Four steps, end to end. The teammate starts the session, screenshots are captured locally, they review and approve, and only what they share reaches the manager. Privacy isn’t a setting — it’s the order of operations.
Tracking only begins when the teammate explicitly taps Start from the menu bar — never on launch, never on a manager's button.
While a session is active, AllyTracker grabs a screenshot of the active window every N minutes (default 10, adjustable from 5 to 30).
Every capture lands in a review tray on the teammate's machine before anything is shared.
When the teammate approves a screenshot, it's encrypted, uploaded, and added to the manager's review gallery alongside the session's tracked time.
Every removed capture quietly drops its own interval out of the session's paid total.
Tracking only begins when the teammate explicitly taps Start from the menu bar — never on launch, never on a manager's button. The session shows a live indicator that stays visible for the whole session, and Pause/End are one click away. The clock is in their hands.
While a session is active, AllyTracker grabs a screenshot of the active window every N minutes (default 10, adjustable from 5 to 30). Each capture is stored locally first — never uploaded automatically. Idle for 5 minutes? The timer auto-pauses, so no captures happen for time the teammate isn't actually working.
Every capture lands in a review tray on the teammate's machine before anything is shared. They scroll through, see exactly what each one shows, and tap Remove on anything personal, sensitive, or just messy. Removal is permanent — the file is deleted from disk, never uploaded, never recoverable.
When the teammate approves a screenshot, it's encrypted, uploaded, and added to the manager's review gallery alongside the session's tracked time. Admins see the timer total, the approved captures, and the privacy stats — never the originals, never anything the teammate removed.
Every removed capture quietly drops its own interval out of the session's paid total. Removed a 10-minute screenshot? Paid hours go down by 10 minutes. The teammate sees the exact deduction before they confirm Remove — no surprise paychecks — and the admin's dashboard shows the breakdown ("8h 30m tracked − 30m removed = 8h 0m paid"). The privacy promise stays intact: admins never see what was removed, just that a deduction happened.
If the teammate hasn't tapped Start, the app isn't watching. There is no background daemon scanning the screen, no auto-resume after sleep, no remote enable.
When a teammate removes a screenshot from their review tray, the file is permanently deleted from local storage. There is no admin override, no cloud backup, no "trash" you can recover from.
Until a teammate approves a screenshot, it does not exist as far as the admin dashboard is concerned. The split is enforced at the database level — not by app convention.
We don't ship features that bypass the consent flow — no "silent capture" mode, no "emergency unlock," no off-the-record session. If we ever shipped one, you'd be reading about it here, with a removal date.
The privacy promise has to cut both ways. If a teammate can quietly remove a capture, the matching minutes have to quietly drop out of the paid total — otherwise the privacy feature becomes a gaming tool. The deduction is shown to the teammate before they confirm, shown to the manager as an aggregate ("30m deducted"), and never reveals what was actually in the removed capture.