Privacy
Charmling reads your screen, on your Mac, and never sends any of it anywhere. This page is the boring version of that sentence, written so you can hold us to it.
The short version
- Nothing from your screen ever leaves your Mac. No servers, no accounts, no analytics, no crash reporting, no advertising, no profiling.
- Every AI feature ships switched off. You turn them on.
- What is recorded lives in one plain-text file in your own folder, is readable only by your macOS user account, and erases itself after 48 hours.
- You can read it, and erase it — all of it, the last hour, or everything from one app — at any time, from the app's menu.
See it for yourself
Claims are cheap. Here is Day Memory's whole pipeline, sixteen minutes of a real screen, the file those captures became — produced by the actual redaction code — and the complete accounting of every network request.
Don't take my word for it. Sixteen minutes of a real screen — and the file it became, from the actual redaction code.
- 09:12 · Xcode main.swift — Charmling
- 09:16 · Terminal
export API_KEY=sk-proj-9Fh2KdLmQ8xTvBn4…, then a deploy - 09:20 · Mail Re: Thursday's review — and Priya's whole message under it
- 09:24 · 1Password AWS root — Personal, with the password on screen
- 09:28 · Safari Billing — card on file 4242 4242 4242 4242
{"app":"Xcode","text":"enum Garden { enum Species: String, CaseIterable { case bonsai, dragon\nvar ladder: [Int] { self == .bonsai ? [0, 1, 2, 4, 7, 11] : [0, 1, 2, 4, 7] }\nBuild Succeeded\nFilter Issue navigator Debug area Library","title":"main.swift — Charmling","ts":1755594720}{"app":"Terminal","text":".\/ship.sh --site-only\nBuilding site\u2026\nUploaded 47 files. Success.","title":"charmling — bash","ts":1755594960}{"app":"Mail","text":"","title":"Re: Thursday's review","ts":1755595200}{"app":"Safari","text":"Payment method on file ending [redacted] expires 09\/28 for the team plan\nNext invoice is scheduled for the first of the month, nothing due today\nBilling Invoices Plan Members Settings","title":"Billing — Charmling","ts":1755595680}The complete accounting — every network request, every filter
The app talks to the internet five ways and only five: an update check (optional, and you can switch it off), activating your licence when you enter it, re-checking that licence about once a week so a refunded key stops working, downloading an update when you ask for one, and — only if you switch Live Scores on — asking one fixed address for the public scoreboard. The first four carry your licence key and a random install ID; the fifth carries nothing at all. None of them carry your name, your files, or anything from your screen. Switch on the Shared Cord and your Mac also talks to another Mac on your own network, which never leaves the building. The weekly check does tell us an install is alive, so if that counts as telemetry to you, count it: it is one request, it is the licence, and there is nothing else.
Password managers — 1Password, Bitwarden, Keychain Access and the rest — are skipped entirely: no screenshot is taken of them at all. Everywhere else, any line that names a password, passphrase, recovery code or API key is dropped before it is stored, and anything shaped like a key, token, card number or masked ••••••• field is replaced with [redacted] — masked for its shape alone, which is why the Safari line above kept its expiry and its plan. Adult sites are never recorded by the same always-on filter. None of it is a setting you can get wrong. And the file is not a diary: it holds window titles and the plain text those apps put on screen, dull and literal — a day with nothing interpreting it for you.
And it's your memory: read every word it remembers, see the actual file on disk, or erase it all — one click each. Finder hides ~/Library, so you won't find the file by browsing: press ⇧⌘G in Finder and paste the path, or use Show What I Remember in the app's menu, which opens Finder on it for you. The long version lives at how the memory works and the privacy page.
What Charmling stores, and where
If you switch on Day Memory, roughly every four minutes — and only while you are actually at the Mac — Charmling takes a picture of the frontmost window, reads the text out of it using Apple's on-device text recognition, throws the picture away without ever writing it to disk, redacts the result, and appends one line of text to:
~/Library/Application Support/Charmling/day-memory.jsonl
That file is created owner-only from the instant it exists, so no other user account on the Mac can read it. Records older than 48 hours are deleted. No image is ever stored, at any point, in any form.
What is never recorded
- Password managers. 1Password, Bitwarden, Keychain Access, Dashlane, LastPass, NordPass, Proton Pass, KeePass, Enpass and others are skipped before a screenshot is taken — and so is a password manager open as a web page, judged on what the page says rather than what the application is called.
- Windows that name a credential. A window called
.env,Passwords,Keychain,Recovery Phraseor similar is not photographed at all. - Other people's messages. Mail, Slack, Messages, WhatsApp, Teams and the like are recorded by window title only — never the contents. Other people wrote those, and they did not agree to anything.
- Adult sites are never recorded, with no setting to get wrong.
What is redacted before anything is written
- Any line naming a password, passphrase, recovery code, API key, licence key or similar is deleted — and so is the line after it, because a login form puts the label and the value on separate lines. This works in nine languages, not only English.
- Anything shaped like a secret is replaced with
[redacted]: private keys, API tokens, JWTs, card numbers, connection strings containing a password, long random strings, and masked ●●●●●● fields.
We do not claim this is perfect. No content filter is, and anyone who tells you otherwise has not tested theirs hard enough. That is precisely why the log is short-lived, plain text, in your folder, and erasable in one click. The design assumes the filter will sometimes be wrong and limits what that costs you.
Every network request Charmling makes
Five, and only five — and the fifth exists only if you switch Live Scores on. None of them carries anything from your screen, your files, or your name.
- Update check — once a day, fetches a small static file listing the current version. Optional; you can switch it off.
- Licence activation — once, when you enter your licence key.
- Licence re-check — about once a week, so a refunded or charged-back key stops working. Carries the licence key and a random install identifier.
- Update download — only when you click to download one.
- Live scores — only while Live Scores is switched on, and it is off until you switch it on. Every few seconds Charmling asks one fixed address for the current public scoreboard. The request carries no query, no teams, no sports, no licence key and no identifier — there is nothing in it that could say which Mac sent it, and everybody who asks gets the same answer back. Which sports and teams you follow is decided on your Mac, from that one shared answer, and is never transmitted. Switch the feature off and the request stops the same second.
The weekly check does tell us that an installation is alive, along with the IP address any web request necessarily reveals. If that counts as telemetry to you, then count it — it is one request, it is about the licence, and there is nothing else.
The scores feed is deliberately built so that it cannot learn anything, rather than promising not to look. It accepts no parameters, so no per-reader answer can exist to build. It keeps one copy of the scoreboard at the edge and hands the identical bytes to everyone. It writes no log. The honest caveat is the same one every website has: reaching an address means the address sees an IP, and there is no way to fetch a live score without one. What it never sees is what you care about.
The on-device AI
Recaps, standups, timesheets and quizzes are written by Apple's on-device foundation model, running on your Mac. No prompt, no answer, and no part of your day is sent to us or to Apple or to anyone else. If your Mac cannot run Apple Intelligence, these features simply do not appear.
The diary (off unless you switch it on)
Day Memory erases the text from your screen after 48 hours. That is a real promise and it does not change. It does mean, though, that on Monday the app cannot tell you what you did on Thursday.
The diary is the optional answer to that, and it is deliberately a different kind of record from the log it outlives. For each day it keeps:
- the hours you worked, measured from the record;
- which applications;
- the window titles your own applications wrote;
- the list of names — filenames, tickets, domains — that provably appeared;
- one sentence, written by the model on your Mac, describing the day.
It contains no text from your screen. Not a line, not a fragment. It is strictly smaller and more abstract than the log it replaces.
The rules around it:
- Off by default. Nothing is written until you choose a retention period, and "off" is the first option in the menu.
- You see the first page before it is kept. On the first roll-over the app shows you what it wrote and asks whether to keep it.
- Short by default — seven days when you switch it on, thirty if you ask.
- It lives in
~/Library/Application Support/Charmling/day-digest.jsonl, owner-only, in plain text you can read. - "Forget Everything Now" deletes it too, and switching the diary off deletes everything it has written.
- Private Mode silences it along with every other kind of capture.
- Each day is summarised once, from the raw record. A summary is never re-summarised — that loses the quiet details first, every time.
Your backups
Charmling erases its own file after 48 hours. It cannot erase copies made by something else.
If you back up your Home folder — Time Machine, iCloud Drive, Backblaze, anything — those
backups may contain older copies. Exclude
~/Library/Application Support/Charmling if that matters to you.
What the purchase itself involves
The app sends nothing about you anywhere. Buying it is a different transaction, and it would be misleading to describe one and not the other.
Payment is handled by Polar as merchant of record — they are the seller of record, not us. To take your money they receive what any payment processor receives: your email address, your name as given on the card, your billing country, the card details themselves, and the IP address the purchase came from. They use the country and IP to work out sales tax and VAT. We see your email address and your order; we never see your card.
Their privacy policy governs that data, and you can ask them to access or erase it. Write to support@charmling.app and we will help you reach the right place. We do not add you to a mailing list, and there isn't one.
Taking your data with you
There is nothing to export, because nothing is in a format you'd need to export from. The memory log and the diary are plain JSON-lines text files in your own folder — copy them, open them in anything, do what you like with them. That is the whole of it.
Removing it completely
Here is every place Charmling puts anything, so you can be certain nothing is left behind. Dragging the app to the Bin removes the first one only.
/Applications/Charmling.app— the app.~/Library/Application Support/Charmling/— the memory log (day-memory.jsonl), the diary if you switched it on (day-digest.jsonl), and your locket picture if you set one.~/Library/Logs/Charmling/— a small error log, no screen contents in it.~/Library/Preferences/com.abi.charmling.plist— your settings: which charm, cord length, working hours, and so on. About fifty small values.~/Pictures/Charmling Shots/— screenshots you took with the app. These are your pictures, so they are left alone; delete them if you want them gone.
Or, in Terminal, all of it in one go:
rm -rf /Applications/Charmling.app ~/Library/Application\ Support/Charmling ~/Library/Logs/Charmling ~/Library/Preferences/com.abi.charmling.plistmacOS keeps the Screen Recording and Accessibility permissions in its own database. Remove them under System Settings → Privacy & Security after the app is gone.
Your rights
Because Charmling stores nothing on our side, there is no account to close and no database to search. Your data is in your folder and you can read, export or delete it yourself at any moment. For the purchase itself, our payment provider Polar holds your billing record; write to support@charmling.app and we will help you reach them for access or erasure.
Found a security problem?
Write to support@charmling.app with "security" in the subject and it goes to the top of the pile. Charmling holds Screen Recording permission, so a flaw in it matters more than a flaw in most small apps, and I would much rather hear it from you first than read about it somewhere else.
What you can expect: an acknowledgement within two working days, an honest assessment of whether it is what you think it is, and a fix shipped as fast as one person can ship one. If you want credit in the release notes you will get it; if you would rather not be named, that is fine too. No bounty programme — there is no company to fund one — and no legal threats either.
Children
Charmling is not directed at children under 13 and we do not knowingly collect anything from them — or, for that matter, from anyone.
Changes to this page
If what the app does changes, this page changes first, with a new date at the top. We will not quietly widen what is collected.