SECURITY
Security
Last updated 10 August 2026
The short version: Clarus is a desktop app that works offline. Your captures, your recordings and the text found inside them stay on your computer unless you press the cloud button on one. There is no analytics and no telemetry of any kind, so we could not tell you what you capture or when you use the app even if we were asked.
Where your work lives
On your machine, in your own folders and in
%APPDATA%\dev.getclarus.app. That covers your captures, your
recordings, your edit history, your settings and the search index.
Text recognition runs entirely offline. The recognition models are compiled into the application itself, so reading the text inside a capture never involves a network request and no image is ever sent anywhere to be read. That is also what makes searching your own history by what a picture says possible without uploading anything.
What leaves your computer, and when
Four things, and nothing else:
- The update check. A request for one small file listing the current version. It carries no account, no machine identifier and no usage information, and it happens whether or not you have an account.
- Sign-in, if you have an account. Your email address, to receive a sign-in code.
- A capture you upload. Only one you have pressed the cloud button on. Along with the file we store its size, dimensions, when it was made, how many times its link has been opened, and the text found inside it, so that you can search your own library.
- Feedback you send from inside the app, with anything you choose to attach.
Everything above travels over HTTPS. Captures are never uploaded automatically — there is deliberately no auto-upload setting, because an automatic upload spends storage silently and moves your work off your machine without you deciding to.
Signing in
There is no password on a Clarus account. Sign-in is a code sent to your email, so there is no password for us to store, for you to reuse, or for anyone to steal from us.
The token that keeps you signed in is stored using Windows' own Data Protection API, encrypted against your Windows user account. A copy of that file taken to another machine, or opened by another user on the same machine, cannot be decrypted and is useless. The short-lived access token is held in memory only and is never written to disk.
An account is signed in on one computer at a time. Signing in somewhere else signs the previous machine out.
Your cloud uploads
Uploads go to private storage with no public access rules on it at all. That, rather than the link being hard to guess, is what protects a file: there is no path by which the storage can be read directly.
When someone opens a share link, the request is checked first — that the upload exists, has finished uploading, has not been revoked, has not expired, and that any password on it has been given correctly. Only then is a temporary address issued, and it stops working a few minutes later.
Every database table holding your data has row-level security enabled, so a signed-in user's requests can only ever reach their own rows. Fields that should never be readable by a client — a share link's password hash, for one — are not readable even by the account that owns the row. Your plan and your subscription state can only be written by our payment provider's verified webhook, never by an app or a browser.
Share links
A share link's address is twelve characters drawn from a cryptographic random
number generator, from an alphabet with the look-alike characters removed. There
are more than 1020 possibilities; they are not sequential and they
cannot be enumerated. Pages under /s/ also tell search engines not to
index them.
Still, a link is a key, so treat it like one. Every link can carry a password, which is hashed on the server and never stored in readable form. Every link can be given an expiry, stopped, or deleted outright, from the app or from your library on the web, and any of those takes effect immediately — including for a page somebody already has open. On a set, the expiry, password and revocation apply to everything inside it.
Recordings uploaded on the free plan are deleted after 24 hours by design.
Updates
Clarus updates itself in the background. Every update package is signed with a key that has never been on a server, and the app verifies that signature against a public key compiled into it before an update is installed. An update that has been tampered with, or one from anywhere other than us, fails that check and is discarded rather than run.
What we don't do
- No analytics, telemetry, ads or trackers. There is no analytics SDK in the app, and no record of which features you use or when you open it.
- No selling or sharing of your data, and nothing used to train anything.
- No reading of your uploads. We don't go looking through them, though we will act on a report of something unlawful.
- No auto-upload, and no capture leaves your machine without you asking.
Who processes data for us
A short list, kept current on the Privacy Policy: our database, storage and accounts provider, the service that sends your sign-in codes, our web host, and our payment provider. Card details go to the payment provider directly and we never see or store them.
Reporting a vulnerability
Please email [email protected] with “security” in the subject. Tell us what you found and how to reproduce it, and we will confirm we've received it. Clarus is built by one person, so you will be talking to the developer rather than a queue.
Please don't run tests that degrade the service for other people, and please don't access, change or keep anyone else's data — if you find you can reach something you shouldn't, stop there and tell us what you found. Report something real and we'll credit you here if you'd like to be.
Questions from IT
If you're evaluating Clarus for a company and need something this page doesn't cover, email [email protected] and ask. A straight answer is faster than a questionnaire, and if the answer is “no, Clarus doesn't do that”, you'll get that instead of a hedge.