Privacy

What stays on your Mac, what can connect to the network, and how on-device processing works.

Your Capd library stays on your Mac in one SQLite database and local asset folders. Capd has no account, cloud sync, analytics, advertising, or telemetry.

This page lists every network feature in the app.

Page-content fetching

Capd stores readable page text so search can match more than a bookmark’s title. When a capture comes from Safari, Chrome, or Arc, Capd first reads the rendered page directly from that browser tab. No additional page request is needed.

For CLI captures, share-sheet captures, dropped links, and Firefox-based browsers, Capd can fetch the page itself. That fetch uses:

HTTP and HTTPS URLs only
an ephemeral browsing context with no shared cookies or persisted website data
navigation locked to the requested page
a 15-second timeout and 10 MB response limit

A failed fetch does not discard the capture.

Control it: use capd add --no-fetch for one CLI capture, or disable Fetch page content for link captures in Settings.

Website icons

When a saved website first appears in the HUD or search results, Capd may request its favicon from that website or the icon location declared by its home page. Requests use an ephemeral network session. Valid icons are cached locally in the favicons/ folder; confirmed misses are retried after seven days.

Favicon fetching currently has no separate setting. If a request fails or the Mac is offline, Capd displays a built-in symbol instead.

Update checks

At most once a week, the menu-bar app asks the GitHub Releases API for the latest version number. Updating is always manual.

Control it: disable Check weekly for a new version in Settings.

On-device processing

Image text recognition uses Apple’s Vision framework. Automatic topic tagging uses Apple’s on-device Foundation Models when Apple Intelligence is available. Captured content is not sent to a model service.

Control tagging: disable Auto-tag captures on device in Settings. OCR continues to run locally for image captures.

MCP and other tools

The capd mcp server reads the local library and returns requested results over standard input and output. It does not make network requests itself. A connected AI assistant may process those results elsewhere, so its own privacy policy also applies.

App security and distribution

Capd runs outside the App Sandbox because reading the frontmost browser tab with Accessibility and Automation is incompatible with sandboxing. Release builds use the hardened runtime, are signed with a Developer ID certificate, and are notarized by Apple.

The source is MIT-licensed and available at github.com/jamiedavenport/capd.