is it safe to let ai see your screen?

it depends on 4 things, and none of them is how good the model is.

that is the honest answer, and it is unsatisfying because the marketing on both sides is not. vendors say "your data never leaves your device", which is almost never literally true. critics say "never let ai see your screen", which ignores that your browser, your os and your employer already can.

the useful version is a set of questions with checkable answers. here they are, current as of september 2026.

question 1: where does the archive live

this is the one that changes the analysis more than anything else.

a vendor holding millions of screen archives is a concentrated target in a way your laptop is not. that is not a hypothetical: security researchers rated microsoft recall a meaningful risk even after it shipped with on device encryption, because a searchable index of everything you did is worth more to an attacker than the same information scattered across apps. microsoft paused recall in june 2024 after the privacy reception and spent roughly 2 years rebuilding it.

the acquisition row is the one people discount and should not. rewind spent 2 years telling mac users the archive was private and theirs, then meta acquired the company in december 2025, capture was permanently disabled on december 19, 2025, and users in 7 markets lost access immediately. almost every privacy policy you have agreed to permits exactly this, in the clause about a merger or sale of assets.

question 2: what can it do besides read

reading your screen and acting on your behalf are different grants, and the gap between them is where the real risk lives.

on a mac these are literally separate permissions. screen recording lets an app see pixels. accessibility lets an app read the interface tree and control other applications. an app holding both, plus network access, is a categorically different proposition from one holding the first alone, which we break down in screen recording permission on a mac.

ask what the tool can do when it is not answering you. a recorder that indexes and waits is a small surface. an agent that can click, type, send and delete is a large one, and the failure modes are covered in computer use agents on a mac.

question 3: can it be steered by what it reads

screen sharing with ai risks one specific failure that most people have not internalised, and it is unsolved rather than merely unpatched.

a model cannot reliably distinguish your instructions from instructions embedded in content it processes. prompt injection is ranked first in the owasp top 10 for llm applications, and screen access makes the attack surface everything you look at: a web page, a pdf, an email, a slack message from a compromised account.

the severity depends entirely on question 2. an agent that can only read gets confused. an agent that can read and act gets used. that is why "what can it do besides read" is the question that determines whether injection is an annoyance or an incident.

it is worth being direct that this affects tools we build too, not only competitors. the full treatment is in what is prompt injection.

question 4: what happens to it later

retention and export decide how much of this matters in 3 years.

is screen recording safe over the long run? that depends on 3 things worth checking before you trust anything:

1. how long are recordings kept by default? short retention is a security control, not a storage optimisation. an archive you no longer hold cannot leak.
2. can you exclude apps and sites entirely? banking, health, password managers and client systems should never enter the archive at all.
3. can you export and delete? an archive you cannot get out of is one you cannot move away from, and an archive you cannot selectively delete is one you cannot clean up.

on retention specifically, the numbers make the case. we measured a real install across 17 days: 26gb total, with video roughly 24.6gb or about 95%, and the searchable index 1.4gb or about 5%. the video is where faces, documents and third party information are legible. dropping it on a short clock removes about 95% of the sensitive material while keeping the part that makes search work. the working is in screen recording storage on a mac.

what "nothing leaves your machine" actually means

treat that claim as a red flag rather than a reassurance.

almost every real application makes network calls: sign in, licence checks, crash reporting, update checks. an app that genuinely sent nothing would not be able to authenticate you. so a vendor claiming absolute locality is either not describing their own software accurately or is counting on you not to check.

the honest version is scoped: the archive stays on your disk, and here is exactly what does cross the network. that is a claim you can verify and hold someone to. the longer argument is in private ai on your mac.

the risk you are already carrying

ai security risks are best judged against the baseline you already carry rather than against zero.

the worry about ai reading my screen privacy is real, and so is the fact that your browser already holds roughly 90 days of history including every url and page title. your employer, on a managed device, can often already see far more than a personal recorder would. your email provider holds a decade of correspondence. chatgpt, claude and gemini all shipped memory features in 2026 that store what you type on their infrastructure under their policy, which anthropic demonstrated is revisable when it began excluding 6 categories including health conditions and political views from claude's memory by default on august 25, 2026.

that change was an improvement. it also confirms those 6 categories were previously in scope, which is the point: provider held data sits under a policy that can change without you.

so the question is not whether to accept risk. it is which shape of risk you prefer, and how much of it you control.

what you get in exchange

it is worth weighing the risk against what the archive is actually for, because the trade is real in both directions.

per the anthropic economic index for may 2026, searching electronic sources is the most common work task in sampled claude conversations at 4.95%, with reference searching second at 3.74%.

searching your own material is 3.61% of conversations and anything about a meeting is 0.26%, while work makes up 43.36% of classified conversations and 51.38% of all usage is augmentation rather than automation. those two low numbers are the gap screen access closes. whether that is worth the exposure is a real decision, and it should be made with both numbers in view.

a checklist before you install anything

6 checks, in the order that eliminates the most tools fastest.

1. where is the archive physically stored? if the answer is a vendor cloud, everything below matters less.
2. what permissions does it hold beyond screen recording?
3. is there an exclusion list, and does it cover apps as well as sites?
4. what is the default retention, and can you shorten it?
5. can you export the archive in an open format, and have you actually run the export?
6. what happens if the company is acquired? read the merger clause rather than the headline.

if a tool fails 1 or 2, stop. the rest is detail.

where remynd sits

remynd records the focused window on a mac, runs ocr locally through apple's vision framework, and keeps the index on your machine.

the scope, stated exactly: focused window capture rather than every pixel of every display, local ocr and storage, recordings default to 30 days of retention, app and site exclusions so whole categories stay out of the archive, and history that is read only everywhere in the app, including over the local connector.

what it does not do, stated equally plainly: asking a question sends the retrieved slices to a cloud model, so there is no claim that nothing ever leaves the machine. the in app chat ships general purpose tools, so the prompt injection caution in question 3 applies to it as much as to anything else. and it does not isolate separate clients or projects into separate vaults.

that is 4 honest answers rather than 4 reassuring ones. if you want the category first, start with screen memory.