BouncerContact the publisher · Updated October 27, 2026 · Development version 0.24.4
BOUNCER PRIVACY NOTICE Updated: 2026-10-27 Publisher: Kledi Jenicerri Support and privacy requests: kledi.jenicerri@hotmail.com Public notice: https://bouncer-website.vercel.app/privacy.html
The desktop app
Bouncer stores rules and enforcement status on this computer. It has no account, advertising, remote telemetry, remote analytics or cloud sync. Optional local usage tracking retains daily totals only after you enable it (details below). The service and signed-in app helper read executable paths to close applications you selected. Machine rules are readable by other local Windows users and writable only with administrator approval.
Optional DNS filtering
Family DNS is off by default. Enabling it in Settings, or retaining an older Family DNS configuration, makes supported browsers send domain queries to CleanBrowsing over HTTPS. CleanBrowsing can see those queries. Encrypted DNS is not anonymity. Its terms and privacy policy apply: https://cleanbrowsing.org/privacy Its availability and categories are outside Bouncer's control. Provider failure can interrupt browser DNS because unfiltered fallback is not enabled.
Diagnostics and local storage
Diagnostics are local. Deliberate diagnostic export includes version, check time, rule counts and status flags, not website names, executable paths or account names. Old activation transcripts can contain Windows account/computer names. No data is uploaded by diagnostic export. Review any file before sending it to support.
Saved settings are in ProgramData\Bouncer; owned browser recovery state stays in ProgramData\FocusGuard for compatibility. Local drafts and per-session helper status are in LocalAppData\Bouncer. Your optional personal goal is stored with machine rules and can be read by local Windows users. Uninstall removes owned protection before removing the program and service. Machine settings and ordinary transaction recovery files are removed after successful uninstall. Per-user drafts, older portable files and unrelated recovery files are retained. Explicit whole-file recovery also retains settings.json.corrupt-<hash>.json archives in ProgramData\Bouncer. These preserve damaged bytes, which can include private goals, rules and activity. They survive Clear history, Remove all protection and uninstall so evidence is not lost; delete them manually when no longer needed. An interrupted recovery may leave a similarly named temporary archive. These files are not included in diagnostic export. They have the same local-user read access as machine settings, and should not be sent to support without review.
Contact Kledi Jenicerri at kledi.jenicerri@hotmail.com with privacy questions. Bouncer has no server copy of your local app data; use the deletion controls described below to manage it on your computer. If you email support, your email address, message and attachments are processed to respond to your request through the publisher's Microsoft-hosted mailbox. Send only information needed for help. Ask at that address to access, correct or delete support correspondence, subject to applicable record-retention obligations.
Routine activity is local metadata in ProgramData\Bouncer\settings.json: routine name/identity, event type, recorded time and pause deadline. It contains no website addresses, app paths, personal goal text or browsing history. Like machine rules, this history can be read by other Windows users on this PC. Up to 100 recent events are retained for 30 days, with pruning during service/activity operations. Settings > View activity > Clear history clears current records and the normal settings backup; it is not forensic erasure of filesystem or external backup copies. Installer recovery snapshots and user-created drafts may retain earlier copies. No activity is uploaded or included in the standard diagnostic export.
Damaged optional activity can be preserved in settings.json.activity-recovery.json and its previous copy, with local-user read access like other machine settings. These contain raw damaged activity/checkpoint fields, which may include unexpected content from corruption; they are not included in diagnostic exports. They remain until Clear history, Remove all protection, or successful uninstall. External backups and filesystem remnants are not erased. Valid rules are not included in this archive.
Browser companion
The optional browser extension sees top-level HTTP(S) navigation URLs in memory to avoid redirecting a newer navigation. Protection checks send only the hostname to the local native host; paths and query strings are not sent for those checks. The reply includes rule status, matching routine names, an optional personal goal and next availability. The hostname appears in the extension block-page URL and may remain in ordinary browser history. Required permissions: tabs, webNavigation, nativeMessaging, storage and declarativeNetRequestWithHostAccess. YouTube scripting/host access is optional and requested when starting a focused lesson or enabling Shorts protection. Shorts protection requests optional HTTP(S) access to youtube.com and its subdomains. No browsing-history permission is requested.
Optional YouTube Shorts protection is separate from tracking and focused visits. It saves one boolean in this browser profile's storage.local, never synced by Bouncer. It inspects YouTube link paths and known Shorts containers in memory to hide surfaces and stop navigation. No video IDs, titles, URLs, viewed content or history are saved or sent by this feature. Browser-managed request rules and content-script registration persist until disabled/access removed. Existing Bouncer daily limits and website blocks continue independently. It stops Shorts routes, not every short-form video accessible through an ordinary watch URL.
Focused visits use browser storage.session: chosen video/purpose, return destination and view choices live only for that browser session, and are removed on Done/tab closure or relevant permission removal. No sync/local extension history is created. The content adapter receives its lesson/view details, not the return destination. Normal browser history and websites' own cookies/data still exist independently.
Patterns and suggestions
Patterns & suggestions is a separate, default-off permission. Activity tracking alone does not enable it. While both permissions are active, the desktop helper reuses validated foreground samples to count app/site visits of at least 10 seconds and returns after another qualified target. It retains app executable paths, website hostnames, active seconds, visit/return counts, a UTC half-hour bucket, an opaque period identifier and a generic timed-focus category (Study, Create, Life admin, Unwind, Focus or computer time). Untimed saved plans are not treated as current activities. It does not store clicks, keypresses, window/page titles, full URLs, page content, search queries or personal goals. Supported browsers without a fresh normal-tab domain are skipped; other apps retain app identity. Idle/lock/sleep exclusions follow Activity tracking. Raw transitions stay only in short-lived memory; disk records are period summaries, not a click timeline.
Patterns/patterns.dat under LocalAppData/Bouncer is encrypted with Windows DPAPI CurrentUser. There is no upload, cloud model, account, new browser permission or native message containing pattern data. Up to 672 periods / 4096 app-site summaries are kept for up to 14 days; pruning occurs when the helper or screen accesses the store. The file also holds user answers, dismissals, chosen allowance review dates, numeric baselines and feedback. Review baselines expire after 14 days. Explicit useful/distracting answers stay until removed, with at most 256 choices. Private data is not included in installers or diagnostic exports. Windows/user-created backups and filesystem remnants are not forensically erased by deletion.
Activity > Patterns & suggestions > My data & choices allows inspection and deletion of periods, answers or all pattern data. Deletion prevents pending samples from recreating earlier history. It does not remove existing Activity totals, daily limits, rules or saved focus plans. Activity's Delete history affects its own daily totals; delete patterns separately here. Pattern Pause/Off stops new collection and suggestions without changing regular Activity tracking or limits. Activity Pause/Off also stops new patterns. Off retains observations until cleanup or deletion. Choosing an answer never modifies protection. Daily allowances require their normal Save; blocks require draft review and Apply changes; focus plans use their normal review and Start. Statistical comparisons are descriptive, not proof that a boundary caused a change or improved productivity.
Companion and reminders
Companion learning is off by default. Opting in stores only explicit event types, chosen context (YouTube learning or briefing), random session IDs and timestamps under LocalAppData\Bouncer\Companion\companion.json. No raw URL, page content, purpose text or sensitive-content classification is an event field. Up to 256 events are retained for 14 days, pruned when the store is used. Pause stops new learning and suggestions. Review/delete events or Forget learned events from the companion preferences (Activity > Privacy > Step-away reminders); the extension also offers forget controls. Preferences, dismissals and your custom step-away reminder are saved locally. The native host accepts bounded companion/usage actions and fixed Open Bouncer/Open Activity actions; it cannot change machine protection. Starting a Step away break does not create activity history. Its message, break length and optional after-focus reminder preference stay in companion.json. Automatic reminders retain only the latest session-ID/round receipt and opt-in time to prevent repeat prompts; there is no list of breaks taken. This receipt does not contain the session purpose or websites. No extra tracking consent is enabled by saving a reminder. Administrators can access per-user local files.
Briefings
Briefings save chosen source names/URLs and types (feed or website), topic terms, up to five headline/short publisher summary/link/source/date entries and explicit usefulness feedback in briefings.json in the same per-user Companion folder. Cached items and feedback expire after 14 days on store access; chosen sources/topics remain. There is no full article cache, click history, dwell time ranking, account connection or Feedly integration. Explicit website discovery and feed previews are held in memory until closed; only Add saves a source. Previewing and fetching selected sources contact publishers over HTTPS; publishers see the connection's network address. Page scripts, remote images and cookies are not loaded. Public website story lists can be extracted locally from the page you choose. Only that page is requested; article links are not crawled. Full HTML is held in memory for parsing and is not kept in the briefing store. Selected story titles, short summaries, links and dates follow the same 14-day retention above. Original links open in your default browser under its own privacy settings. Forget briefing data deletes cached items and feedback and owned backup/temp copies; source choices remain. Removing a source removes it from current choices immediately. Companion and briefing writes do not keep automatic previous snapshots. Deletion is not forensic erasure and cannot remove external backups or filesystem remnants. Machine uninstall leaves these per-user preferences/data, like existing local drafts.
Focus sessions and sharing
Focus sessions are machine settings: chosen domains, optional task, approving Windows identity, phase/deadlines and bounded command receipts. Local Windows users can read them, like ordinary rules. The last session remains until replacement or removal of machine settings. It is not uploaded or included in diagnostic export.
Recipe sharing is explicit local file export. Focus/view recipes contain their reviewed public choices, not personal history or goals. Briefing recipes contain source names/types, public URLs and include/exclude terms shown in the export preview. URLs with credentials/query tokens are rejected, but secrets inside custom URL paths cannot reliably be detected: inspect that preview before sharing. Exported files and copies shared by you are outside Bouncer's deletion controls.
Usage and daily limits
Tracking is off for new users. Activity > Enable tracking explains collection and asks for your choice. Tracking continues in the signed-in session when the window is closed, through the unprivileged app helper. Foreground app time is estimated in seconds; time after 60 seconds without input is excluded, except audible foreground browser playback. Lock and sleep gaps never count. Silent passive video may be treated as idle. Only the browser audible flag is read, never audio contents. App executable paths identify the same program across launches and may include personal folder names. No window titles, typed text or app contents are read.
The extension observes only its active normal HTTPS tab while the browser has focus. It sends the hostname to the local native host only when tracking is enabled and not paused. Private-tab domains are excluded; their browser app time can still count. No page title, full URL or page content is stored in usage history. Website time is a subset of browser app time, never added to total active time twice.
Usage totals and limits are encrypted with Windows CurrentUser data protection in LocalAppData\Bouncer\Usage. Programs running as your Windows user may access that data; encryption is not a defense against a compromised account. Up to 30 local calendar days are retained, pruned on store access. No data is uploaded. The extension/native host uses a short-lived current-site observation so the app helper can attribute foreground browser time; stale observations are not counted.
Browser connection diagnostics are separate from usage history. The local native host records only browser name, extension version, check time, availability, tracking/paused flags, a bounded status reason and a random connection-owner ID in LocalAppData\Bouncer\BrowserConnections. There are no domains, raw URLs, page titles, executable paths or usage totals in these plain local diagnostic files, and nothing is uploaded. At most one current record is kept per supported browser, not a history of connections or profiles. Activity ignores evidence 20 seconds old or older. A normally closed connection clears its own record; an abrupt exit can leave a stale file until overwritten or removed. Connection state is refreshed even when usage tracking is off, so setup can distinguish a working connection from consent, update or connection problems. This does not enable tracking. Delete usage history does not reset these independent connection diagnostics; a running browser may refresh them.
Pausing or turning off tracking also pauses daily usage limits. Scheduled Blocking rules continue independently. Daily limits reset at local midnight. Website limits require the enabled updated extension. App limits warn, then request normal closure; apps may refuse. There is no forced close, unbreakable lock or clinical diagnosis.
Delete usage history clears measured totals and resets today's used allowances, while keeping tracking preferences and limits. Pending earlier samples are discarded. Deletion is not forensic erasure and does not delete external backups. Export is an explicit readable JSON file of daily app paths/domains/totals and limits. These are not included in diagnostic exports. Uninstall retains per-user data; delete it from Activity > Privacy before uninstalling if you do not want to keep it.
FOCUS WEBSITES The chosen domains and optional task are stored in shared machine settings. During a session limited to your work websites, the extension checks the current site when you activate a tab/window and periodically while its background worker runs, even when optional activity tracking is off. These protection checks send only the hostname to the local Bouncer helper; they do not create browsing history or upload data. The same website scope applies to all local Windows users in supported browsers. Saved global exceptions outside those sites resume after the session.
ARRIVAL AND SAVED ACTIVITIES - 0.21.0 The welcome stores five user-editable activity slots, their optional personal goals, up to five normalized website domains each, durations and explicit website-focus/open-website choices. It also stores the sign-in welcome setting, whether the welcome was dismissed/configured, last chosen activity and one matching focus-session ID/personal goal. There is no arrival history, click recording or inferred behavior. Saving a setup does not opt in to usage tracking or companion learning. Data is protected with Windows CurrentUser encryption in LocalAppData\Bouncer\Arrival\plans.dat. Other programs running as your user may decrypt it; this is not protection against a compromised Windows account. No goals or activity records are uploaded. Opening websites contacts those sites normally. A website-focus session shares only its generic activity category (Study, Create, Life admin, Unwind or Focus), domains and timer with the existing machine-wide session. The personal goal is read locally for your Home tile. Older goals entered through other screens retain their documented shared scope. Settings > General > Saved activities > Forget plans clears these personal goals and setups, keeping the sign-in choice and existing protection/tracking intact. Only the current encrypted file is kept, without an automatic previous snapshot. Per-user plans remain after uninstall, like other per-user preferences. Deletion does not erase external backups or filesystem remnants. Sign-in uses the normal Windows startup registration; no credential provider or keyboard hook is added.
Windows sign-in and unlock
The existing welcome preference now covers Windows sign-in and unlock. The signed-in helper listens for Windows session events; it keeps only a volatile pending-unlock flag to avoid duplicate prompts. It does not log lock/unlock times. Home displays the existing saved setups and last explicitly started activity. No new personal data fields, permissions, tracking consent or history are added.
Optional X account setup
Optional setup uses existing scripting permission and access to https://x.com/*. It opens a dedicated settings tab. Only the visible account-switcher handle and two sensitive-content controls are read. A review identifies the account before an explicit Apply action. Changes use the page's normal controls and go to X. The two pages are reloaded to check that settings stayed saved. Account changes, unrecognized/disabled controls and failed saves stop automation with manual help. Account/settings state exists only in the setup page's memory and disappears when it closes or reloads. Nothing from setup is added to extension storage, Activity, Companion, diagnostics or desktop/native messages. It does not inspect cookies, session tokens, passwords, general posts or private messages. Normal browser history and X's handling of its account preferences still apply. No background monitoring or account-setting lock is installed; saved X changes remain on stop.
Optional X search protection
This optional browser feature needs scripting permission and access restricted to X and Twitter domains. The extension declares declarativeNetRequestWithHostAccess; request rules have no X access until you grant the optional domain permission. Enabling registers a persistent page script for these domains and bounded request rules. The script checks search fields and the current search URL locally; it does not inspect messages, images or general page text. DOM changes are observed only to notice in-page navigation. No keys outside supported search fields are read. Only xSearchGuardEnabled, a boolean, is saved in the browser's local extension storage. Static rules and script registration also persist until disabled/removed. No searches, matched-term history, counts or sensitive URLs are saved or sent to the desktop host, a server, companion learning or Activity. Block-page addresses contain only a generic blocked flag. Browser history and website collection work normally; Bouncer does not erase them or promise the website never receives text. This is a term-based search filter, not comprehensive adult-content detection. Turn off on the extension's X search protection page; remove X access in browser extension settings to revoke the permission. It must be enabled per browser/profile.
Notes and committed breaks
Notes & goals stores up to 30 explicitly entered items (type, text, opaque ID and completed state) in LocalAppData\Bouncer\Notes\notes.dat, protected with Windows CurrentUser encryption. No timestamps, tracking or inferred goals are added. They appear only in your desktop Home/editor, never in shared rules, feed recipe exports, the browser host protocol or requests to feed publishers. Edit, complete or delete items in Notes & goals. Completed items remain editable in that window until deleted; there is no automatic expiry. No previous snapshot is kept. Other software running as your Windows user can decrypt these notes. They remain after uninstall, like other personal settings. Deletion cannot erase external backups or filesystem remnants. Existing feed requests and local cached headlines keep their previously documented scope; opening Home never fetches a feed.
StepAwayCommitted is an off-by-default preference in the existing local Companion file. Saving it does not start a break. Each start needs an unchecked agreement for the exact duration. During the agreed break, fullscreen covers and a temporary keyboard hook hold ordinary switching/closing shortcuts. The hook checks only shortcut state and Escape hold duration in memory; no keys, text or break history are logged, saved or uploaded. It is removed on finish, emergency exit or disposal; Windows removes it if the process ends. A monotonic in-memory countdown expires the covers, including elapsed time during sleep. Hold Esc for 10 seconds to exit in an emergency; Ctrl+Alt+Delete and Task Manager recovery remain available. No credentials, Windows authentication, browser policy, app contents or user files are changed. Apps remain open. It is not a tamper-proof or persisted Windows lock; process termination or restart releases it. Multi-monitor live acceptance remains necessary on the owner's setup; automated tests use ordinary isolated windows.
Website and support
The public website is hosted by Vercel. It uses no advertising trackers, analytics scripts, third-party fonts or Bouncer account cookies. Vercel may process normal request information such as IP address, browser details, requested URL and time to deliver and protect the site under its privacy policy: https://vercel.com/legal/privacy-policy Waitlist registration is not connected and no signup email is collected by the website. A future signup provider will be named with its privacy notice before registration opens. Support email is separate from a waitlist subscription. The website plays the promotional video only when you start it. The media and images are served by the website host. External links open third-party services under their own privacy practices. This notice will be updated when practices change; its update date appears above.