Privacy Policy

Last updated: June 21, 2026

BiBoTracking is local-first. Activity is captured and stored on each device, and only synced to a backend that the workspace owner controls. This policy explains what is collected, where it lives, and what we never do.

Who this applies to

This policy covers the BiBoTracking desktop app (macOS & Windows), the web dashboard, the browser extension, and the hosted service at bibotracker.com. If you self-host BiBoTracking, the organization running it is the data controller and its own policies apply.

What the desktop app captures

When tracking is enabled by a workspace owner, the desktop app may record:

• active app & window titles and the time spent in them;
• keystroke volume — counts only, never the keys themselves (no keylogging);
• periodic screenshots (configurable, and can be turned off);
• browser activity (page URL, title, time on page) via the extension.

What is captured is governed by a per-workspace policy. Owners decide what is on.

Where data is stored

Activity is stored locally on each device first. Syncing that data to a backend is the workspace owner's choice. In the hosted service, synced data is stored in a Postgres database operated for that workspace; access is always scoped so an owner only ever sees their own workspace's data. If you self-host, all data lives in your own infrastructure.

The browser extension

The extension observes the active tab and sends each completed visit (URL, title, start time, time on page, browser name) only to the BiBoTracking desktop app on the same computer, over the loopback address http://127.0.0.1. That address is not reachable from the network or the internet. The extension does not read page content, form inputs, passwords, cookies, or keystrokes, and it uses no analytics, ads, or third-party SDKs.

What we never do

• We don't sell, rent, or share your activity data with third parties.
• We don't transmit your captured activity to the developer when you self-host.
• We don't use advertising networks or third-party trackers inside the apps.
• We don't capture keystroke content, passwords, or clipboard data.

This website & cookies

This marketing website (bibotracker.com) uses privacy-respecting analytics (Google Analytics) to understand aggregate traffic — pages viewed, approximate region, device type. This is about site visitors, and is separate from any tracking data captured by the apps. The web dashboard uses only the cookies/local storage needed to keep you signed in.

Consent & intended use

BiBoTracking is intended for workplace or family use with the knowledge and consent of the people using the device, in line with the deploying organization's policies and applicable local laws. Organizations are responsible for notifying users and obtaining any consent required in their jurisdiction.

Data retention & your rights

For the hosted service, workspace owners can delete activity, screenshots, members, and entire workspaces; deletion removes the associated data. To request access to, or deletion of, data that concerns you, contact the owner of your workspace, or us at the email below.

Children

BiBoTracking is not directed to children, and we do not knowingly collect personal information from children. The optional "family" workspace mode is a tool operated by a parent or guardian for their own household.

Source code & verification

Because the apps are open source, the most reliable way to verify these claims is to read the code: github.com/ngnclht1102/bibo-emplooyee-tracking.

Changes to this policy

If this policy changes, we'll update the "Last updated" date above and publish the revised version at this URL.

Contact

For any privacy questions or requests, contact:

• Email: [email protected]
• Telegram: @bibotracker

© 2026 BiBoTracking · bibotracker.com