Privacy
Your screen stays yours
A screenshot tool sees everything you see, so it should be boringly predictable about what it does with that.
Privacy summary
The short version
No telemetry
Nothing about your usage, your machine or your captures is reported anywhere. Ever.
Local by default
Capture history lives on your disk and only starts after you say yes once.
Explicit is the only mode
Nothing leaves the machine unless you picked the destination yourself.
Scrubbed on export
EXIF and GPS are stripped on export automatically, and orientation is baked into the pixels.
No telemetry
The only four background reasons MycoCap talks to the network
That is the complete list of background traffic. If any of these happen, it is because you asked for it or left an on-by-default check enabled. Links you click — Support, the issue tracker, an update page — open in your browser, which is ordinary browsing rather than MycoCap phoning home.
- Update checks. A request to the update feed to ask whether a newer version exists — it only detects and opens the download page, never downloads or installs. On by default, and it can be turned off completely.
- Diagnostics you explicitly export. They are generated locally and only leave when you save the file.
- Destinations you explicitly choose. A webhook, an upload target, a mail client, the Windows share sheet — your call, every time.
- Remote images referenced by pasted content. If a paste or drag-and-drop carries
http(s)image addresses, MycoCap asks once per paste — naming every distinct host and how many images are involved — and fetches only on your say-so. Decline and nothing is requested while the rest of the paste is unaffected. Fetches to local, private-network and cloud metadata addresses are refused, and a failed permission check means no download: fail closed.
No analytics, no crash pings
There is no usage counter, no session id, no device fingerprint and no background phoning home when something goes wrong.
Captures never upload themselves
A capture is only sent when a destination you chose receives it. There is no hidden default destination.
Capture history
Local, consented, and yours to clear
Capture history is a convenience, not a surveillance log. It keeps up to 100 recent grabs on your own disk so you can rescue the screenshot you took but forgot to save.
- Consent is a checkbox, not a click-through. The first-run wizard has a “Keep a history of recent captures” box that starts unticked. Until you tick it, nothing is ever written to history — and skipping the wizard counts as leaving it off.
- It is local. The history never syncs, never uploads and is not readable by anyone but you.
- You control the lifetime. Clear it or turn it off at any time. Turning it off stops new entries; stored ones are deleted separately with Delete all captures in Privacy & data.
Metadata
What gets removed before the file leaves
Stripped on export by default
- EXIF blocks, including camera make and model.
- GPS coordinates and location tags.
- Other embedded
PropertyItems— every metadata block is removed, colour profiles included.
All of it happens automatically — there is nothing to configure.
Kept, on purpose
- Orientation is baked in. Rotation is applied to the pixels rather than left as a flag, so the image looks the same everywhere instead of sideways in one old viewer.
Metadata you hand over knowingly is different from metadata that leaks by accident. MycoCap assumes accidental leakage is never acceptable.
Sharing
Webhook, mail and Windows share are reviewed
Before a capture leaves through the webhook, email, or Windows share destination, MycoCap shows you what is about to leave — when the review step is on (the default). The review step shows a thumbnail preview, a plain-language no-location line and a sensitive-text scan, plus a toggle for including the window title.
Thumbnail preview
You see the exact pixels that are about to be sent — not a filename, not a path. If the crop is wrong, you will notice before it is too late.
Metadata check
A plain-language line confirms the PNG carries no location data.
Sensitive-text scan
The same detection used in the annotation canvas flags text that looks like it should not be shared, and tells you to cover them in the editor before sharing.
Storage and transport
Tokens, clipboard and diagnostics
Webhook tokens
- Encrypted with Windows DPAPI. Tokens are protected with the same per-user encryption Windows uses for credentials, so a copy of the config file is not a copy of the token.
- HTTPS-only. A destination that is not HTTPS is refused rather than downgraded.
- One webhook. A single URL and a single bearer token, so there is nothing to keep in sync.
Clipboard auto-clear
When MycoCap puts a capture on the clipboard, it can clear that entry again after a delay you choose — an opt-in setting, off by default (0 means never). Screenshots sitting in a shared paste buffer all afternoon are a quiet, ordinary leak — turn it on to close it.
Diagnostics
- You see what is collected before anything is written, item by item.
- Secrets are redacted — tokens, paths that look personal, and anything the scan recognises as a credential.
- Nothing is sent automatically. A diagnostic bundle only moves when you move it.
Updates & verification
A signed feed, checked on a schedule you can stop
Update checks are the one thing MycoCap does on its own, so they are built to be verifiable rather than merely trusted.
- Ed25519-signed feed. The update manifest is signed, and the signature is verified before the contents are parsed — not after. A tampered manifest is never read, let alone acted on.
- It only detects. MycoCap never downloads or installs an update itself — it opens the download page and you install manually.
- Every 14 days by default. A quiet check on a fortnightly cadence, which is enough to stay current without being chatty.
- Set it to 0 to disable. Setting the interval to
0turns update checks off entirely. No checks, no requests, no exceptions. An empty feed URL disables them too. - Scoped digests, plus an SBOM. Checks run against
https://github.com/MushroomCyber/MycoCap/releases/latest/download/update-feed.json; the feed’s SHA-256 digests cover the three installers only, not the portable ZIP. Each release also ships an SPDX software bill of materials.
Why signature-first matters
Most parsers are happiest when they trust their input. Verifying the signature before parsing means a hostile manifest never reaches the code that interprets it — the attack surface is a signature check, not a document parser.
- No telemetry, no analytics, no crash reporting.
- Capture history is local, consented, and removable.
- EXIF and GPS stripped on export by default; orientation baked in.
- Webhook, email and Windows share are reviewed first (when the review step is on): thumbnail preview, a no-location line, a sensitive-text scan, and an include-window-title toggle.
- Webhook tokens encrypted with Windows DPAPI, https only.
- Clipboard auto-clear is opt-in, with a configurable delay (off by default).
- Diagnostics show what they collect and redact secrets.
- Updates are Ed25519-signed, checked every 14 days, or never when set to 0.
Next
That is the whole policy
Short enough to read in one sitting, which was the point.