cockpit is a personal productivity board. It runs on the operator's own server at home in Brazil; it may later run on a rented virtual server in the European Union, operated by one person, for a handful of people who log in with a password given to them by the operator. There are no advertisements, no analytics, no third-party scripts and no tracking cookies, so there is no consent banner to click. The only cookie is the login session.
| board | cards, notes, labels, deadlines, the horarium and its revisions, day plans, weekly envelopes, settings |
| work record | pomodoros with their pauses, outputs and notes, chosen breaks, briefings |
| forge activity | commits, events and open pull requests fetched from GitHub and Forgejo for the operator's own account; other accounts get none |
| activity rollups | five-minute totals per category (deep, comms, feeds, media, neutral), per repository and app-switch counts, computed on your own computer from ActivityWatch and pushed by you |
| activity minutes | one row per minute holding the app name and window title, stored only as ciphertext (XChaCha20-Poly1305). The key is a file on your computer; you paste it into your browser once and it stays there. The operator, the database, the backups and anyone who reads the server disk see random bytes. Lose the key and nobody, including the operator, can recover those minutes |
| access log | login attempts and account actions (time, account name, IP address, success). Kept 60 days, then deleted automatically. Nothing else is logged per request |
Every row belongs to one account and the API only ever returns your own rows. The operator has database access to everything except the activity minutes, which only your key opens. Nightly backups of the database are kept on hardware owned by the operator; they contain the same ciphertext.
Board and work records stay until you delete them or the account. Cards in todo that were not touched for 30 days are removed. The access log is capped at 60 days.
You can take everything out and you can delete everything, right here, without asking. Export gives you one JSON file with every row of yours (the minutes come out as the ciphertext the server holds). Delete removes the account and everything under it immediately; there is no soft delete and no grace period. This covers the GDPR and the LGPD rights of access, portability and erasure. Questions or a request the buttons do not cover: renatobritto.professional@gmail.com.