← Spotlit

Privacy

Spotlit has no telemetry and no analytics, and makes no network connection unless you start a live stream. Nothing is sent anywhere otherwise.

Diagnostic log

• Kept in memory only (last 5000 entries); nothing is written to disk unless you export it.
• Each entry has a timestamp, severity and subsystem. Sources: Spotlit itself, its interface toolkit, and its video engine.
• Redacted when written (so it cannot reach the on-screen log or an export): stream keys and RTMP key paths, password/token/key/secret values, bearer tokens, capture-permission tokens, and home-folder names (/home/you becomes ~).
• Never logged by policy: typed text, key presses, scene or source names, recording contents, audio. The redaction layer is a safety net against accidents, not a reason to log such data.
• Export (Diagnostics → Export...) writes a plain text file you choose. It adds the versions of the app, its interface toolkit and its video engine, the platform and available encoders; no host name or user name. Review it before sharing.

Plugins

Spotlit loads third-party plugins only from the plugin folder (%LOCALAPPDATA%\spotlit\plugins on Windows, ~/.config/spotlit/plugins on Linux; set SPOTLIT_PLUGIN_DIR to use another). It never downloads plugins. A plugin is native code that runs with this app's permissions and can do anything the app can, so install only plugins you trust. Plugins that fail to load are skipped and noted in Diagnostics. A saved scene can only create sources that an installed plugin registered, never arbitrary built-in sources.

Camera

A camera source is added only when you add one. Spotlit asks the system for the camera you choose (Windows and macOS may show a Camera privacy permission); video goes into the recording or stream you start, with nothing stored or sent anywhere else. The preview may show it while the preview is on. There is no camera access until a camera source exists in the live scene.

Cursor effects

Off by default. Turning them on starts a pointer-tracking session that the desktop asks you to approve (a screen-share dialog on Linux/Wayland; choose the screen you record; Windows and macOS need no dialog for the pointer position). Spotlit reads only the pointer position from that session: never keys, clicks or screen contents (frame data is not mapped). Positions are used for drawing and are not stored or logged. On Linux/Wayland a saved permission token (in ~/.config/spotlit/cursor_tracker.json) lets it resume without asking; delete the file, or revoke the permission in your desktop's settings, to withdraw consent.

Auto-zoom

Uses the same screen-share permission as the cursor highlight (one permission). The pointer position is used for the zoom and is not stored or logged. Zoom is part of the recorded video.

"Also zoom where I type" (on by default once auto-zoom is on; separate switch) cannot see your keys: no platform lets ordinary apps do that without extra permissions, and Spotlit does not use them. It notices which small area of the screen is changing. Spotlit's own video engine, which already renders the screen it records, makes a small copy of that picture about 10 times a second and reduces it at once to a 64 x 36 grid of average brightness. Only that grid is held, in memory, only for the latest frame; nothing is saved, logged or sent anywhere, and it contains no readable text. With the switch off (or auto-zoom off) it does not run. On Linux/Wayland the pointer-tracking connection still carries cursor metadata only: its frame data is never read.

Scene-change effects

On by default (separate switch under Effects). To notice that you switched windows or a new page opened, Spotlit's video engine uses the same 64 x 36 brightness grid described above: it only compares successive grids and asks whether most of the screen changed at once after a calm moment. Scrolling and video change the screen all the time, so they do not count. No pixels, text or screenshots are kept, and the log records only the *kind* of effect that played ("scene change: flash"), never what was on screen. It does not read window titles or application names. With the switch off (and typing-zoom off) the grid is not computed at all.

Live captions

Off by default. When on, the microphone is analysed by a speech model on this computer (whisper.cpp, English); no audio or text leaves it. What you say is shown on screen (and in the video, if you choose to include captions in the recording) and is never saved or written to the log: the diagnostic log records only that captions started or stopped. Muting or hiding the microphone source pauses captions immediately. The model file (about 140 MB) is downloaded once, only when you press "Download speech model" in Effects > Live captions (or with scripts/fetch_whisper_model.sh). The app fetches it over https from huggingface.co, checks its SHA-1, and discards it if the check fails. After that, captions work fully offline.

Keystroke display

Off by default, and typed letters, numbers and punctuation stay hidden even when it is on (a separate switch, with a warning). It shows shortcuts such as Ctrl + Shift + P, function keys, arrows and Enter/Tab/Esc as keycaps.

• It only works where the operating system lets apps observe keys, through that system's own mechanism: XInput2 on X11, a keyboard hook on Windows, a listen-only event tap on macOS (which asks for Input Monitoring permission). On Wayland the desktop does not allow it, so Spotlit offers only a demo that plays scripted keys; it does not try to get around that.
• Only the keys currently on screen are held: at most 6 entries, each gone after a few seconds. No typed text is buffered, saved, logged or sent anywhere, and key names never appear in the diagnostic log (it records only that the display was turned on, off, paused or resumed).
• Always visible: a "KEYS ON / KEYS PAUSED" indicator sits in the top bar. Ctrl + Alt + K (or the indicator) pauses it at once and clears the screen.
• Hidden automatically while a password / secure field has focus where the system tells us (macOS secure input), and while a blocked application is in front where the system reports it (X11, Windows). Where it cannot tell (a native Wayland window, and password fields on Windows, where this is not implemented), keep typed letters off.
• Windows: the keyboard hook does not receive keys while an elevated (administrator) window has focus; that is a Windows security rule, which Spotlit does not try to get around.

Hiding private windows

• The privacy shield (Settings > Privacy) covers the preview, recording and stream with a plain "Hidden for privacy" card while an application or window title you listed is in front, optionally muting audio too. The Hide screen button (Ctrl+Shift+H, also in the tray menu) does the same on demand and works on every desktop.
• It reads only the front window's title and application name (X11 and Windows). Wayland and macOS do not tell ordinary programs which window is in front, so there only the manual button is available; Spotlit says so instead of pretending.
• Window capture records just the window you choose: while a window source is visible in "choose a window" or "follow the window in front" mode the screen itself is not drawn, so nothing else on it can leak into the video (the area around the window is black).
• Full-screen games are recorded with a game-capture hook, a small DLL loaded into the game process (the usual way screen recorders capture games). Some anti-cheat systems object to that; the hook is only loaded when a full-screen app is in front and the "full-screen apps" mode is on.
• The cover is drawn into Spotlit's own output: your real screen is unchanged.

Live streaming

• Nothing is transmitted until you press Go live, and then only to the RTMP/RTMPS server address you typed.
• The stream key is never saved: it lives in memory for the session, is cleared from the dialog after use, and is not written to settings, logs or diagnostic exports (the log redacts the key part of any rtmp:// URL as a second line of defence). You paste it again next time. Storing it in the OS keyring is a possible later addition.
• Spotlit uses its own minimal streaming setup instead of a third-party service list, because such lists are downloaded from the internet when they start.
• Only the server address (not the key) is remembered between runs, so the dialog is pre-filled.