Privacy Policy

This policy explains what data the Attentus desktop application and the Attentus browser extension (the “extension”) handle, why, and where it goes. Attentus is a focus tool that uses an on-device AI model to decide whether a newly created web tab matches what you said you’re working on, and redirects or closes that tab when it doesn’t.

1. Our core principle: nothing leaves your device

Attentus was deliberately built without a cloud backend for content analysis. The AI model that evaluates your tabs runs entirely on your own hardware. It does not run on our servers, not on any third-party cloud service. The browser extension is a thin “handle” that lets the local app classify and act on newly created tabs during an active focus session. Chromium and Firefox use the browser’s Native Messaging interface to reach a local Attentus helper; Safari uses its native extension handler. Each path exchanges direct replies with the Attentus app over an owner-only Unix-domain socket with no HTTP listener or network service.

This is not just a policy commitment. It is architecture. There is no server endpoint that could receive your browsing data even if we wanted one.

2. What the extension accesses

During an active focus session, the extension classifies only the first accessible http:// or https:// page loaded in each newly created tab. A content script on HTTP and HTTPS pages initially sends only a page-ready signal without page content. Only after the local app confirms that the tab belongs to the current session does the extension read and pass the following data to the local Attentus app:

The extension does not enumerate all open tabs and does not inspect whether a browser window is private or incognito. If you grant the extension access in your browser’s private-browsing mode, the same new-tab workflow can operate there.

This information is sent only to the Attentus app through a direct, in-memory request and reply. Browser-page payloads are not placed in mailbox files, written to disk, retried after a failed transaction, or transmitted over the network. After classification, the extension verifies that the page has not navigated before it applies any redirect or close action to that same tab.

3. What we do not collect

• We do not transmit your browsing history, page content, or screenshots to Attentus servers or to anyone else.
• We do not sell or share your data with third parties.
• We do not use the data for advertising, profiling, or any purpose unrelated to enforcing your focus session on your own device.
• There is no analytics SDK, telemetry, crash reporting, or usage tracking in either the app or the extension.
• There is no session replay, heatmapping, A/B testing framework, or any third-party script with access to your activity.
• We do not use any cloud AI service (OpenAI, Google, Anthropic, etc.) to process your tabs. The model is a local file on your disk.

Chrome Web Store Limited Use: The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

4. The AI model runs on your hardware

When Attentus evaluates a tab, here is the complete data path:

1. A content script in a newly created web tab sends a page-ready signal. The local app must confirm an active matching focus session before the script reads page data.
2. The extension gathers the bounded URL, title, and rendered text. It may also capture the visible page only when that exact tab is already active; it never activates a background tab.
3. Chromium and Firefox pass one direct Native Messaging request through the local Attentus helper; Safari passes it through its native extension handler. The request reaches the app over an owner-only local socket.
4. The app passes the transient page data to its local model (≈ 3.3 GB, installed in the private Attentus Application Support directory) running on your GPU or CPU.
5. The model returns a neutral, focused, or distracting classification, and the app replies directly with any action for the same tab.
6. The page payload is released with that transaction. No browser-page payload file or server copy is created.

At no step does any of your tab data leave your machine. You can confirm this yourself with a network monitor such as Little Snitch: classifying a tab causes no outbound network connection.

5. The app’s network activity

The Attentus desktop app makes anonymous, download-only HTTPS GET requests to receive public update information and signed files. These requests contain no request body, cookies, account identifier, device identifier, browsing activity, focus data, or telemetry. Its entire outbound surface is two hosts, plus a connection that never leaves your computer:

• App updates: anonymous, download-only GET requests to attentus.app for public update information and, when a newer version exists, the cryptographically signed update files. The same release information is available to every user; no account or device identifier is included.
• AI model download: a resumable, on-demand fetch of the verified ≈ 3.3 GB model archive from atentus.tech (a Cloudflare-backed static file host we run purely to serve the model). The verified model files are installed in Attentus’s private Application Support directory, and the request carries no account or browsing data.
• Local only: Chromium and Firefox use browser Native Messaging, and Safari uses its native extension handler, to exchange browser decisions with the app through a protected local socket. That traffic stays on your own machine and never reaches the network.

Authentication starts in your browser and is completed by the app. When Attentus needs to confirm your subscription, it opens your normal web browser, carrying only a one-time nonce and anonymous, one-way device codes in the URL fragment. A fragment is not sent in the initial web request or in a Referer; the page copies it into tab-scoped session storage for no more than 15 minutes and immediately removes it from the address bar and browser-history entry before authentication or activation. The browser then submits those codes over TLS to mint a short-lived handoff code. The app redeems that opaque code over TLS and verifies the returned signed license locally. The request contains no browsing history, focus goals, screenshots, or session data.

There are no analytics, no telemetry, and no error beacons. The app contains no tracking code of any kind.

Website download counts

When someone chooses the macOS installer, the website sends an anonymous GET request to the same fixed, read-only release endpoint used for updates. Attentus does not create an application-level per-visitor download record or connect the request to an account, trial, subscription, or app activity.

Don’t take our word for it. Verify it. A network monitor such as Little Snitch will show Attentus contacting only attentus.app (updates) and atentus.tech (the one-time model download), while tab classification itself causes no outbound connection. For full proof of content, route the app through a TLS-intercepting proxy (e.g. mitmproxy, Charles, or Proxyman): because you own your machine, you can decrypt your own traffic and read every request. You will see plain download requests and no upload of your data. Encryption hides traffic from third parties, never from you.

6. Account data, authentication & payments

Attentus uses two third-party services for account management and billing. Neither service has any access to your browsing data, tab screenshots, or focus sessions. Those never leave your machine. Your account identity and your usage are architecturally separate: Clerk knows your email, not your tabs. Stripe knows your card, not your focus goals.

Authentication: Clerk

When you create an Attentus account (optional during the trial and required to subscribe; the 7-day trial works with no account at all), your sign-up is handled by Clerk, a third-party authentication provider. Clerk holds:

• Your email address and the authentication method you chose (email & password, or OAuth via Google/Apple).
• Session tokens used to keep you signed in.
• A cached subscription status (trial / active / expired) that Attentus updates from Stripe webhooks.

Attentus does not pass any browsing history, tab data, focus goals, or session content to Clerk. Our servers also store private account-security and billing identifiers needed to bind devices, prevent trial abuse, and open your billing portal. Clerk is governed by its own Privacy Policy.

Payments: Stripe

Account-bound trials and subscriptions are processed by Stripe. If you bind an anonymous trial to an Attentus account, we create a Stripe customer and cardless trial subscription using your account email and the exact remaining trial time. When you add a payment method, you are redirected to a Stripe-hosted page. Attentus never sees your card number or full payment details. Stripe handles the transaction entirely. Stripe holds:

• Your account/billing email and, only if you add one, the tokenised payment method (card type and last 4 digits, never the full number).
• Transaction history for your subscription (charges, refunds, invoices).
• Billing address, if you chose to enter one during checkout.

Attentus receives subscription lifecycle events from Stripe—including trial, payment, renewal, and cancellation status—and caches the minimum state needed to issue offline access. If no payment method is added, an account-bound trial cancels automatically at its exact end; it never creates an unpaid charge. Stripe is governed by its own Privacy Policy.

The 7-day free trial

The free trial requires no account and no payment method. A temporary anonymous token is minted for your device and verified locally by the app. Our server retains only peppered device hashes and the trial window, not the token or raw hardware identifiers. No name or email is required. If you later sign up for an account while time remains, that exact remaining window moves to a cardless Stripe trial; creating an account never restarts it. Without an account it expires silently after 7 days.

7. Data retention

Tab URLs, page titles, rendered page text, screenshots, and focus-session content are processed transiently by the local app and are never retained beyond what the app needs for the originating classification transaction. Because nothing is uploaded, there is no server-side copy of your browsing activity to retain or delete.

Account data (email, plan status) is retained by Clerk for as long as your account exists. Payment records are retained by Stripe as required by financial regulations. You can request account deletion at any time by contacting us at dev@attentus.app.

8. Children’s privacy

Attentus is a productivity tool intended for general audiences and is not directed at children under 13. We do not knowingly collect personal information from children.

9. Changes to this policy

If we change how data is handled, we will update this page and revise the “Last updated” date above. Material changes will be communicated in the app and in the extension listing.

10. Contact

Questions about this policy or your data? Email dev@attentus.app.