Choosing what a work tracker can see
Work records can pick up client names, internal document titles and links that carry login tokens. Before you turn a tracker on, it helps to know what it reads, what it keeps and which switch controls each source. This is how Hina's defaults and switches work.
What Hina records by default
Out of the box, Hina records which app is in front, for how long, and the number of key presses, clicks and scrolls, sampled every 3 seconds. The key count is a number only. Hina does not read or store what you typed. It also tracks a few on-or-off states, such as whether the microphone or camera is in use and whether the window is fullscreen, without recording anything the microphone hears or the camera sees.
The only permission it asks for is Accessibility, which macOS requires for reading the front window. It does not ask for screen recording, and it takes no screenshots. Window titles and document paths stay off until you open Settings, Privacy and turn on Record window titles and page paths, so a fresh install holds only app names, durations, input counts and those few states.
That default is useful on its own. The Trail lists the apps you used in order, and the Day view splits the day by app and category. Titles add the ability to tell two Figma files or two repositories apart, which is also the point where the privacy questions start.
What the title switch adds, and what Hina trims
With the switch on, Hina reads the front window's title and, where the app exposes one, its document path. For browsers it keeps the address as scheme, host and path only. The query string, the fragment and any username or password in the address are dropped before anything reaches the database, because that is where magic links, OAuth codes and signed download URLs keep their secrets. A web address that cannot be parsed cleanly is discarded instead of stored.
If you turn the switch off later, new capture stops and existing records remain.
Three more rules apply once titles are on. Password managers such as 1Password, Bitwarden, KeePassXC, LastPass and Keychain Access always record the app name only, and there is no switch for it. Their time still counts, so the Trail shows no unexplained gap. Private browsing windows keep the app name only while App name only for private windows is on, which is the default. And Hide titles containing these words takes a pattern such as bank|private, so any window whose title matches keeps just the app name.
Apps you do not want recorded at all
Some apps should leave no trace, not even a name. Right-click an entry in the Trail and choose Stop recording followed by the app's name. Hina then records nothing for that app, and it appears under Ignored apps in Settings, Privacy, where Resume recording undoes the choice.
Ignoring is different from hiding a title. An ignored app leaves no record, so an hour spent in it becomes a gap in the day. A window with a hidden title still counts toward that app's time. If a client's name appears in many titles, a title pattern keeps the time and removes the name. If the app itself is the problem, ignore it.
Local histories are separate, default-off sources
Hina can also read three local sources, each behind its own switch in Settings, Privacy and each off by default. Read agent sessions covers Claude Code and Codex. It takes your own prompts, the session times, the working directory, the branch and the file paths that edit tools touched. For Cursor it takes only the text of your prompts. It does not read the assistant's replies or tool output, and a prompt that looks like it carries a credential, such as a token, a password, an email address or a license key, is skipped whole.
Read shell history keeps the command and a recognized subcommand, such as brew install or make verify, and drops the arguments. A line containing words like token, password or api_key is dropped whole, and so is a line that starts with an environment variable assignment. A script path is cut down to its filename. AI usage metadata takes only model names, project paths, timestamps and token counts from the same Claude Code and Codex logs. These histories are read when they are needed and are not copied into Hina's own database.
Git works differently. Hina scans no repository until you choose project folders under Settings, Data, Project folders used in reports, and it reads only the local commits in those folders. It does not query GitHub.
Checking what is stored, and clearing it
Settings, Privacy has See what has been saved, which lists the latest three records for the selected day with their titles and paths. After a normal day of work, that is the quickest way to see real rows. Under Settings, Data, Export CSV writes your records to a file and Show in Finder reveals the database at ~/Library/Application Support/Hina/hina.sqlite.
Clear records under Usage records deletes Hina's own records and pauses recording until you resume it. It does not touch AI conversation files, your repositories or files you exported. Deleting the app does not remove the database either, so clear the records first if you want them gone.
What leaves the Mac, and when Hina is the wrong tool
Recording, search, charts and reports work without a network connection. The app contacts the network in three places, and only when you click. Opening the purchase page in your browser is one. Activating a purchased key is another, which sends the key and a device label to the payment provider. The third is Check for Updates, which reads a small version file from hina.day. None of these requests carries activity records, and there is no background check. Hina itself does not send your records to a server or a cloud AI.
Anything you copy or export sits outside that boundary. A report pasted into an AI assistant, or output from the Hina command line handed to Claude Code or Codex, falls under that tool's privacy terms. If your work rules forbid keeping any activity log at all, even a local one, a tracker is the wrong tool and you should check what kind of time record your work rules permit before using a manual timer.