What a screen recorder should never store

01 Recording everything is the wrong goal

The pitch for screen memory is "never lose anything." Taken literally, that is a terrible design target. Your screen shows your passwords as you type them, your card number at checkout, your bank balance, the private tab you opened for a reason. A recorder that captures all of it faithfully has not built a memory; it has built the most sensitive file on your computer.

So the more useful question is what a screen recorder should refuse to keep. Here is our list, and what Pixel Dust does about each.

02 What we don't keep

Anything typed into a password field. macOS signals when a secure text field has focus. Pixel Dust listens for that signal and does not capture while it is set. The frame where you typed your password does not exist.

Private and incognito windows. A browser window you opened privately was opened privately for a reason. We exclude them at the capture layer — the window is removed from the screen contents before the frame is taken, not blurred afterward.

Apps you name. Your password manager, your banking app, a client's confidential tool. Add it to the exclusion list and it is cut from every capture, whether or not it is the frontmost window.

Card numbers and secret-shaped strings. Sixteen digits that pass a checksum are a card number, and Pixel Dust scrambles them before they reach the search index. Long random strings that look like API keys get the same treatment. The checksum matters: an order number or a tracking code is left alone, because a redactor that eats everything is a redactor people turn off.

Keywords you choose. A project codename, a person's name, a diagnosis. Name it and every occurrence is scrambled in the index before it is written.

The indicator. Not something we store, but something we never suppress. If Pixel Dust is recording, your Mac shows it.

03 Why this happens at capture, not in the viewer

Redaction that happens when you view your history is theater. The data was written; blurring it on playback just means the unblurred copy is one file away. Every exclusion above happens before the frame is stored, or before the text is indexed. What is excluded was never kept. You cannot leak what does not exist.

The same logic drove the decision to encrypt the captures themselves rather than only the index. Protection that covers part of the data is a description of where to look.