Legal

Privacy Notice

CaptureX keeps source media on your Mac and limits online data to payment and license operations.

Effective September 3, 2026

Privacy Notice

1. Local media stays local

CaptureX is a local-first macOS application. Screenshots, screen recordings, camera video, microphone audio, edits, history, and exported media are processed on your Mac. CaptureX does not upload this source media to the licensing service or website.

2. License and purchase data

To start a purchase or activate a license, CaptureX and this website may process:

  • Email abuse protection stores keyed HMAC hashes of the recipient and source IP (an IPv6 /64 prefix), request type and time. It does not store raw IPs or email contents in these records. Records expire after 24 hours and are deleted on requests and by an hourly cleanup, normally within 25 hours. Cleanup failures may delay deletion; these records are not used for analytics.
  • The email address you verify before purchase, kept together with a one-way SHA-256 hash that binds the license. Short-lived verification challenges store an HMAC of the six-digit code, failed-attempt count, and a hash of the temporary access token; plaintext codes and access tokens are not stored.
  • Paddle customer, transaction, price, adjustment, and refund identifiers needed to issue, restore, or revoke a license.
  • The purchased plan, fixed seat limit, license status, slot number, timestamps, and bounded audit outcomes used for fraud prevention, refunds, device release, and support.
  • When you first activate a license, CaptureX sends the licensed email, license key, a random per-installation ID generated in your Keychain (not a hardware identifier), and the app version. The service returns a signed device grant for offline use. Only administrators can view device seats; installation identifiers are shortened in the administrator console. Screens, capture content, file paths, hardware serial numbers, and usage are never sent.
  • A one-way hash of the recovery secret. The licensing database does not store the original recovery secret.

3. Website hosting, payments, and browser storage

The website is served through Cloudflare. Like ordinary website hosting, Cloudflare may process request metadata such as IP address, user agent, requested URL, timestamps, and security outcomes to deliver and protect the site. For growth analysis the website keeps server-side records of what it serves: each page view records the URL path, its language segment, the referring page and its host, a coarse platform label, IP address, user agent and time, and each file download additionally records the file name and version; common crawler requests are excluded. CaptureX does not place analytics, advertising, or cross-site tracking cookies, loads no third-party analytics scripts, and website request metadata never includes your local capture media.

Paddle acts as the payment provider and merchant of record. Paddle receives checkout, customer, tax, and payment details under its own privacy terms; CaptureX does not receive full card details.

The checkout page temporarily stores a purchase request, selected plan, your email address, and the recovery secret in your browser session so you can resume checkout and retrieve the license key after payment. The separate administrator site uses a Secure HttpOnly session cookie, stores only language and theme preferences in local storage, and keeps request-verification tokens in page memory. Administrator password hashes, expiring session hashes, and minimal administrator audit records are stored by the service. Verified payment totals and currencies may be stored for business reporting; no usage telemetry is collected.

4. Retention, disclosure, and choices

Unused purchase requests become invalid after 24 hours. License, transaction, adjustment, and audit records may be retained for the life of the license and as reasonably required for security, accounting, legal compliance, refunds, and support.

We disclose data only to service providers required to operate checkout and licensing, when required by law, or to protect users and the service. We do not sell screen content or license data.

You may clear browser session data at any time. To ask for access, correction, or deletion where legally available, open a public GitHub issue containing no personal data or secrets and request privacy-safe follow-up instructions. Payment-data requests can also use the private support link in the Paddle receipt.