Your attention is yours. So is your data.
Still has no accounts and no analytics. Your selections, sessions and history stay on your PC or phone, and we’re upfront about what the app can and can’t do.
Nothing to sign up for. Nothing to sign in to.
Still doesn’t report how, when or whether you use it.
Preferences, alerts, to-dos and history are stored locally.
What goes online
Only two things, and both are about what you asked for:
- Website logos. For a website you select, Still requests only that domain’s icon from Google’s favicon service, then caches it locally. Offline sites get a letter icon.
- Update check. Settings → Check for updates contacts GitHub, only when you click it. Nothing is sent about you.
The font is bundled. There are no ads, trackers or third-party SDKs.
What’s stored, and where
| Data | Location |
|---|---|
| Preferences, to-dos, alerts | %APPDATA%\still-focus (alerts in alerts.json, imported media in alert-media\) |
| Session state & history | %ProgramData%\Still\state.json, written atomically and writable only by administrators and SYSTEM. Up to 500 recent sessions. |
| The guard | %ProgramFiles%\Still Guard |
| The app | %LOCALAPPDATA%\Programs\Still |
Uninstalling lets you choose to remove your data too. Export your history as JSON any time from Your progress.
App security
- The interface runs in Windows’ WebView2 and only Still’s own page can talk to the app.
- A restrictive Content Security Policy; navigation is blocked.
- Only allowlisted requests, each with bounded, validated input.
The guard
- Still Guard runs as LocalSystem. Its named pipe is restricted to its owner, SYSTEM and administrators, with network access denied.
- Requests are bounded and validated again inside the native service.
- A policy snapshot is stored before any change. Cleanup removes only rules carrying Still’s reserved name prefix and restores the prior collection mode.
- Unrelated rules, collections and concurrently added third-party rules are retained.
Browser companion
The companion uses Chrome and Edge’s native request rules. It doesn’t upload browsing history, and its native host waits on filesystem notifications rather than scanning tabs or polling URLs. For time limits, the companion checks the addresses of your open tabs every 30 seconds, on your PC only, and counts time while a limited website is open in any tab.
The extension’s settings page shows each website you add with its logo. Like the Windows app, it requests only that domain’s icon from Google’s favicon service, once, and keeps it in your browser. If that fails, the website gets a letter icon.
No TLS interception, root certificate, network proxy or DNS change is ever used.
While Settings is open, Still checks whether the extension is added by reading the extension list in your Chrome and Edge profile settings on this PC. It only looks for its own extension, and nothing is sent anywhere.
Android preview
The Android app can’t go online at all. It doesn’t ask Android for internet access, so nothing it knows can leave your phone. There are no website logos or update checks on Android.
To block apps and websites, Still uses an Android accessibility service. Here’s exactly what it looks at:
- With no session and no limits, it asks Android for nothing and does no work.
- During a session, it’s told only when you open or switch apps, and checks whether that app is blocked. It never reads what you type or what’s on screen in other apps.
- In supported browsers, during website sessions or while you have daily limits, it reads the address bar to see which website is open. Only the website’s name is compared with your list; it doesn’t keep a browsing history.
- With Protect Still on, it checks whether an open Settings screen mentions Still Focus, so it can keep Still’s own settings and uninstall screens closed until the session ends.
Everything is stored in Still’s private app storage on your phone: session state and history (up to 500 sessions), to-dos, alerts, limits and today’s usage. Cloud backup and phone-to-phone transfer are switched off. Images and sounds you pick are copied in through Android’s file picker, so Still never needs access to your photos or files. Uninstalling the app removes all of it. Export your history from Progress any time.
Honest limits
Still is a focus aid, not an unbreakable lock. No app can guarantee that against the administrator of the same PC. We’d rather you know exactly where the edges are:
- An administrator can stop or remove the service, change policy or the clock, or use another account.
- Modified or differently identified binaries, another operating system and remote/streamed games aren’t covered.
- Blocking a launcher doesn’t block every game it can start. Select the games too.
- Website blocking covers Chrome and Edge. Other browsers and proxy/remote sites can bypass it.
- The extension can be removed from the browser; that bypasses immediate blocks until browser policies refresh.
- Alerts need Still open or in the tray, and sleeping PCs aren’t woken.
- On Android, Safe mode, a factory reset, USB debugging or another user profile get around Still, and websites inside other apps’ built-in browsers aren’t seen.
Still shows these limits in the app, too. Essential Windows components, framework packages and Still itself can never be selected.
This website
This site uses no cookies, analytics or trackers. To show the latest version and release notes, your browser asks GitHub’s public API for Still’s releases; the answer is kept in your browser for ten minutes. Downloads come straight from GitHub Releases.