Should I vibe code
Track desktop activity categories and provide neutral focus and break reminders
Tracking yourself is a Saturday project. Tracking your colleagues is a surveillance system with its own case law.
?
Their verdict, the Basic price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-04.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
Polling the foreground window every few seconds into a local SQLite file is a real Saturday project with a real payoff, and the categorisation rules are better when you write them yourself, because only you know that "Figma — untitled" at 11pm is not work. Keep it on one machine, for one person, and the worst thing that can happen is you lose a month of history you were never going to read. Two things are worth knowing before you start. The file you are creating is a minute-by-minute list of every document you opened and every URL you visited, which makes it the single most revealing thing on the disk — treat it like a password vault, not like a log. And Rize itself has moved on: it now sells team utilisation and profitability dashboards, and the moment you point your version at a colleague's machine you have stopped building a personal tool and started building workplace monitoring, which comes with works councils, notice requirements and a completely different entry on this site.
What actually breaks
not "if". the specific failures.
- Browser URLs, which are the whole point and the one part the OS will not hand you — every Chrome or Safari update is a chance for your AppleScript or extension to start returning empty strings
- Idle detection, so lunch, a long phone call and a meeting in another room all get filed as ninety minutes of deep focus on whatever was on screen
- The categorisation rules, which drift as your tools change until the report is forty percent "uncategorised" and you stop opening it
- The database, which is one file, on one laptop, with no backup, holding the only copy of two years of history
- Laptop sleep and time zones, which produce sessions that start before they end and days with twenty-six hours in them
- macOS permissions, where accessibility and screen-recording grants get revoked by an OS upgrade and the tracker silently records nothing for a week
Is that you?
the verdict is a default, not a law
- It runs on your machine, for you, and nothing leaves the disk
- You captured window metadata only — app, title, URL — and never pixels or keystrokes
- The exclusion list exists before the first row is written
- You would be relaxed about the database file being read aloud, or it is encrypted
- Anyone else's machine is running the agent, at which point it is employee monitoring and the rules change in most of Europe
- It uploads activity to a server you run, because now the most sensitive file on your laptop has a network path to it
- You are tempted by periodic screenshots — that is a different product and a much worse leak
- The timesheet it produces is going to become an invoice; that is the Harvest entry, not this one
If you build it anyway
the checklist, then the prompt that enforces it
- Local storage, no account, no telemetry. A personal activity log has no business being in someone else's database, including yours.
- Filter at capture, not at display. Password managers, banking domains and private windows should never reach the disk in the first place, because a filter in the UI still leaves the row in the file.
- Capture metadata only — app name, window title, URL. No screenshots, no keystrokes, no clipboard. The value of the extra data is small; the value of the file to a thief is not.
- Encrypt the database at rest, or accept that anyone with the laptop gets a searchable history of everywhere you have been.
- Treat idle as a first-class state: detect it from the OS, and make untracked gaps visible in the report rather than absorbing them into the adjacent session.
- Write the export before the dashboard. CSV or JSON out of your own schema is what makes the project reversible.
- Set a retention policy on day one — raw events aged out after a few months, daily aggregates kept forever. Nobody needs per-minute window titles from 2024.
- If a second person is ever going to run this, stop and read up on workplace monitoring rules where they sit. Consent, notice and a works council are not optional extras there.
I am building an automatic time tracker that watches my own desktop activity.
Everything below is about keeping it a personal tool and keeping the log on
this machine. Push back if I ask for something on this list.
1. Local first: SQLite on disk, no account, no server, no telemetry. If you are
about to add a sync backend or a hosted dashboard, stop and ask me why.
2. Build the exclusion list before the collector. A list of app names, window
title patterns and URL patterns that are never written to disk, applied at
capture time. Seed it with password managers, banking domains and private
browsing windows.
3. Capture window metadata only: app name, window title, active URL. No
screenshots, no keystroke logging, no clipboard reads. If I ask for periodic
screenshots, tell me plainly what that folder is worth to whoever steals the
laptop, and make me confirm.
4. Encrypt the database at rest and keep the key in the OS keychain.
5. Idle detection comes before pretty charts. Use the OS idle timer, and render
untracked gaps as gaps — never extend the last active session over them.
6. Store every event in UTC with the local zone recorded next to it, and prove
the day boundary is right across a DST change and a suspended laptop.
7. Write the CSV/JSON export before the dashboard, so the data is portable from
the first commit.
8. Add a retention job: raw events expire after 90 days, daily aggregates are
kept. Make the window configurable and default it to on.
9. Categorisation rules live in a plain config file I can edit and diff, not in
a table, and unmatched activity shows up as "uncategorised" rather than being
guessed at.
10. Refuse to add multi-user or team reporting. If I ask, tell me that an agent
on someone else's machine is workplace monitoring, and that the legal and
consent work comes before the code.
11. Out of scope on purpose: billing, invoicing, client reports. If timesheets
are going to turn into money, that is a different app with different rules.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
At the second person, or when you get tired of fixing browser URL capture after an OS upgrade. $12.99 a month buys someone else's on-call for exactly the fiddly platform layer that breaks — plus mobile, cross-device history and a categoriser trained on more than your own habits. For one person on one laptop who wants full control of a genuinely sensitive file, the homemade version is competitive and always will be.
$12.99/mo is cheaper than your weekend.
There is nothing to exit — the data is yours, on your disk, in a schema you wrote. Keep a nightly CSV or JSON dump next to the SQLite file and back both up with everything else, and the project can be abandoned without losing the history. If you want out of maintaining the collector, ActivityWatch has the same event model and will happily be the thing that keeps the OS-specific half working while you keep your own reports on top of its data.
Local-first automatic activity tracker with watchers for window titles, browser tabs and AFK state — the same shape as Rize, with the data staying on your machine.
Mature open-source time-tracking application with projects, reports and exports, for the manual-timesheet half of the problem.
Questions
Why is this SHIP IT when Harvest and Clockify are not?
Because nothing downstream consumes the output. Rize's shape is a private mirror: it observes, it reports back to you, and if it is wrong the only person misled is the person who wrote it. Harvest turns hours into an invoice somebody pays and Clockify turns them into a colleague's timesheet — both add a second party who did not choose your code. Keep this single-user and you never cross that line.
How sensitive is a window-title log, really?
More than it feels. "Redundancy_letter_final.docx", the URL of a clinic booking page, the name of a client you have not announced yet, the chat window with a recruiter — all of it in one searchable file, timestamped to the minute. It is not a keylogger, but for the purpose of reconstructing your life it is close enough that the file deserves encryption and an exclusion list.
Can I run this on my team's laptops if I tell them?
Telling them is the start, not the end. In much of Europe, monitoring employees needs a lawful basis, a documented necessity assessment, and often works council agreement before the software is installed; in several US states there are notice requirements too. That is a project with a legal workstream, not a weekend build — and it is the point where paying a vendor who has already done that work stops being a luxury.
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
A window-title log is the most revealing file on your machine. The good news is that yours never has to leave it.
A timer and a table. If you bill from it, treat the table like an accounting record.
Solo it's a timer. With approvals it's the record your client disputes and your team gets paid from.
last reviewed 2026-08-04 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice