FocusTube measures your attention without a server in sight. Here's exactly where data lives, what syncs, what never leaves, and why the architecture makes lying impossible.
Local is an architecture, not a promise
“Your data never leaves your device” is easy to say and easy to fake. The only version that means anything is architectural: there is no endpoint to send data to. FocusTube has no backend, no analytics endpoint, no crash reporter, no update ping. The extension's network surface — visible to any inspector in the manifest — is YouTube's public pages and, if you enable summaries, your chosen AI provider. That's the entire list.
Blocking, scoring, ring math, streak ledgers, heatmaps: all computed on-device, from history stored in chrome.storage.local. Unplug the network after install and every feature except AI summaries and folder sync keeps working identically.
What sync means when there's no cloud
People reasonably assume sync requires a server. FocusTube's cross-browser sync instead uses the File System Access API: you pick a folder — a local directory, a Dropbox mount, a USB drive, anything — and the extension keeps one small JSON file per month in it, union-merging changes across every browser pointed at the same folder. The "cloud" is a folder you administer.
The files are deliberately boring: plain, readable JSON keyed by local dates. A monthly file is a portable archive that never grows unbounded, and picking the folder into a fresh install imports everything already there. v1.8.4 extended this to a local-first model — activity records even when no file is connected, marked "Saved locally," merged on reconnection.
The exclusion list
v1.8.4's privacy note is worth quoting in spirit: API keys, passwords, emails, browser and session state, file handles and runtime timer state are explicitly excluded from the portable file. Sync payloads carry usage statistics and safe preferences — never credentials. The accountability pairing feature goes further: only ring counts leave the device at all, in a checksummed, tamper-evident card you paste to a partner by hand.
There's a design principle underneath the list: data minimization isn't a checkbox, it's a habit. Every new feature must argue its way into the payload, and most lose the argument.
Permissions, explained one by one
The manifest requests storage, tabs, scripting, activeTab, tabGroups, notifications, declarativeNetRequest, idle and alarms. Each exists for a named feature — the security page lists them with reasons. The one people ask about is host access to all URLs: that's the universal site blocker and the floating companion working on any page you choose to protect. It is not a license to read your banking; the content scripts' actual behavior is in the repo, readable line by line.
That's the final privacy feature, and the strongest one: you don't have to trust the description, because the product ships as inspectable source.
