What we thought about when we built it

Last updated: 14 October 2026 · Describes build 1.1.0

catchroll makes files that go where you send them, often straight into an AI conversation. That raised design questions we took seriously. These are the answers we chose, and why.

1 · The frame you draw is the boundary

Whatever you framed is what’s shared. The tool may include less; it must never include more. And the boundary is geometric: your rectangle, not what happened to be visible inside it. Text sitting under an opaque panel inside your frame is still captured; text outside your rectangle stops at the edge. A cut line can carry a truncated fragment, but never a readable sentence from outside your frame. Practical tip: close floating chat and DM windows before you capture, so they aren’t inside your frame to begin with.

2 · Redaction destroys; it doesn’t cover up

When you black out, pixelate or blur part of a tile, the pixels are destroyed in the picture itself, not covered by an overlay someone can peel back. And because a tile can carry text and a link back to its source, redacting also removes the saved text and the source pointer from every file you save or export. One honest trade-off: redacting any part of a tile removes all of that tile’s saved text, no matter how it got onto the canvas. There is no reliable way to know which words sit under the redaction, so we remove all of it rather than risk leaking what you hid. If one part of a page is sensitive, capture it separately and redact that capture. Redaction’s limits (a thin edge under black-out, very large text under pixelate or blur, and copies made before you redact) are on the security page.

3 · No fingerprints

Files exported from catchroll carry no identifier for you or your installation. A per-install signature was proposed early on and rejected outright: a token like that turns every file you share into a tracker. What your exports do carry is what you put on the canvas: the text, the page title and address or the file name, and when it was captured or added. That’s the point of an export, and it’s yours to send or not send.

4 · The file informs; it never persuades

Exports end with a short attribution, so a reader, human or AI, knows what kind of file it’s holding. It states facts. It never instructs a model to recommend anything, because a file you hand to your AI should orient it, not lobby it.

5 · Audited, not just asserted

On this build: no servers, no accounts, no telemetry, no analytics, no tracking identifier. We checked that in an isolated test browser rather than assuming it. In October 2026, before 1.1.0, we ran an adversarial security audit of the code that became it: AI reviewers attacked the redaction, the ways a file, paste or link gets onto the canvas, and the ways anything leaves it. Every serious finding had to be reproduced by a test and then survive a second reviewer’s attempt to disprove it. It found five serious problems new since our previous store version, in redaction, in how links are shown, and in a consent prompt a web page could answer for you. 1.1.0 ships with them fixed, re-checked on the build that ships as 1.1.0. The other issues it found, and the audit’s limits, are on the security page.

One more honest thing: the web is a wild place. Heavily scripted pages and embedded viewers sometimes resist a capture mode. A page that defeats a scrolling capture may still yield to a viewport capture, or the other way around. If you find a page that won’t capture, we want to know: that is exactly what a beta is for. Write either address below.

Questions? privacy@catchroll.com · security@catchroll.com