is in that category, and goes one step further, in that the release build contains no networking code at all and is set up to fail if a networking symbol appears. There is no account to create and nothing leaves the Mac.
What no tier can see
Whichever tier a tracker is in, it is watching the computer, not you. Nobody’s tracker knows that the hour in the editor was productive or that the hour in the browser was research. It does not know you were on the phone, that the meeting ran over, or that you were thinking. Every number an automatic tracker produces is a number about the Mac’s front window, and the interpretation is yours.
That is a limitation worth embracing rather than fighting. A record of apps and hours, read by the person who lived the day, is enough to answer “where did it go.” Adding titles, URLs and screenshots makes the record more detailed without making it more true. Automatic time tracking accuracy goes further into what the numbers can and cannot carry.
Questions
Does a tracker with no permissions really work? Yes, for app-level tracking. The frontmost-application notification is public to every app on macOS. What a zero-permission tracker cannot do is read titles, URLs, keystrokes or the screen, which is precisely why it needs no permission.
Can I revoke a permission after granting it? Yes. System Settings, Privacy & Security, then the relevant list; turn the app off. The tracker will usually fall back to app names or stop working, depending on how it was built. Nothing already recorded is removed by revoking the permission; check the app for a delete option. Punchcard’s is called Burn the roll and removes everything.
What about browser time? Is “Safari, three hours” useful? Less than a URL breakdown, more than nothing. Most people know what they were doing in the browser for three hours when they see the line. If you genuinely need per-site numbers, you are choosing a tracker with Accessibility or an extension, and the trade is the one described above.
Where is the data kept? It depends on the tier. Cloud-based trackers sync to their servers, which is how they offer dashboards from any device. Local ones keep a file on the Mac. Punchcard keeps a single SQLite file at ~/Library/Application Support/Punchcard/punchcard.sqlite and exports CSV from the app.