Privacy

Last updated 25 July 2026

DrawOnClip never connects to the internet. No accounts, no sync, no analytics, no crash reporting, no update checks. There is no server to send anything to, so nothing about what you capture or draw leaves your Mac.

The one exception is Draw on Another Device, which is opt-in, off by default, and runs only on your local network — described in full below.

What the app stores on your Mac

• Sessions — ~/Library/Application Support/DrawOnClip/Sessions, kept for 14 days. Each session holds the original image and every step you drew, so undo and rewind can work.
• Preferences — your tool, color, stroke width, hotkey, and window choices.
• Diagnostic logs — standard macOS logs, which age out on their own. They record that things happened; they never contain your image contents or the text you type.

The un-redacted original

This is the part worth being explicit about. When you redact something, every image you export is a flattened render with the hidden pixels genuinely absent. But while the session still exists, the original image is kept inside that session bundle so undo can work.

It never leaves your Mac — but it will be copied by any backup that copies your Application Support folder, Time Machine included. If a capture is sensitive enough that this matters:

• File ▸ Delete Session Now erases that session's saved data immediately, including the original, and stops it being saved further. The window stays open so you can finish and export.
• Settings ▸ Clear All Data removes every saved session and resets preferences. It tells you exactly what will go before you confirm.

What your exports contain

Images you copy, save, share, or drag out are flat renders at full resolution. They carry:

• no embedded thumbnail;
• no leftover metadata from the original capture;
• no hidden trailing bytes past the end of the image data.

That last one is the flaw that famously let "cropped" screenshots be un-cropped in other tools. It's excluded here by construction and an automated test enforces it on every build.

Files you export are yours. The app never touches them again, and "Clear All Data" does not delete them.

Draw on Another Device

This feature starts a small service on your local network so a tablet or phone can draw on the current screenshot in its browser. It is off until you turn it on, and each session needs a fresh scan of a QR code.

• The pairing secret is 128 bits and appears only in the QR code. A challenge-response handshake keeps it off the wire entirely.
• The image and every stroke are encrypted and tamper-checked with that secret, so another device on the same Wi-Fi can neither read your screenshot nor inject strokes.
• The service runs only while a device is paired and stops on disconnect, purge, window close, or quit. While it's live the app shows a "connected" chip and animates the menu bar icon.
• Nothing is sent to the internet — traffic stays between your Mac and the paired device.

Scoped honestly: this is an app-level encryption scheme, not a certified secure channel, which is why the consent sheet recommends a network you trust. The browser page also caches the image on that device, so use a private tab for sensitive captures.

Permissions the app may ask for

• Screen Recording — only for "New Screenshot", which captures from inside the app. The main path (⌃⇧⌘4, then click the menu bar icon) needs no permission.
• Folder access — only if you use the recent-screenshot rescue, so macOS can let the app look at the folder your screenshots land in.
• Local network — only for Draw on Another Device.

Removing it completely

Drag the app to the Trash, then delete ~/Library/Application Support/DrawOnClip and the app's preferences file.

This website

drawonclip.com is a set of static files. It sets no cookies, runs no JavaScript, loads no third-party fonts, scripts, or trackers, and has no analytics. It's hosted on Cloudflare Pages, which keeps ordinary server request logs as part of serving it — that's the only data collected anywhere in this project, and it belongs to the hosting layer rather than to the app.

Changes

If any of the above changes, this page changes with it and the date at the top moves.