catchroll

Security Position

Last updated: 6 August 2026 · Describes build 1.0.49

This page describes catchroll’s security position as it stands today. It is deliberately scoped to what the shipping code actually does — not to promises.

The words on this page

  • Capture — one thing you grabbed: the image, the text from inside your frame, and a link back to where it came from.
  • Capture roll — the short-term shelf for your latest captures, kept in local browser extension storage on your device. It keeps your ten most recent — an eleventh capture pushes the oldest out. You see and manage it in the popup.
  • Popup — the small panel behind the toolbar button: pick a capture mode, see your roll, send captures to a canvas.
  • Canvas — the workspace where captures become a board: arrange them, mark them up, redact, save the board as a .catchroll file, export it for an AI.

On-device by construction

catchroll has no backend. On this build: no servers, no accounts, no telemetry, no analytics, no tracking identifier. Your captures live in local browser storage and in files on your own disk, and they stay on your machine unless you move them yourself. The safest place for your data is your own machine — so that is where catchroll keeps it.

Redaction is destructive on purpose

When you redact part of a capture (blackout, blur, or pixelate), catchroll permanently destroys those pixels in the saved image. Redaction is not an overlay you can peel back and it is not undoable — in every file you save or export, the sensitive content is actually gone. One thing worth knowing: the original, un-redacted capture stays in your capture roll on your own device — deliberately, so an accidental redaction is recoverable — until you delete it or newer captures push it out of the ten-capture roll. If you want the original gone sooner, delete it from the roll.

Redaction protects the text and the trail, not just the pixels

A capture can carry the page’s text alongside the image, and a link back to where it came from. Hiding pixels while leaving those behind would be a false sense of safety. So when you redact a capture, in every file you save or export:

  • the saved text for that capture is destroyed, and
  • the link back to the original source (its URL and title) is withheld.

The reasoning: an image redaction is only real if someone can’t recover what you hid by reading the leftover text — or by simply following a link to the un-redacted original. In the files you save and export, catchroll closes both doors.

Folder access is scoped, not broad

catchroll can connect to a folder you choose to hold your saved library. That access is granted through your browser’s own file picker and is limited to the single folder you select — not your drive, not your other files. It is mediated by the browser, and you can revoke it at any time. catchroll uses it to read and write your library locally; nothing in that folder leaves your device. It is a scoped, revocable key to one folder — not general access to your computer.

Scope and honesty

This is a position statement, not a certification. A code-level security audit of catchroll has been run — and re-run. That included an independent cold review: a reviewer given the code but none of our prior records, re-checking everything fresh. The cold review found things our own reads had missed, and what was found was fixed in the builds that followed. This page describes the result as of the build named above, and it will keep being updated as the checks re-run — including if they find something that makes it less flattering.

Reporting a concern

If you find a security issue, please report it to security@catchroll.com.