Where your tasks and notes actually live

Focusbox is a local-first focus app. By default, your tasks and notes don't live in someone's cloud — they live in a single file on your own disk, with no account to create and nothing tracked.

That's the default, not a setting you have to hunt for. When you open the app it just writes to your own machine. There's no sign-up, no telemetry, no analytics pinging home about how you use it. If you deleted your internet connection forever, Focusbox would keep working exactly the same.

The code is also public, under the Focusbox Community License (free for personal and internal use). It's on GitHub, so you can read exactly what it does, check that the claims on this page are true, and build it yourself if you want to. "Trust me" is a lot weaker than "here's the source."

If you do want your work on more than one device, there's optional cloud sync, and I've tried to be precise about how it works. It's end-to-end encrypted: your tasks, notes, and settings are encrypted on your device before they leave it, so the server only ever holds encrypted blobs. It never receives your password or your keys, which means I can't read your data — this is what "zero-knowledge" means in practice.

One honest caveat on tiers. The web app uses the same end-to-end encryption, but the signed desktop app is the strongest tier, and it's the one I'd recommend if your notes are genuinely sensitive. Same encryption, slightly different threat model. You can read the full plain-language version on the privacy page.

Sync is the only paid part, and it's entirely optional. The app itself stays free, local-first, and open. That ordering is on purpose: your data is yours first, and the cloud is just a convenience you can switch on if you ever need it.

What “local-first” actually means here

The phrase gets used loosely, so here's the specific claim. Focusbox is not a web app in a desktop wrapper that needs a server to function. The app is the source of truth. It reads and writes a file on your disk, and every feature — timer, tasks, notes, settings, themes — works with the network unplugged, forever, with no degraded mode and no read-only state.

Contrast that with cloud-first tools that keep a local cache: there the server owns your data and your machine holds a copy. If the company folds, the copy usually stops being useful. Here it's the other way around. Sync, when you turn it on, is a mechanism for two local files to agree with each other — not the place your work lives.

Where the file is

Your tasks, notes, and settings live in one JSON file named focusbox.json, in the standard per-app data directory for your OS:

• macOS — ~/Library/Application Support/com.mathiass.focusbox/focusbox.json
• Windows — %APPDATA%\com.mathiass.focusbox\focusbox.json

You can open it in a text editor and read it. You can copy it to a new machine. You can put it in your own backup, or in a folder that something else syncs. Nothing is obfuscated and nothing is locked to the app — if Focusbox disappeared tomorrow, your notes would still be a readable file you own.

In the browser version the equivalent store is your browser's own local storage for the site, which is per-browser and per-device rather than a file you can hand around.

What gets sent, and when

With sync off — the default — nothing. No account, no telemetry, no analytics, no crash reporting, no fonts or scripts fetched from a third party at runtime. The one exception is the update check: the desktop app asks GitHub whether a newer release exists, which means GitHub sees a request. You can decline the update; the check is a version lookup, not a report about you.

With sync on, encrypted blobs go to the sync server, plus the metadata any HTTPS request necessarily involves: your account email, timestamps, and roughly how big the blob is. Not the contents. The encryption keys are derived on your device from your password, and neither the password nor the keys are ever transmitted — that's what makes it zero-knowledge rather than merely encrypted-in-transit.

The practical consequence: if you forget your sync password, I can't recover your data, because I don't have anything capable of decrypting it. That's the cost of the guarantee, and it's the right way round.

“Source-available”, not open-source — the honest wording

The code is public and readable on GitHub, and it's licensed under the Focusbox Community License: free for personal and internal use, free to build from source, free to redistribute. What it doesn't grant is commercial resale or rebranding — selling it, or shipping it as your own product, needs a commercial licence.

That means it doesn't meet the OSI definition of open source, and I'd rather say so than stretch the word. “Source-available” is the accurate term. What it buys you as a user is the part that actually matters here: verifiability. Every privacy claim on this page can be checked against the code instead of taken on faith, and you can build the binary yourself if you don't want to trust mine.

Why any of this matters for a timer

It's fair to ask. A countdown and a to-do list aren't state secrets. But the notepad is a different thing: what goes into a scratch page during work is half-formed decisions, numbers you shouldn't have written down, things about people. It's the least curated and most revealing text most of us produce.

A tool that holds that shouldn't require an account to open, shouldn't upload it by default, and shouldn't be able to read it if you do ask it to sync. That's the whole argument, and it's why the defaults are the way they are rather than being a privacy mode you have to find.

Questions

Does Focusbox work offline?

Completely, and indefinitely. There's no account, no activation, and no feature that waits on a server. Sync is the only part that uses the network, and it's optional.

Can I back up or move my data myself?

Yes — copy focusbox.json from the app data directory listed above. It's plain JSON, so you can read it, archive it, or move it to another machine.

Is Focusbox open source?

The source is public and you can build it yourself, but the licence restricts commercial resale, so the accurate term is source-available rather than open-source.

Can you read my notes if I turn on sync?

No. Encryption happens on your device and the keys never leave it, so the server only stores blobs. The trade-off is that a forgotten sync password can't be recovered.

Is there any tracking or analytics?

None. No telemetry, no analytics, no crash reporting. The only outbound request with sync off is the desktop app's update check against GitHub.