Privacy and tracked data

Hackatime receives activity events, called heartbeats, from your WakaTime-compatible editor plugin. The plugin sends metadata about the active coding session, not the contents of the file.

Metadata a heartbeat can contain

Depending on the editor and plugin, a heartbeat can include:

• the file path or other entity name
• project, branch, language and dependencies
• editor, operating system, machine and plugin information
• activity category, timestamp and line-count metadata
• AI coding metadata supported by newer WakaTime clients
• request metadata such as IP address and user agent

Hackatime does not receive screenshots, a stream of your keystrokes, password values or the contents of the file you are editing through ordinary heartbeats.

Hide sensitive paths before sending

Privacy options belong under [settings] in ~/.wakatime.cfg. They are applied by the plugin before a heartbeat reaches Hackatime.

Send paths relative to the detected project folder:

[settings]
hide_project_folder = true

Obfuscate every file name while retaining its extension:

[settings]
hide_file_names = true

You can also set hide_file_names to a list of path patterns, or use hide_project_names, hide_branch_names and hide_dependencies for the corresponding metadata.

Exclude paths entirely

exclude entries are POSIX regular expressions. Matching activity is not sent:

[settings]
exclude =
    /node_modules/
    /vendor/
    \\.env$
    /private/

Use forward slashes in patterns, including on Windows. Test broad expressions carefully: excluded time cannot appear in Hackatime because the plugin never sends it.

For the complete client-side option reference, see the WakaTime CLI configuration documentation.