Your data stays on your Mac — our privacy promise

Granting Screen Recording, Camera, and Microphone permissions to any app is a real moment of trust. You’re handing it the ability to see and hear everything you do. So before you flip those toggles, here’s the deal with TinyRec — in plain language, no legalese.

The short version

TinyRec runs 100% offline. Your recordings, your scripts, your transcripts, your edits — none of it leaves your Mac. There’s no account to create, no cloud sync, no analytics on what you record, no telemetry on how you use the app.

The short list below covers the only times bytes leave your Mac — all opt-in, all clearly initiated by you.

What stays on your Mac (everything you actually create)

Thing	Where it lives
Screen recordings	~/Library/Application Support/TinyRec/desktop/recordings/
Camera + mic recordings	Same project folder, side by side with the screen capture
Project files (script text, edits, settings)	Same project folder, as JSON
Transcripts (captions)	Generated locally with Whisper, saved next to the recording
Voice-overs (TTS audio)	Synthesized by the third-party TTS provider you pick (using your own API key), then saved as .wav in the project folder
Exported MP4s	Wherever you tell the export dialog to save them

You can drag the entire TinyRec folder out of Application Support to back it up, move it to another Mac, or delete it. There’s no cloud copy.

What goes to a server (the small list)

Below is every network request TinyRec ever makes. You can verify all of them with Little Snitch or Lulu:

1. Update check — On launch, the app pings GitHub Releases to see if there’s a newer version. The request includes nothing about you — it’s a plain HTTP GET to a public release URL. You can disable auto-update in Settings if you’d rather.
2. License activation — When you enter a Lifetime license key, the app sends only the key itself to the activation server (Polar.sh) to confirm it’s valid and bind it to your device. No filename, no recording metadata, no email — just the key string. Free users never make this request because there’s no key.
3. Cloud share — only if you click “Share to Cloud” — When you decide to upload a finished video to get a quick public link to send around, that one file is uploaded to TinyRec’s storage. The file is automatically deleted after 7 days, and the link stops working at the same time. Nothing else gets uploaded — not your project file, not other recordings, not your scripts. If you never click this button, nothing ever leaves the app’s local storage.

That’s the entire list. No analytics. No crash reporting. No “anonymous usage data.” No A/B test bucketing. No Mixpanel, Segment, Sentry, or anything similar.

What about transcription? Doesn’t that need a cloud?

No. Captions are transcribed by Whisper running locally on your Mac. The audio file is read off your disk, processed by the model running in a sandboxed process, and the transcript is written back to disk. Nothing leaves the machine.

The first time you generate a caption, the Whisper model itself is downloaded (one-time, ~150 MB) — but that’s a model file, not a request that includes any of your audio.

What about voice-over?

No data ever passes through TinyRec’s servers — voice-over is a “bring your own provider” feature.

When you add a voice-over to a scene, you pick a text-to-speech provider (e.g. ElevenLabs, OpenAI, etc.) and paste in your own API key. The script text goes from TinyRec directly to that provider over their public API; the synthesized .wav comes back, lands in your project folder on disk, and we never see any of it.

That means:

• The provider’s privacy policy (whichever one you picked) governs what happens to your script text on their side. We don’t influence that.
• Your API key is stored locally in TinyRec’s settings — never uploaded.
• If you don’t add any voice-overs, no TTS network requests are ever made.
• Switching providers, revoking your API key, or going offline all “just work” — TinyRec has no opinion about which one you use.

What about iPhone recording?

iPhone capture happens over a USB cable using the same protocol QuickTime uses (CoreMediaIO). Frames go directly from the phone, through the cable, into TinyRec, onto your disk. They don’t pass through Apple’s servers, our servers, or anyone else’s.

”Why does TinyRec need Accessibility?”

It’s a macOS-level permission for reading the cursor position locally. It lets TinyRec see where your mouse is on your own Mac so the editor’s auto-zoom and click effects can react to cursor activity. The permission gives the app no way to send that information off-device — you can hand it Accessibility access while your Mac is in airplane mode and it works fine.

The promise

If TinyRec ever starts collecting analytics, telemetry, or anything else — even anonymized, even for “improving the product” — that change will be flagged in the release notes, opt-in by default, and visible in a Settings → Privacy panel that you can verify before deciding.

Right now, that panel doesn’t need to exist, because there’s nothing to opt out of.

How to check for yourself

Don’t take my word for it. macOS gives you everything you need to verify what TinyRec is doing — pick whichever one of these you’re most comfortable with:

Easiest — Activity Monitor (no install)

Built into macOS. Open Activity Monitor → Network, find TinyRec in the list, and record a video while you watch. As you record / export / caption, you’ll see TinyRec’s “Bytes Sent” stay flat. The only times it ticks up are the actions in the list above (update check on launch, license activation if you’re on Lifetime, your own click on Share).

Most thorough — Little Snitch or Lulu

If you want to see every connection attempt and approve it one at a time, install Little Snitch (paid) or Lulu (free, open-source). Both intercept outbound connections at the kernel level and pop up a prompt the first time any app tries to reach a new domain.

You’ll see TinyRec only ask for:

• objects.githubusercontent.com — fetching the latest release info
• api.tinyrec.io — license validation (only if you enter a Lifetime key)
• Your TTS provider’s domain (e.g. api.elevenlabs.io, api.openai.com) — only if you’ve added a voice-over with that provider
• TinyRec’s cloud-share endpoint — only when you click Share

Block any of those and the rest of the app keeps working.

Sanity check — pull the plug

Disable Wi-Fi (or just unplug your ethernet) and use TinyRec for a full session: record, edit, export, caption. Everything works. The only things that fail are the four exceptions above — none of which are part of the core record-edit-export loop.

Questions?

I read every email — nam.trankhanh.vn@gmail.com. If something here is unclear, or you want me to walk through the codepath for a specific permission, just ask.

→ Back to Grant permissions on first launch