The short version
The default path never needs a server.
CaptureRecall does not require an account, cloud sync, or analytics. Captures are saved as PNG files on your computer. Search metadata lives in a local SQLite index. OCR runs from models bundled with the app.
No. Not in the default workflow. Capture, storage, metadata, search, and OCR are local. Optional hosted backup and semantic image analysis are separate, explicit choices described below.
Default data flow
From your screen to your library—and nowhere else.
Your operating system controls permission and selection.
The PNG is saved and OCR runs on your device.
SQLite indexes metadata and recognized text for search.
The capture is available for copy, drag-out, or explicit export only when you initiate that action.
What is stored
Files and fields you can reason about.
Optional semantic analysis
Off by default. Loopback only. Explicitly enabled.
CaptureRecall can request suggested titles and descriptions from an OpenAI-compatible vision service, but only after you enable the feature. The endpoint must resolve to 127.0.0.1, localhost, or ::1. Remote endpoints and HTTP redirects are rejected.
When the service is off or unavailable, local OCR remains searchable and CaptureRecall leaves semantic metadata untouched rather than manufacturing a title from partial OCR text.
Optional hosted vault
Cloud storage only when you choose it.
The free desktop app does not need an account. If you use the hosted vault, sign-in is handled by ChatGPT. CaptureRecall stores your Site user ID and email for account and membership access. Stripe handles payment details; CaptureRecall stores provider customer and subscription identifiers, subscription state and seat count, not your card number.
Explicit uploads send the selected screenshot and submitted title, notes, tags and OCR text to CaptureRecall's Cloudflare R2 storage and D1 metadata database. Downloads require an authorized account or a scoped device key. Team members can read and upload screenshots in their shared library while the subscription and their membership are active. The owner can remove membership and delete hosted copies. Hosted data is not end-to-end encrypted; the service operator and hosting providers can process it to operate the service.
Device keys are stored as hashes on the service, expire after 90 days and can be revoked in your account. The desktop holds the key only while Settings is open and clears it when you leave Settings. No screenshots are uploaded automatically. Browser uploads do not run OCR: they use the filename as a title. Desktop backups also upload existing local metadata.
Deleting a local screenshot does not delete a hosted copy, and deleting a hosted copy does not delete a local screenshot. Hosted deletion removes the library record and requests deletion of the stored object; provider operational backups and logs may follow their own retention. Canceling billing stops new uploads after paid access ends; the owner can still download existing copies. Export your data before deleting hosted files.
Desktop permissions
Your operating system remains the authority.
On macOS, capture uses ScreenCaptureKit for the main display and Apple's native crosshair for area selection. On supported Linux Wayland sessions, capture goes through the XDG Desktop Portal. In both cases the operating system remains in control of permission. A cancelled request does not create a record or leave the app hidden.
System-owned prompts
Capture permission is presented by the desktop environment, not silently bypassed by the app.
Requested access
CaptureRecall asks for the screen interaction needed to complete the capture you initiated.
Deletion and reporting
Delete the image and its index record together.
After confirmation, deletion removes the PNG file and the corresponding database row. Because screenshots can contain sensitive material, review a capture before copying, dragging, exporting, or sharing it outside the application.
Report security issues privately through the project’s GitHub Security page rather than opening a public issue.