Privacy Policy

Last updated: February 25, 2026

The short version

Kadrs is a screenshot tool. All screenshots are captured, annotated, and stored locally on your Mac. We have no analytics, no telemetry, and no third-party tracking. The only time data leaves your device is when you explicitly use the Share feature.

On your device

Screenshots, annotations, OCR text recognition, and all image processing happen entirely on your Mac. Nothing is sent to any server during normal use. We don't collect usage statistics, crash reports, or any form of telemetry.

When you share a screenshot

If you choose to share a screenshot via a link, the following happens:

• Your screenshot is encrypted on your device using AES-256-GCM before upload. The decryption key exists only in the URL fragment (#key) and is never sent to our server.
• The encrypted file is stored on a server in Helsinki, Finland until the expiry you choose, or indefinitely if no expiry is set.
• We cannot view, decrypt, or access your screenshot content.

What we store when you share

When you upload a shared screenshot, our server records:

• Device identifier — a random ID generated by the app, stored in your macOS Keychain. Not tied to your Apple ID or any account. Used for rate limiting and abuse prevention.
• Country code — a two-letter country code (e.g. "DE", "LV") derived from your IP address by Cloudflare. Your actual IP address is not stored.
• Hashed IP address — a one-way HMAC hash of your IP, rotated daily. We cannot reverse this to obtain your real IP address.
• Upload metadata — timestamp, file size, and your chosen expiry duration.

This data is stored in a database in the EU (Warsaw, Poland) and retained indefinitely for abuse prevention and legal compliance.

What we do not store

• Your real IP address
• Your name, email, or any personal identity
• Unencrypted screenshot content
• Decryption keys
• Any data from the local screenshot/annotation workflow

Third parties

We do not sell, share, or provide your data to third parties. Infrastructure providers (Cloudflare, Hetzner) process requests as necessary to deliver the service but do not have access to decrypted content.

Data deletion

Shared screenshots are automatically deleted after the expiry you choose, unless you select no expiry. Anyone with the share link can also report it for immediate removal. Audit logs are retained for legal compliance.

Legal disclosure

We may disclose the data described above in response to valid legal requests, such as court orders or law enforcement subpoenas. We will only provide data we actually possess and will not attempt to decrypt end-to-end encrypted content, which we are technically unable to access without the decryption key.

Contact

Questions about this policy: kadrs@epias.ltd