Why the architecture is the control
Most apps that record your screen have a security story that ends with "and we encrypt it on our servers." That is a promise about how well a target is defended. ReMynd's story is that, unless you turn on optional sync, the target does not exist, and with sync on it holds only data encrypted on your computer.
Your recordings, the text extracted from them, your searches and your local timeline are written to your computer, under ~/Library/Application Support/Move37/ScreenomeX/Recordings/. Nothing is uploaded to us unless you turn on optional sync. With sync off, an attacker who fully compromised our infrastructure would find no recordings of your screen. With sync on, recordings and extracted text are encrypted on your computer with a password you set before upload, to ReMynd's storage or to your own S3 bucket, so what an attacker would find on our side is encrypted data without that password.
This is not a claim that ReMynd is unbreakable. It is a claim about blast radius: what an attacker gets if they win. We would rather that number be small by construction than defended by diligence.
What we actually hold
The complete list, so you can size the risk yourself:
| What | Where it lives | Why we have it |
|---|---|---|
| Your email address and authentication tokens | Google Firebase Authentication | So you can sign in |
| Subscription and billing status | Our payment processor and Firebase | So paid features work |
| Crash reports — stack traces, OS version, device model | Sentry | So we can fix crashes |
| Usage counters — event names, counts, durations, character counts | Segment, forwarded to Mixpanel | So we can tell which features work |
| Marketing contact record, if you gave us your email on the website | HubSpot and Customer.io | So we can send your download link and, with consent, updates |
| Synced recordings and extracted text, only if you turn on optional sync | ReMynd's storage or your own S3 bucket, encrypted on your computer before upload | So you can back up and restore your history |
| Moments you choose to share (screen video and context, or call audio, transcript and summary) | ReMynd's share service | So the link works |
Unless you turn on optional sync or press Share, we never collect screen recordings, extracted text, call audio or transcripts. We never collect search terms or the contents of your questions to the AI. See the privacy policy for the full detail on what leaves your computer and when.
How the data we hold is protected
- In transit. Everything the app and the website send is over TLS. There is no plaintext fallback.
- At rest. Account, telemetry and marketing records sit with the providers named above, encrypted at rest under their platform controls.
- Access. Production access is limited to the people who need it, over accounts with multi-factor authentication. We are a small team, and the honest version of this control is that the list of people is short.
- Secrets. API keys and service credentials are held as platform secrets, not in the repository.
Your backup bucket
If you enable cloud backup, you supply an S3-compatible endpoint, region, access key and secret. Two consequences worth being explicit about, because they cut both ways:
In your favour: those credentials stay on your computer. We never receive them, so an attacker who compromises us gains nothing that would open your bucket. You can rotate or revoke them in your own provider's console without asking us.
Your responsibility: because it is your bucket, its configuration is yours too. If it is made public, or its keys leak from your machine, we cannot detect that or protect you from it. Keep the bucket private and the credentials to yourself.
On the app's permissions
ReMynd asks for screen recording permission, and on some features accessibility permission. Those are powerful grants and you should be sceptical of anything that asks for them.
What narrows them in practice:
- Text extraction is scoped to the window you are focused on, not to everything on screen. Background windows are recorded as video but not read.
- The recorder skips text extraction when a ReMynd window overlaps what you are focused on, so the app does not read its own AI chat back into your history.
- The AI agent reads your history over a read-only database connection, so it cannot write to your archive. It does also carry tools that run shell commands, AppleScript, Python and web requests on your computer, because that is how it acts rather than only answers. That is the same power as a terminal, and worth treating the same way.
You can revoke either permission at any time in System Settings → Privacy & Security. ReMynd will stop capturing; it will not nag you into turning it back on.
What we do not claim
We are a small team shipping quickly, and it would be easy to imply more assurance than we have. So, plainly:
- We are not SOC 2 certified, and we will not imply we are. If that is a blocker for your organisation, tell us — it affects how we prioritise.
- We have not yet completed an independent third-party penetration test of the Mac or Windows apps.
- No system is perfectly secure, including this one.
If any of that changes, this page changes with it, and the date at the top moves.
Reporting a vulnerability
If you have found a security issue in the app, the website, or our infrastructure, email [email protected]. Please include enough detail to reproduce it.
What you can expect:
- We aim to acknowledge your report within 3 working days.
- We will tell you our assessment and an expected fix timeline rather than going quiet.
- We will credit you when we ship the fix, if you want the credit.
- We will not pursue legal action against you for research conducted in good faith: testing only against your own account and your own data, no destruction or exfiltration of other people's data, no denial of service, and giving us reasonable time to fix the issue before publishing.
We do not currently run a paid bug bounty. We would rather say that than imply one exists.
If something goes wrong
If we suffer a breach affecting your personal data, we will tell you and the relevant regulator within the timeframes the law requires, and the notice will say what was taken rather than what might have been.
Unless you turn on optional sync or share a moment, your screen history is not in our custody, and anything you sync is encrypted on your computer first, so a breach of ours cannot expose a readable copy of it.