Private by default

Your screenshots.
Your device.

A screenshot can contain passwords, private conversations, health information, financial details, client work, and everything else visible on your screen. CaptureRecall treats local control as a product requirement, not a settings-page promise.

The short version

The default path never needs a server.

CaptureRecall does not require an account, cloud sync, or analytics. Captures are saved as PNG files on your computer. Search metadata lives in a local SQLite index. OCR runs from models bundled with the app.

Does CaptureRecall send screenshots to the cloud?

No. Not in the default workflow. Capture, storage, metadata, search, and OCR are local. Optional semantic image analysis is a separate, explicit opt-in described below.

Default data flow

From your screen to your library—and nowhere else.

STEP 01System capture

Your operating system controls permission and selection.

STEP 02Local processing

The PNG is saved and OCR runs on your device.

STEP 03Local library

SQLite indexes metadata and recognized text for search.

The capture is available for copy, drag-out, or explicit export only when you initiate that action.

What is stored

Files and fields you can reason about.

Screenshot PNGApplication data directoryThe original capture that you browse, copy, drag, or delete

SQLite indexApplication data directoryPaths, dimensions, timestamps, capture mode, and searchable metadata

OCR textLocal SQLite indexSearch text visible inside captured images

Personal contextLocal SQLite indexTitles, descriptions, notes, tags, and favorite state

Shortcut settingsLocal application settingsYour configured global area and full-screen shortcuts

Optional semantic analysis

Off by default. Loopback only. Explicitly enabled.

CaptureRecall can request suggested titles and descriptions from an OpenAI-compatible vision service, but only after you enable the feature. The endpoint must resolve to 127.0.0.1, localhost, or ::1. Remote endpoints and HTTP redirects are rejected.

Important: a separate service running on your computer can still relay data elsewhere after it receives a capture. CaptureRecall cannot control that service. Only enable semantic analysis when you trust its configuration and behavior.

When the service is off or unavailable, local OCR remains searchable and CaptureRecall leaves semantic metadata untouched rather than manufacturing a title from partial OCR text.

Desktop permissions

Your operating system remains the authority.

On macOS, capture uses ScreenCaptureKit for the main display and Apple's native crosshair for area selection. On supported Linux Wayland sessions, capture goes through the XDG Desktop Portal. In both cases the operating system remains in control of permission. A cancelled request does not create a record or leave the app hidden.

VISIBLE

System-owned prompts

Capture permission is presented by the desktop environment, not silently bypassed by the app.

BOUNDED

Requested access

CaptureRecall asks for the screen interaction needed to complete the capture you initiated.

Deletion and reporting

Delete the image and its index record together.

After confirmation, deletion removes the PNG file and the corresponding database row. Because screenshots can contain sensitive material, review a capture before copying, dragging, exporting, or sharing it outside the application.

Report security issues privately through the project’s GitHub Security page rather than opening a public issue.