Updated 2 November 2026

Privacy policy

catu is a Mac app for screenshots, clipboard history and screen recordings, an iPhone app for recording, sharing and editing, and an optional sharing service at catu.app. This policy explains what each part does with your data. The short version: the apps keep everything on your devices; the sharing service stores only what you choose to share, and it does not track you.

Who is responsible

YDESIGN SYSTEMS LTD EOOD, 46 Gena Dmitrova Str. Sofia 1415 Bulgaria, Bulgaria (“we”). Questions and requests about your data: privacy@catu.app.

The Mac app

The app itself has no access to the internet. Your clipboard history stays in the app’s memory and is gone when the app quits, unless you turn on “Save history on this Mac”, in which case it is kept encrypted in the app’s own folder and excluded from Spotlight and backups. Things that look like passwords or keys are never kept. Screenshots and recordings are saved in folders under your Pictures and Movies. The app sends no analytics, no crash reports and no usage data to us or to anyone else.

Screen text recognition (OCR) runs on your Mac with Apple’s frameworks; nothing is sent anywhere.

Screenshots and screen recordings

The Mac app uses the macOS Screen Recording permission only to capture what you ask it to, when you ask: a screenshot, a scrolling capture, Copy Text or Copy Table from Screen, or a screen recording, each started by you with a keyboard shortcut, the menu or a Siri or Shortcuts action. It never captures in the background. It captures the area, window or display you pick; a recording also takes the microphone and the camera only if you switch them on for it.

Screenshots are saved on your Mac in Pictures › catu screenshots and recordings in Movies › catu recordings, and each one also goes to the clipboard history on your Mac. Text read from the screen is recognised on your Mac. To name a recording, the app reads the title of the window under the recorded area; that title stays on your Mac unless you share the recording. Nothing captured leaves your Mac unless you share it as a link (see “Sharing”), in which case it is encrypted on your Mac before upload and stored with our storage provider only so the link can show it. Captures are never sold, never shared with anyone else, and never used for advertising or to train AI models. You can delete local captures in Finder at any time; shared ones stay until you delete them, until the expiry you chose, or until you delete your account.

The iPhone app

The iPhone app signs in with Apple or with a code sent to your email, and shows the Library of the same account. Screen recordings (made with iOS’s own screen broadcast), camera recordings and the videos and pictures you pick from Photos or Files stay in the app’s own storage on your iPhone until you share them; the microphone records with the camera (Settings › Recording can turn that off), in a screen recording only when you turn it on in iOS’s broadcast panel, and for a voice-over you record in the editor. Sharing encrypts the file on your iPhone and uploads it like the Mac app does (see “The sharing service” below), during the recording if “Upload while recording” is on. While you record, the progress shows in a Live Activity on your Lock Screen; that stays on the iPhone.

With “Transcript after sharing” on (Settings › Recording, on by default), the iPhone transcribes the speech of a recording you shared with Apple’s on-device recognition on iOS 26; the words are encrypted with the recording’s key and stored with it, like the Mac’s notes below. The video editor on the iPhone works like the one on the web: AI editing, a transcript made from the video, voices, music, GIFs and photos send exactly what is described below for the browser, from the app instead. Clipboard sync on the iPhone uses the same account key as your Macs and the same end-to-end encryption: the key arrives through iCloud Keychain, the QR code from the Mac app or your recovery key, or, if you have none yet, is made on the iPhone and kept in its keychain; it never reaches us. What you write on the Support tab reaches us as described under “Who helps us”. The iPhone app sends no analytics, no crash reports and no usage data to us or to anyone else.

Clipboard sync

Off by default, and part of the Web app plan. If you turn on “Sync clipboard to catu.app” in the app’s Privacy settings, your last 50 copies (text, links, pictures up to 5 MB and single files up to 200 MB) are sent to our storage so that they appear in your web Library and on the other Macs you sign in on, and copies added there arrive on your Mac. Copies that look like passwords or keys, copies made while Private Mode is on and copies from blocked apps are never sent.

These copies are encrypted end to end. The key is made on your Mac from an account key that lives in your Mac’s keychain and is never sent to us; another device of yours gets it only from the QR code or link you create in the app, together with a 6-character code shown next to it, and the sealed hand-over expires after a minute. We hold only the encrypted items, their size and kind, which device they came from, when they were copied and whether they are pinned. Files from the clipboard are saved by the receiving Mac in its Downloads folder, under catu. The account key is stored as an iCloud Keychain item, so when iCloud Keychain is on, Apple carries it to your other Macs with Apple’s own end-to-end encryption; it still never reaches us. We cannot read the items, and we cannot recover them if you lose every device that holds the key. Turning the setting off stops uploading and offers to delete the items already stored; the “Clear all” link in the web Library deletes them too. Items beyond the last 50 are deleted as new ones arrive.

You can turn a clipboard item into a share link. It is then stored like a shared clip (see below), with one difference: the key stays in the link itself, after the “#”, which browsers never send to a server, and we hold only a copy locked with your clipboard key. We cannot open such a link, so it gets no content preview in chat apps, and we cannot read it when asked to.

AI editing

Off until you turn it on in Settings, and part of the Web app plan. When you type an ask in the video editor, your browser (or the iPhone app) sends the ask together with the clip’s edit list (the trims, cuts and items you have placed), the recording’s length and picture size, your previous asks in that session, and up to 24 small still pictures of the recording (512 pixels wide, one every few seconds and around the moments your ask names) and, when the recording has them, the notes your Mac made at recording time (below) to Anthropic’s Claude through our server. It never sends the video file, the audio, the title or the key. Our server forwards the request and keeps none of its content: one row per call records when, for which clip, how many tokens, and whether you kept the result, which is what your daily budget counts. Anthropic processes the request under its API terms, does not train on it, and keeps it only briefly for abuse monitoring. The AI only proposes; nothing is saved until you keep it.

Notes your Mac makes for AI editing

With “Notes for AI editing” on (Settings › Privacy in the Mac app, on by default), the Mac app does two things after a recording is shared: it transcribes the speech with Apple’s on-device recognition on macOS 26, with the time of each word, and it keeps where you clicked, scrolled and moved the pointer inside the recorded area while recording. Never which keys you pressed. Both are encrypted on your Mac with the recording’s own key, stored next to the recording, counted in your storage and deleted with it. Nobody at catu can read them. They are used by the editor for captions and by AI editing when you ask, and are sent to Anthropic only then, as described above. Videos uploaded from the web have no such notes. For those, and for a recording where the Mac did not make them, the editor’s Captions card offers to make a transcript from the video: when you click it, your browser (or the iPhone app) decodes the audio and sends it, piece by piece, to OpenAI’s transcription service through our server. We keep none of the audio; OpenAI processes it under its API terms and does not train on it. The words come back to your device, are encrypted with the recording’s key and stored with it like the Mac’s own notes. A voice-over made from text (an AI ask for a narration) sends that text to ElevenLabs through our server, which keeps neither the text nor the audio; the audio is stored with the recording, encrypted, like a recorded take. Music or a sound effect made to order (the Music and Sounds options in the editor’s Audio card, or an AI ask) sends your short description and the wanted length to ElevenLabs the same way; the audio comes back and is stored with the recording, encrypted. Picking from catu’s own library sends nothing anywhere. ElevenLabs processes both under its API terms. The music is cleared for commercial use in your videos.

Finding a GIF or a stock photo or video in the editor sends your search words to Giphy or Pexels through our server. The small previews and the one you pick are then loaded straight from Giphy’s or Pexels’ servers, which see your network address as they would for any picture on the web; the one you add is stored with the recording, encrypted. Text in a font other than Geist loads that font from Google Fonts in the same way, which sees your network address and the font’s name, nothing else; this also happens when someone opens a shared clip whose text uses such a font.

The sharing service

Sharing is optional and needs an account. When you share a capture, a separate helper inside the app, the only part with network access, encrypts the file on your Mac and uploads it to our storage. Here is what the service holds:

Your account: the email address of your Apple ID (or Apple’s private relay address), your Google account or the email you signed in with; a display name and a profile photo if you set them (the photo is stored on Vercel and shown beside your clips and comments); sign-in records kept by our authentication provider.
Shared clips: the encrypted files, their encryption keys (sealed with a server secret so a copy of the database alone opens nothing), their size, when they were shared, whether they expire, who may comment, a count of how often they were opened and, for each opening, the viewer’s country and kind of device (never their address or identity; shown to the person who shared the clip, who is also emailed once when a shared recording is first opened), and the link’s password as a one-way hash if you set one. When a link without a password is pasted into a chat app or an email, the service opens that clip’s title and first frame to make the preview the app shows; links with a password show only that a clip was shared.
Comments: the text and, for recordings, the moment it refers to; who wrote it (an account, or for guests a name and a random identifier kept in the guest’s own browser); when it was written, edited or removed.
Protection against abuse: to limit password guessing and comment spam we count attempts per link and per network address for a day. Addresses are stored as one-way hashes and deleted after 24 hours.

We can read clips and comments when needed to run the service, for example to remove content that breaks the terms. We do not sell data, show advertising, or use your content for anything but providing the service to you and to the people you share with.

People who open a link

Opening a shared link needs no account. We do not set tracking cookies and run no analytics on clip pages. Someone who comments as a guest gets a random identifier stored in their own browser, so they can edit or remove their comments later; it is not linked to anything else.

Website statistics

To see how many people visit catu.app and where they come from, the site counts page views itself. It keeps the page, the referring site, campaign tags from the link you clicked, your country and whether you used a phone or a computer. It does not set a cookie and does not keep your address: visitors are told apart for one day by a one-way code made from the address and browser with a secret, discarded the next day. Pages that show a shared clip are not counted at all, and browsers that send “Do Not Track” are left out. No third party receives any of this.

Cookies and local storage

Signed-in pages use a session cookie, needed to keep you signed in. Your browser also keeps small preferences (such as the Library’s view and a guest name) in its own storage. There are no third-party cookies.

Where data is kept, and who helps us

Supabase (accounts and the database), hosted in the European Union (Ireland).
Slack (receives what you write on the support page or the iPhone app’s Support tab, so we can answer).
Stripe (payments for the Web app plan: your card details go to Stripe, never to us; we receive your email, country, and the status of your subscription and invoices).
Resend (sends our emails: the sign-in code, a note when someone comments on your recording, and one when a recording you shared is first opened; both can be turned off in Settings). Your email address and the message are passed to it for sending.
Sentry (error reports from the website, stored in the European Union, Germany): what failed, in which page and browser, and the country and city Sentry reads from the connection, with page addresses cut before any “?” or “#” so no link key, sign-in code or content is ever included; no names, emails or IP addresses are kept. The Mac and iPhone apps send nothing.
Vercel (the website, and file storage in Paris, France). Some requests may be served from Vercel’s other regions, including the United States, under standard contractual clauses.
Anthropic (Claude, for AI editing), OpenAI (a transcript made from the video) and ElevenLabs (voices, music and sound effects), only when you use those features, as described above, each under its API terms.
Giphy, Pexels and Google Fonts (GIFs, stock photos and videos, and fonts in the editor and on shared clips), as described above.
Apple and Google, when you sign in with them, under their own policies; Apple also carries the account key through iCloud Keychain when you use it.

How long

Shared clips stay until you delete them. When a link expires or you switch it off, it stops opening and nothing of the clip is shown to anyone who opens it, but the clip stays in your Library until you delete it. We never delete a clip on our own. Comments stay with their clip. Account data stays until you delete the account, in Settings on catu.app or in the Mac app (Settings › Sharing › Delete Account), or ask us to; that removes every clip, comment and synced item and cancels a subscription at once. Clipboard history and local files are yours and never reach us, except the encrypted copies you choose to sync, which stay until newer copies replace them, you delete them or you turn syncing off.

Your rights

Under the GDPR you can ask for a copy of your data, have it corrected or deleted, restrict or object to its processing, and take it elsewhere. Write to privacy@catu.app. You can also complain to your local data protection authority; in Bulgaria that is the Commission for Personal Data Protection.

The legal bases for processing are the contract with you (providing the service), our legitimate interest in keeping the service safe (abuse limits, security), and your consent where you share content.

Children

catu is not meant for children under 16, and we do not knowingly keep their data.

Changes

If this policy changes in a way that matters, the date at the top changes and signed-in users are told on the site.