ReMyndWhy the architecture is the control
Most apps that record your screen have a security story that ends with "and we encrypt it on our servers." That is a promise about how well a target is defended. ReMynd's story is that the target does not exist.
Your recordings, the text extracted from them, your searches and your local timeline are written to your Mac, under ~/Library/Application Support/Move37/ScreenomeX/Recordings/. There is no upload path from that folder to us. If our infrastructure were fully compromised tomorrow, an attacker would not find a single frame of anyone's screen, because we never asked for one.
This is not a claim that ReMynd is unbreakable. It is a claim about blast radius: what an attacker gets if they win. We would rather that number be small by construction than defended by diligence.
What we actually hold
The complete list, so you can size the risk yourself:
| What | Where it lives | Why we have it |
|---|---|---|
| Your email address and authentication tokens | Google Firebase Authentication | So you can sign in |
| Subscription and billing status | Our payment processor and Firebase | So paid features work |
| Crash reports — stack traces, OS version, device model | Sentry | So we can fix crashes |
| Usage counters — event names, counts, durations, character counts | Segment, forwarded to Mixpanel | So we can tell which features work |
| Marketing contact record, if you gave us your email on the website | HubSpot and Customer.io | So we can send your download link and, with consent, updates |
Not on that list, and never collected: screen recordings, extracted text, search terms, the contents of your questions to the AI, call audio, or transcripts. See the privacy policy for the full detail on what leaves your Mac and when.
How the data we hold is protected
- In transit. Everything the app and the website send is over TLS. There is no plaintext fallback.
- At rest. Account, telemetry and marketing records sit with the providers named above, encrypted at rest under their platform controls.
- Access. Production access is limited to the people who need it, over accounts with multi-factor authentication. We are a small team, and the honest version of this control is that the list of people is short.
- Secrets. API keys and service credentials are held as platform secrets, not in the repository.
Your backup bucket
If you enable cloud backup, you supply an S3-compatible endpoint, region, access key and secret. Two consequences worth being explicit about, because they cut both ways:
In your favour: those credentials stay on your Mac. We never receive them, so an attacker who compromises us gains nothing that would open your bucket. You can rotate or revoke them in your own provider's console without asking us.
Your responsibility: because it is your bucket, its configuration is yours too. If it is made public, or its keys leak from your machine, we cannot detect that or protect you from it. Keep the bucket private and the credentials to yourself.
On the app's permissions
ReMynd asks for screen recording permission, and on some features accessibility permission. Those are powerful grants and you should be sceptical of anything that asks for them.
What narrows them in practice:
- Text extraction is scoped to the window you are focused on, not to everything on screen. Background windows are recorded as video but not read.
- The recorder skips text extraction when a ReMynd window overlaps what you are focused on, so the app does not read its own AI chat back into your history.
- The AI agent's access to your history is read-only and goes through typed tools, rather than arbitrary access to your filesystem.
You can revoke either permission at any time in System Settings → Privacy & Security. ReMynd will stop capturing; it will not nag you into turning it back on.
What we do not claim
We are a small team shipping quickly, and it would be easy to imply more assurance than we have. So, plainly:
- We are not SOC 2 certified, and we will not imply we are. If that is a blocker for your organisation, tell us — it affects how we prioritise.
- We have not completed an independent third-party penetration test of the macOS app.
- No system is perfectly secure, including this one.
If any of that changes, this page changes with it, and the date at the top moves.
Reporting a vulnerability
If you have found a security issue in the app, the website, or our infrastructure, email [email protected]. Please include enough detail to reproduce it.
What you can expect:
- We aim to acknowledge your report within 3 working days.
- We will tell you our assessment and an expected fix timeline rather than going quiet.
- We will credit you when we ship the fix, if you want the credit.
- We will not pursue legal action against you for research conducted in good faith: testing only against your own account and your own data, no destruction or exfiltration of other people's data, no denial of service, and giving us reasonable time to fix the issue before publishing.
We do not currently run a paid bug bounty. We would rather say that than imply one exists.
If something goes wrong
If we suffer a breach affecting your personal data, we will tell you and the relevant regulator within the timeframes the law requires, and the notice will say what was taken rather than what might have been.
Because your screen history is not in our custody, a breach of ours cannot expose it. That is the whole point of building it this way.