Data Collection Details
This page provides a detailed breakdown of every category of data the F7 agent collects, along with explicit guarantees about what is never collected.
Captured Data
Application Focus
| Field | Example | Purpose |
|---|---|---|
| App name | "VS Code", "Slack" | Identify tools used throughout the workday |
| App category | "IDE", "Communication" | Classify work activities for scoring |
| Foreground/background transitions | App moved to foreground at 10:32 | Measure focus time and context-switching patterns |
Not captured: Window title content (for non-work apps), text on screen, content of documents.
Input Activity
| Field | Example | Purpose |
|---|---|---|
| Click count | 47 clicks in 5 minutes | Measure engagement levels |
| Keystroke count | 230 keystrokes in 5 minutes | Measure typing activity |
| Scroll events | 12 scroll actions | Distinguish reading from active work |
| Idle periods | 5 minutes idle | Identify breaks and context boundaries |
Not captured: Which keys were pressed, what was typed, mouse coordinates, click targets.
Network Metadata
| Field | Example | Purpose |
|---|---|---|
| Destination domain | api.openai.com | Identify AI tool usage |
| Port | 443 | Classify connection type |
| Process name | "chrome" | Associate network activity with apps |
| Detected AI provider | "OpenAI" | Track AI adoption metrics |
Not captured: Full URL, query parameters, request body, response body, cookies, headers.
Limited capture: For traffic identified as AI-provider API calls (for example api.openai.com, api.anthropic.com), the path component of the URL alone (e.g. /v1/chat/completions) is recorded for provider classification. No query strings, fragments, headers, or request/response bodies are captured for any traffic.
Session Structure
| Field | Example | Purpose |
|---|---|---|
| Session boundaries | Session started 9:00, ended 11:30 | Define work sessions |
| Duration | 2 hours 30 minutes | Measure productive time |
| Focus time | 1 hour 45 minutes uninterrupted | Identify deep work periods |
| Context switches | 8 app switches in 30 minutes | Measure focus vs. fragmentation |
| Depth classification | "Deep work" | Categorize session quality (computed locally by on-device AI) |
AI Interaction Metadata
| Field | Example | Purpose |
|---|---|---|
| AI provider | "Claude", "ChatGPT", "GitHub Copilot" | Track which AI tools are used |
| Turn count | 12 turns in a session | Measure conversation depth |
| Request/response sizes | 500 bytes sent, 2KB received | Measure interaction complexity |
| Time-to-first-response | 1.2 seconds | Track AI tool performance |
Not captured: Prompt text, response text, conversation content, model parameters.
Git Metadata (via webhook, not agent)
| Field | Example | Purpose |
|---|---|---|
| Commit count | 3 commits today | Correlate AI usage with development output |
| Files changed count | 7 files modified | Measure scope of work |
| Insertions/deletions | +120 / -45 lines | Measure development velocity |
| Branch name | "feature/auth-refactor" | Associate work with project context |
Not captured: Diff content, file contents, commit messages.
Employer-Provided Data
The deploying organization can provide workforce directory data to F7 through configured identity, directory, or file-based syncs.
F7 does not independently collect this data — it is supplied entirely by the employer.
Job Metadata
| Field | Example | Purpose | |-------|---------|---------|| | Job title | "Senior Backend Engineer" | Role-level segmentation and benchmarking | | Employment type | Full-time, part-time, contractor | Workforce composition analytics | | Cost center | "Engineering - Platform" | Financial attribution | | Location | "San Francisco" | Geographic analysis |
Org Hierarchy
| Field | Example | Purpose | |-------|---------|---------|| | Department / team | "Engineering" → "Platform Team" | Reporting structure (up to 16 levels) | | Manager | Manager email or UPN | Manager-level dashboards | | Headcount | 12 people on team | Team sizing (includes non-enrolled employees) |
Employment Lifecycle
| Field | Example | Purpose | |-------|---------|---------|| | Hire date | 2024-03-15 | Tenure analysis | | Termination date | (when applicable) | Automatic deactivation | | Active status | Active / Inactive | Accurate headcount |
Identity (for account linkage)
| Field | Example | Purpose | |-------|---------|---------|| | Email | user@company.com | Primary join key for HR sync | | Display name | "Jane Smith" | Dashboard display | | User principal name | user@company.onmicrosoft.com | IdP sync key | | External ID | IdP object ID | Deduplication across syncs |
Not provided by employer: Anything about work behavior, AI usage, or application activity — that data comes only from the agent.
Third-Party Event Integrations
With the deploying organization's authorization, F7 can ingest event metadata from configured controller integrations. These integrations are opt-in — each must be explicitly configured by an organization administrator. The currently implemented integration sources are event/webhook providers: GitHub, GitLab, Bitbucket, Jira, Linear, Asana, Jenkins, GitHub Actions, GitLab CI, CircleCI, Google Calendar, Microsoft Outlook, LaunchDarkly, Zendesk, and Generic webhooks.
| Integration area | Example sources | Data Retrieved |
|---|---|---|
| Source control | GitHub, GitLab, Bitbucket | Commit, pull request, branch, and review event metadata |
| Issue/project management | Jira, Linear, Asana | Ticket and sprint event metadata |
| CI/CD | Jenkins, GitHub Actions, GitLab CI, CircleCI | Build, test, and deployment event metadata |
| Calendar/support/feature flags | Google Calendar, Microsoft Outlook, Zendesk, LaunchDarkly | Meeting, support-ticket, and flag-change event metadata |
| Custom workflows | Generic webhooks | Customer-defined event metadata |
Not retrieved: Document contents, message text, prompt/response text, code diffs, file contents, repository contents, calendar descriptions, or support conversation bodies.
Integration Controls
- Opt-in only: No integrations are enabled by default
- Admin-authorized: Each integration requires explicit administrator configuration with API credentials
- Minimum scopes: F7 requests only the API permissions needed for usage analytics — never broad read access
- Disconnectable: Any integration can be revoked at any time; historical data from that integration follows standard retention policies
- Audited: All integration connections and data retrievals are recorded in the audit log
Data Never Captured
These are absolute guarantees about data F7 will never collect:
- Prompt and response text from any AI tool
- File contents of any kind
- Email or chat message content
- Screenshots transmitted off-device (even when the optional vision model is enabled — frames are processed locally; current macOS builds stream capture bytes through stdout and scrub stale legacy vision temp files on startup)
- Clipboard contents
- Passwords, tokens, or credentials
- Full browsing URLs — only the destination domain, optional API endpoint path (e.g.
/v1/chat/completions) for AI-provider classification, and approximate byte counts. Never query strings, request bodies, or response content. - Activity from excluded apps (zero telemetry)
- Individual keystrokes (only aggregate counts)
Design Principle
These aren't just policies — the agent's code is architecturally incapable of capturing content. There are no code paths for reading prompt text, file contents, or clipboard data. The guarantees are enforced by the codebase, not just by configuration.