The installer isn’t signed by Apple, so macOS blocks it the first time. Nothing is broken and nothing is dangerous — it’s Gatekeeper doing its job.
Go to Downloads and double-click TimeTracker.pkg. A warning appears saying Apple could not verify the file. Click OK. This step looks pointless, but it’s what unlocks the button in step 2.
This software may harm your Mac or compromise your privacy.
Scroll to the bottom. There will be a line saying TimeTracker.pkg was blocked, with an Open Anyway button next to it. It only exists after step 1 — before that, there’s nothing there to find.
Click Open Anyway, then Open in the dialog that follows, and type your Mac password. The installer runs normally from there.
It only looks for plugins on launch. If it’s open, quit it, install, and open it again.
Signing an app with Apple costs US$ 99 a year. Time Tracker is free and sells nothing, so charging you to cover that bill made no sense. The cost is this one-time block — once, and never again.
Open Terminal and run shasum -a 256 followed by the file. The result must match this: