Privacy
Upstream is a focus tracker, not a surveillance tool. Here's exactly what we collect, what we don't, and why you can trust us.
Your data stays on your machine
Upstream's desktop app processes all activity data locally. App names, window titles, and focus time are computed on your device. Nothing is uploaded until it's anonymized and aggregated into hourly buckets.
We never see your screen
Upstream does not take screenshots, record keystrokes, or capture any content from your windows. We only record which app you're using (e.g. 'VS Code') and whether you're focused — not what's inside it.
What we store in the cloud
Your Supabase database stores: your email (from sign-in), your project names, session durations, verified/unverified status, distraction domains you've blocked, and hourly-bucketed app usage summaries. That's it. No raw window titles, no file contents, no code.
Open source, verifiable
The entire Upstream codebase is open source at github.com/DanisChaparov/upstream-app. You can audit exactly what the desktop app monitors, what data it sends, and how the backend processes it. No black boxes. No hidden telemetry.
Row-Level Security on all data
Every database table is protected by Supabase RLS policies. User A cannot read User B's data — not even accidentally. The only exception is the public Developer Twin, which is an explicit opt-in setting you control.
You can delete everything
Delete your account at any time from Settings. All your sessions, projects, and profile data are permanently removed from the database. The desktop app stores nothing — it's a thin client.
Questions? Open an issue on GitHub.