Can you run a personal time tracker on a work Mac? What to check
· 6 min read
Often, yes. A tracker that needs no special macOS permissions will run on most company Macs where you are allowed to install apps at all. Whether you should is a different question with three parts: what your employer’s policy says, what the Mac’s management setup allows, and who else could read the record you would be creating on a machine you do not own. Check those in order before you install anything.
Find out whether the Mac is managed
A managed Mac is enrolled in a device management system that lets the company configure it remotely. There are two ways to check.
- Open System Settings, General, Device Management. Any installed profiles are listed there. (On macOS 13 Ventura, look under Privacy & Security, Profiles.)
- Or open Terminal and run:
profiles status -type enrollment
It prints two lines, Enrolled via DEP and MDM enrollment, each with a Yes or a No.
If either says Yes, the company can install and remove software, decide which apps are allowed, approve or block privacy permissions in advance, and keep an inventory of what is installed. Assume the list of apps on the Mac is visible to IT.
If both say No, the Mac is still the company’s. The policy applies either way; there is simply less enforcing it.
Read the policy, then ask
Look for an acceptable use policy or a software installation policy. They tend to take one of three forms: only apps from an approved list, anything not expressly prohibited, or ask before installing.
If the answer is not obvious, ask. A request that IT can answer quickly contains four facts:
- What the app does, in one sentence.
- Which macOS permissions it requests.
- Whether it sends any data off the Mac.
- Where it stores what it records.
Something like: “I would like to install a personal time tracker that records which app is in front, by name only. It requests no privacy permissions and keeps its data in a local file. Is that acceptable?” Giving those facts up front saves IT from having to dig them out.
Asking first is also the safer order. Unapproved software on a managed machine is the kind of thing that turns up in an audit months later, when the explanation is harder to give.
Why permissions decide how easy this is
Many trackers ask for Accessibility so they can read window titles, Screen Recording so they can take screenshots, or Full Disk Access. On a company Mac those are exactly the switches IT controls. They may be blocked outright, they may need an administrator password you do not have, and a request to enable them is likely to start a security review.
You can see what is granted on the Mac now under System Settings, Privacy & Security: look at Accessibility, Screen Recording (labeled Screen & System Audio Recording on recent versions), Input Monitoring, Full Disk Access and Automation. What Mac apps can see about you, permission by permission explains each one.
A tracker that asks for none of them has nothing to approve at that layer. Punchcard is in that group: it notices which app is in front, by name, and that needs no macOS permission. The one optional permission is Automation, and only if you switch on “Itemize websites” so that browser time prints as site names. That setting is off by default, and on a work Mac there is a good case for leaving it off, covered below.
Who else could read the record
A local file is not a private file on a computer someone else administers. Anything in your home folder can be read by a person with administrator access, copied by the company’s backup software, and scanned by management or security agents. So the useful question is what the file contains.
Punchcard keeps one SQLite file at ~/Library/Application Support/Punchcard/punchcard.sqlite. It holds app names, minutes and receipts. It never holds window titles, document names, URLs, keystrokes or screen contents, because those are never recorded.
With itemized browsing on, it also holds site names: the bare site, never the full address, path, search terms or page title. Settings has “Hide a website”, which leaves a site off receipts, streaks and the past-days list. Be clear about what that does, though: the record stays in the local file until you delete it. On a Mac you do not control, not collecting the site names at all is the cleaner choice.
The rule that covers every tracker: do not record on a company machine anything you would be uncomfortable having read.
What crosses the company network
Network traffic on a work Mac is often logged, so it is fair to ask what an app sends.
The free version of Punchcard makes no network calls. Tracked data (app names, site names, minutes, receipts) never leaves the Mac in either version. The only network use is the license. Activating a key needs a connection once; it sends the key and the Mac’s name to the payment provider and gets back a yes or no. A licensed copy re-checks silently at launch. On a company Mac, bear in mind that the Mac’s name is often an asset tag or your own name.
Tracking and printing work with no connection, and being offline never locks out a paying customer.
Plan for the day you hand the Mac back
Company Macs get replaced, wiped and returned, sometimes at short notice. If the record matters to you, do not leave the only copy there.
- Export the CSV from time to time. It has one row per session: start, end, app, seconds. Check that taking a file like that off the machine is allowed; some policies restrict moving any file to personal storage.
- Before returning the Mac, “Burn the roll” deletes everything Punchcard has stored.
- The license covers two Macs, so it can come with you. Each Mac keeps its own record; nothing syncs between them.
Moving to a new Mac without losing your time history covers carrying the data across.
Questions
Will IT know I installed it?
On a managed Mac, assume so. Software inventories are a standard part of device management. That is one more reason to ask first.
Is a personal tracker the same thing as employee monitoring software?
No. The difference is who installs it and who reads it. Monitoring software reports to the employer; a personal tracker reports to you. What employee monitoring software sees sets the two side by side.
Can my employer ask to see the record?
Policies and laws vary by workplace and by country, and this is not legal advice. The practical position is simpler: a file on their machine is one they may be able to read, so keep only what you would be content to show.
Would it be simpler to track on my own Mac?
Only if the work happens there. A tracker sees the Mac it runs on, and Punchcard has no iPhone app and no sync. If your working day is on the company Mac, that is where the record has to be made.