Screenshot tools that don't upload
If you screenshot client dashboards, internal tools, staging environments or anything with customer data in it, “where do these images go” stops being a preference and becomes a requirement.
This page is about how to answer that question for yourself, for any app — including this one.
Why it’s hard to tell from the marketing
Almost every screenshot tool now says “privacy-first” or “local-first” somewhere. The phrases are unregulated and usually mean one of several quite different things:
- Local capture, cloud sharing. The screenshot stays on your Mac until you press Share, at which point it’s uploaded. Common, reasonable, and easy to trigger by accident.
- Local OCR with a cloud fallback. Text recognition happens on-device, but the image is sent to a server when local recognition is poor. The failure case is exactly the sensitive document you most wanted kept local.
- Local processing, cloud account. Images stay put, but the app maintains a login, syncs settings and reports usage.
- Genuinely no network. Nothing leaves, and there’s no code that could send it.
All four get described the same way.
How to check, in about five minutes
1. Install an outbound firewall. Little Snitch is the standard; LuLu is free and open source. Both prompt on every outbound connection.
2. Use the app normally for ten minutes. Take twenty screenshots. Search them. Copy from them. Export something. Open every settings pane.
3. Watch what it asks for. An app that never prompts, never made a connection. An app that prompts for its own domain during a save or a search is doing something you should understand before continuing.
Do this during the trial, before you pay, and specifically while doing the thing you care about — capture and search, not just launch.
Read what the connection is for. Not every connection is a problem. An explicit update check or a one-time licence activation is fine and normal. A connection every time you take a screenshot is a different matter.
Other things worth checking
Where is the library stored? Ordinary files in a folder you can open, or an opaque container? If you can’t inspect it, you’re trusting a description of it.
~/Library/Application Support/<the app>/Open it. You should recognise what you see.
Is there an OCR fallback? Ask directly, or look for it in the settings. “We use on-device recognition” and “we never send your image anywhere” are not the same sentence.
Is there analytics? Many otherwise-local apps still ship an analytics SDK. Little Snitch will show it.
What happens on update? An app that can silently update itself can change its behaviour after you audited it. Updates that are user-initiated and signed are much easier to reason about.
Reasonable options
The built-in macOS tools. ⌘⇧5 and Live Text send nothing anywhere. If your needs are simple, this is the safest answer and it’s free.
Shottr. Local capture with on-device OCR, free or a small one-time price.
Screenshot Inbox. This app — local capture, on-device Apple Vision recognition, no cloud OCR and no cloud fallback. Two network operations exist in the whole app, both behind buttons: Check for Updates and licence activation. See Privacy.
CleanShot X, used carefully. Capture and annotation are local; the cloud features are opt-in. A capable tool if you can be relied on not to hit the wrong share button with a client’s billing screen on the clipboard.
Whichever you pick, run the Little Snitch test yourself. It takes five minutes and it beats every claim on every website, including this one.
If you need to answer a security questionnaire
Useful things to be able to state:
- Text recognition runs on-device using Apple’s Vision framework
- No image data is transmitted
- The library is ordinary files plus a local database, on the endpoint
- Network operations are limited to an explicit update check and a one-time licence activation
- No analytics, telemetry or crash reporting is present
- Optionally, the recognised-text index can be encrypted at rest with a device-held key
Being able to demonstrate the first two with a packet log is usually worth more than any of the rest.