Attain · Privacy
Privacy Policy
Attain records structure and metadata about work activity. It does not record the content of that work. This page states exactly where that line falls, field by field, and what enforces it.
1The governing principle
The agent records structure and metadata about activity: which application and site is in use, how much input activity occurred, what kind of action was taken, and when.
It does not record the content of that activity. Not the characters typed, not what was copied, not what a document says, not what is on screen, and not what was said on a call.
How measurement works without keeping content
Where the agent must touch content in order to measure or classify it — for example to tell whether a clipboard item is an email address, or to recognise a repeated template — that content is read transiently in memory, reduced to a type, a length and an irreversible fingerprint, and then discarded. It is never written to disk and never transmitted.
2What is recorded
Every record carries a timestamp and the application involved. This is the complete list.
| Area | What is recorded |
|---|---|
| Active window | The application, the window title text, and for browsers the domain only — for example github.com, with no query string. Paths are normalised so /invoices/12345 becomes /invoices/:id. |
| Keyboard | Whether a key was alphanumeric, a named special key such as Enter or Tab, or a command shortcut such as Ctrl+C, plus which modifier keys were held. Typed characters are discarded at the point of capture. |
| Mouse | Movement segments, clicks and scrolls, with coordinates, distance and duration. |
| Clipboard | That a copy, cut or paste happened; the shape of the item (text, number, email, url, file, image); its character count; and an irreversible fingerprint so a copy can be matched to its later paste. |
| On-screen controls | The type of control used (button, link, menu item) and its accessible label, subject to the redaction rules below. |
| File activity | The action (open, save, download), the file extension only, and an irreversible hash of the containing folder. Never file names, never file contents. |
| Typing bursts | The length and an irreversible fingerprint of a completed field, to detect repeated boilerplate. Skipped entirely for password and secure fields. |
| Meetings | That a call started or ended and the platform — Zoom, Teams, Meet and so on. Detected from the operating system's microphone-in-use flag. No audio, no video, no participants. |
| AI assistants | That a session started or ended and which tool. Never prompts or responses. |
| Session markers | Start, pause, resume, idle, lock, unlock, sleep, wake, and a presence heartbeat roughly every minute while the machine is awake and unlocked. |
| Identity | The enrolled person's work email, their recorded consent version and timestamp, the agent build and operating system. |
Two points worth stating plainly
Window titles are stored as written. This is the one field that keeps literal text, and a title can incidentally contain a document name, an email subject or a client name. It is the largest single disclosure in this list and we would rather say so here than have you discover it.
On Attain's own web properties — hirexe.com and attainhq.ai — the full page path is kept rather than just the domain. Query strings are still stripped. This is first-party product analytics and it is a deliberate exception to the domain-only rule everywhere else.
3How keyboard capture works
This is the part most often misunderstood, so it is stated exactly. When a key is pressed, the agent classifies it as one of three things.
| Classification | What is kept |
|---|---|
| Shortcut | A command modifier was held — Ctrl, Alt, Cmd or Win. The key identity is kept, because Ctrl+C denotes the command copy rather than the letter c. This is what lets the agent see that a copy, paste, undo or save happened. |
| Special | A named non-character key: Enter, Tab, Backspace, Escape, Delete, arrows, function keys. Kept by name. |
| Alphanumeric | Ordinary typing. The character is discarded at the point of capture. Only the fact that a key was pressed is kept — a count. |
Shift is deliberately not treated as a command modifier. Holding Shift to type a capital letter or a symbol is typing, so the character is discarded exactly like any other. Shift is still listed among the modifiers when it forms part of a genuine command such as Ctrl+Shift+C.
What this means in practice
The result is that keyboard data shows how much someone typed and which commands they used. It cannot be used to reconstruct what they typed, including passwords, messages or document text.
4How fingerprints work
Where a fingerprint is needed — for clipboard items, completed fields and folder paths — the agent stores a salted, truncated SHA-256 digest rather than the value.
- The salt is 32 random bytes generated per installation, held on the device, and never transmitted.
- Fingerprints are therefore irreversible, and comparable only within a single installation. The same text on two people's machines produces different fingerprints, so they cannot be correlated across people or matched against an external dictionary.
- Their only purpose is equality: the thing copied here is the thing pasted there, or this same template was typed forty times.
5What is never recorded
These are prevented in the software, not by policy alone.
- The characters you type.
- Screen contents. No screenshots, no screen recording, no reading of pixels, no text recognition.
- Clipboard contents, file contents or field values — only type, length and irreversible fingerprints.
- File names. Only the extension and a hashed folder path.
- Full web addresses, query strings and fragments on third-party sites.
- Microphone audio, camera video, your location, or who was on a call. The agent reads no device sensors — it asks the operating system only whether the microphone is in use, never what it heard.
- AI prompts or responses.
- Passwords and the contents of secure fields.
- The agent's own window.
6Safeguards
| Safeguard | Behaviour |
|---|---|
| Password and secure fields | Field fingerprinting is skipped entirely when the operating system marks the focused field as secure. Control names for such fields are dropped. |
| Fields that can hold typed content | The control name is dropped for editable roles. Only the control type and a structural identifier are kept. |
| Password managers | Clipboard, control and field capture are disabled entirely while 1Password, Bitwarden, LastPass, KeePass, Dashlane, Keeper, Enpass, NordPass or ProtonPass is in focus. |
| Private and incognito windows | Detected and suppressed. No domain, no path, no content-adjacent capture for that window. |
| Pause | Anyone can pause capture at any time from the system tray. Pausing and resuming are recorded as such. |
| The agent itself | Never records its own window or process. |
7Consent, storage and retention
| Area | Position |
|---|---|
| Consent | No capture happens until the person accepts the in-app disclosure. The version they accepted and the time they accepted it are stored and sent with every batch. If what is captured changes materially, the disclosure version changes, which invalidates the stored consent and asks again before collection resumes. |
| Visibility | The agent keeps a local, never-transmitted copy of its own last 24 hours so the person it runs on can see exactly what is being recorded, at any time, without asking anyone. |
| Transmission | Sent over HTTPS with an authenticated token. Batches carry a stable identifier so a retry is a safe repeat rather than a duplicate. |
| On the device | Batches are written to the application's own data folder before first send and deleted once delivered. The queue is capped and drops oldest-first beyond that. |
| Retention | Raw activity events are kept for 90 days and then permanently deleted by a scheduled job. Aggregated figures derived from them fall under separate business policy. |
| Access | Activity data is visible only to authorised administrators. |
8Installation and disclosure
On an organisation-managed machine, installation happens under an announced policy. On a personal machine, installation is always visible and consented. There is no hidden mode and no silent install.
Activity is tied to a named person through their work email. It is not anonymised, so access control and the retention limit above are what protect it.
If you are deploying this to a team
Workplace monitoring is regulated in many places, and the rules differ by country and sector. If you are deploying Attain across a team, the in-app consent gate is a foundation and not necessarily the whole of your obligation. We will give you whatever detail your legal or works council review needs — ask us for the full data capture reference.
9Your data and how to reach us
If you want to know what is held about you, have it corrected, have it deleted, or stop collection entirely, email team@attainhq.ai and a person will answer. There is no form and no ticket queue.
If you are an employee whose organisation deployed Attain, we will always tell you what is recorded about you. Requests to delete or stop collection are your employer's decision to make, and we will tell you that plainly rather than leaving you waiting.
10Changes to this policy
Any change to what is captured requires both a new in-app disclosure version, which asks everyone to consent again before collection resumes, and an update to this page.
Changes that reduce what is captured do not require fresh consent, but are still recorded here.