Privacy statement

SentryScreen examines your Mac’s screen on your Mac. Screen content never leaves it. The app sends one thing over the internet, and only when you say so: a diagnostic report you have read and approved. Nothing is sent automatically.

On your Mac

SentryScreen uses the macOS Screen Recording permission to receive what is on the screen. It examines those frames in memory. The installed app never writes screen images or video to disk, and it never sends them anywhere. The one exception is a developer command-line option that someone runs by hand: it saves cropped screen images to a folder they choose, on that Mac.

It writes local logs about its own work: what was covered and how confident it was, where the covers were placed, which application a cover belonged to, and timings and health figures. Those logs stay in a local folder on that Mac and are never sent anywhere. They can still show when an application was in use, so treat them as private.

Your settings live in a local file. Your parent PIN is not stored as plain text, and a Standard account — your child’s account — cannot read, copy, or delete it.

Diagnostic reports

A diagnostic report helps us find and fix problems. Nothing is sent until the Mac’s owner opens the report in SentryScreen’s settings, reads what it contains, and approves sending it. Each report is sent once, one way, to our server; nothing comes back except a receipt that it arrived. If you never approve one, the app makes no network request at all.

A report contains:

• A random report number (machine_id), made fresh for each report and never stored on the Mac. It is not your Mac’s serial number, and it does not link two reports. Two reports from the same Mac can still share some of the same log lines.
• The SentryScreen version and build, and which detection-model file it uses.
• Your macOS version (for example “15.4”), the processor family, the Mac’s model (for example “Mac15,4”) and how long since it last started.
• Your account’s user number (uid), whether it is an administrator, and whether it is the account signed in at the screen.
• Whether SentryScreen’s background jobs are running, and their last exit code.
• Your protection settings, from a fixed list and never the PIN. Account names are replaced by “admin” or “standard”.
• The end of SentryScreen’s own logs: alerts, status lines from a fixed list, counter summaries and cover counts.
• SentryScreen’s most recent crash log, if there is one.

SentryScreen sends no header describing your system (no “User-Agent”), so a report does not say which browser or library sent it.

What our server keeps

Diagnostic reports

Kept 90 days from the day they arrive, then deleted automatically. Only the people who maintain SentryScreen can read them, and we use them only to fix problems.

The internet address a report came from

Not stored with the report. It is counted, as a one-way hash, in a short abuse limit that is deleted within an hour of its window closing. Our server’s logs hold the method and path of a request, never its address or body. Our hosting provider (Railway) keeps standard request logs, which include the address, for a limited time.

Anything else

Nothing. There are no accounts, no payments, no emails from us, no analytics and no advertising.

Companies involved

Cloudflare

Hosts this website and carries connections to it and to our server.

Sees the internet address of a request and, for a report, the report itself in transit.

Railway

Runs the small server and database that receive diagnostic reports.

Stores the reports for the 90 days above.

Stripe

Processes contributions made through the “Support the project” link, on Stripe’s own page.

Receives what you enter there, under Stripe’s privacy policy. We see the amount, the email address and the name Stripe passes on, and use them only for the receipt. The app has nothing to do with it.

GitHub

Hosts the source code and the downloads.

Sees what any visitor to GitHub sees when you download a release or open an issue, under GitHub’s own privacy statement. The app does not contact GitHub.

This website sets no cookies and loads nothing from other sites. The room switch remembers your choice in your own browser only.

Removing SentryScreen

An administrator removes SentryScreen from Settings › Remove SentryScreen…. Removal deletes the application and its local files, asks whether to keep your settings and PIN, and can clear the macOS record of the Screen Recording permission.

Deleting a report early

Reports are deleted after 90 days without any request. To have one deleted sooner, write to us from the Support page with the report’s machine_id. Copy it from the report on the review screen before you press Send; the app does not keep it.

Check it yourself

The app and the server are both open source, so every statement here can be checked against the code: the app and the server and this site.