Last updated: October 31, 2026

This Privacy Policy explains what PodXero Studio ("the Software") does with your information, and what happens to your account information if you connect an account service.

The short version: the Software is local-first. Your recordings, screenshots and project files are written to your own device. Section 2 lists every destination this version of the Software can reach, and Section 3 describes what an account service receives when you sign in to one.

1. What the Software Keeps on Your Device

What the Software records is written to your own machine, primarily in the folders the operating system gives to the app:

• ~/Library/Application Support/PodXero_Studio/
  • PodXero_Studio.db — settings, the recordings library, and the history of exported videos.
  • recordings/ — the raw video, metadata, and mouse/click samples of each recording you make.
  • Movies/ — exported videos, one folder per recording, unless you choose a different output folder in Settings.
  • account.json, session.json, avatar.png — your local profile, session token, and avatar, if you used the account feature.
  • line-items.json and thumbnails/ — the screenshots and clipboard items hanging on the clothesline or in the garden, with small preview images.
  • mcp-token — the random token that protects the local Model Context Protocol server.
  • activity-history.json, area-selection.json, mcp-config.json — your activity log, your last screen area selection, and the local MCP client configuration.
• ~/Pictures/PodXero Studio/ — screenshots taken outside a recording.
• ~/Library/Logs/PodXero Studio/ — the application log.

If you used an earlier build of the Software under a different product name, some of your screenshots may still sit in a folder named PodXero ScreenKit, Pod Clip Pilot, PodVue or PodxeroScreenKit. The Software no longer reads those folders — move any screenshots you still want into ~/Pictures/PodXero Studio/ yourself, or delete them.

Deleting these files deletes that data permanently. Uninstalling the app leaves them in place.

2. What Can Leave Your Device

Data can leave your device in four ways — each one applies only under the conditions noted below:

• The account service you connect to — account registration, sign-in, profile refresh, and deleting your account. See Section 3.
• The optional driver download — the CUA driver, if you turn that feature on, is downloaded from GitHub. You can also point the download at a mirror URL of your own: the list of available versions is always fetched from GitHub, only the driver binary itself comes through the mirror, and every download is verified against the SHA-256 digest that listing reported, so a mirror can at worst refuse to serve the file. With a mirror, both GitHub and your mirror see your IP address and browser information. It is off by default.
• Apple's in-app purchase — only in a copy of the Software you obtained from the Mac App Store: if you buy a Pro subscription, the transaction is carried out by Apple's system APIs. The Software receives the product information and the entitlement state; your payment details stay with Apple. Other copies have no purchase channel, charge you nothing, and have every feature available.
• Links you click — the "Feedback & help" mail link and links inside the legal documents are handed to your default browser or mail app instead of being opened by the Software. Both agreements are hosted as web pages by the publisher: the app only provides a link to those pages in About, it does not read the text, and the host is contacted by your browser when you open a page.

The local Model Context Protocol server listens on 127.0.0.1 and requires the token described above, so it stays on this machine.

3. If You Use an Account Service

This feature is optional: every recording, editing and export feature works without it. With no account connected, the remaining destinations are the optional driver download and the links you click.

When you register or sign in, the Software sends the following to the account service:

• The email address and password you enter. The password is used to authenticate the request; the Software keeps no copy of it on disk.
• A session token in the Authorization header on later requests.

The Software keeps the session token locally so that you stay signed in, and removes it when you sign out. A copy of your profile — your nickname, email address, and the avatar you picked — is kept in the application data folder so that the interface can show it.

The account service, not the Software, decides what else happens to your account data. Such an operator stores the things it needs to run the service: your email address, a hash of your password, the nickname and avatar on your profile, and your sessions. If you connect to an account service operated by PodXero, then PodXero is the operator of that service, and it handles your account data as described in this Section.

Those account requests carry the sign-in information listed above. Your recordings, screenshots, cursor traces and project files are written to your device instead.

You can delete your account from inside the app, which also ends the session on the service. On a service operated by PodXero, deleting the account marks it as deleted rather than erasing it outright: you can no longer sign in to it, and the service keeps a limited record of the deleted account for security, audit and legal purposes. The local files listed in Section 1 — your avatar image and your recordings — stay on your device until you delete them yourself.

4. Third Parties

• Apple processes in-app purchase transactions. Apple's own privacy policy applies to that processing.
• GitHub serves the optional CUA driver download, and always serves the list of available versions. If you fetch the binary through a mirror, that mirror serves the file instead, and both GitHub and the mirror receive your IP address and browser information.
• The Software bundles open-source components, including the FFmpeg binary under the GPL-3.0-or-later license, and contains cards derived from third-party projects (video-shotcraft, Apache-2.0; remotion-scenes, MIT). Those components run on your machine, are not modified at runtime, and send nothing anywhere. The licences they require are shipped with the application and reproduced in Section 8 of the End-User License Agreement.
• This version of the Software ships without an advertising SDK, and without third-party tracking, analytics or crash-reporting SDK.

5. Permissions and Why They Are Requested

• Screen Recording — to capture your screen, a window, or a region.
• Microphone — to record your voice along with the video.
• Camera — to show you in the webcam bubble.
• Accessibility — to observe clicks and the window under the pointer, for click tracking and automatic zoom.

Permission is requested when you use the matching feature, and you can revoke it at any time in System Settings → Privacy & Security. The Software does not require Full Disk Access, and the folders it reads are the ones it creates.

6. Retention and Deletion

• Recordings, screenshots, exports, and settings are kept until you delete them, in the app, in Finder, or by removing the files listed in Section 1.
• The activity log is a rolling local file that keeps the most recent entries.
• Your account on the account service is marked as deleted when you delete it there; the local copy is removed by signing out and removing account.json and session.json.

7. Children

The Software is a general-purpose utility and is not directed at children under 13, or the equivalent age where you live. An account service applies its own policy on children's data.

8. Security

• The MCP token file is created with owner-only permissions.
• The session file is stored in your user data folder, which macOS creates for your user account.
• External links are handed to your browser through a scheme allow-list, and the window does not open them itself.
• The renderer runs with a strict content-security policy that limits it to the app's own files, so network requests from the interface are blocked.
• Requests to the account service are made by the main process, and they use HTTPS when the address the Software is connected to is an HTTPS address. HTTPS is recommended; the address is used as it was entered.

9. Your Choices and Rights

• Use every feature without an account.
• Turn off the account feature at any time and delete the local profile and session.
• Revoke any system permission at any time.
• Delete local data at any time by removing the files listed in Section 1.
• Delete your account from inside the app.
• Ask the operator of the account service to export, correct, or delete the data it holds about you.

Where the GDPR or a similar law gives you rights over personal data held by the account service, those rights are exercised against that operator, which is the controller of that data. You also have the right to lodge a complaint with your local data protection authority.

10. Changes to This Policy

This Policy may be updated when the product or the law changes. The date at the top always shows the current version, and the updated text appears on the page the publisher hosts; the app provides a link to that page in About.

11. Contact

Questions about this Policy: [email protected]