SentryScreen privacy statement

Last updated 1 September 2026.

Draft for owner review. It is not approved for publication until the release candidate has passed the repository's egress audit, payload inspection and runtime network observation.

Summary

SentryScreen examines the Mac screen on the Mac. Screen content is not sent anywhere. SentryScreen does make two kinds of network request — checking your subscription and downloading updates — and the Network behavior section below describes exactly what those carry. There is no analytics client, no advertising client and no automatic support upload.

Screen processing

SentryScreen uses the macOS Screen Recording permission to receive screen frames. The detector processes those frames in memory. The runtime does not write screen images or video to disk, and does not transmit them.

The application can write local detection metadata. This metadata can include:

the detection label and confidence;
normalized detection and cover rectangles;
numeric window identifiers and window geometry;
the owner application name for a cover event;
timestamps, processing latency, health state, CPU use and memory use.

The activity view uses the application name and event time. It does not use a window title, a website address or a screen image. Diagnostic metadata can still show when a specific application was in use. Treat these local files as private data.

Parent settings and PIN

SentryScreen stores machine-wide protection settings, such as pause state and sensitivity, in a local settings file. The parent PIN is not stored as plain text: a salted password verifier and the failed-attempt counter are stored in an administrator-only directory. Any Mac administrator can use the approved local recovery flow, because an administrator can also remove the application.

Your license key is stored in that same administrator-only directory. A Standard (child) account cannot read it, copy it or delete it.

Local diagnostic files

Each user session writes local files below:

/Library/Logs/SentryScreen/<user-id>/

The main log has a 50 MiB limit and keeps four generations, so at most 200 MiB for that log in each user session. SentryScreen does not upload these files. A parent or support person must select and send a file deliberately. Review a log before sharing it, because it can contain application names and detection metadata. The uninstaller removes the SentryScreen log directory.

Network behavior

SentryScreen makes network requests for exactly two purposes:

Checking your subscription. So that we can tell you if your subscription needs renewing.
Downloading updates. So that your protection improves without you having to do anything.

Both happen from a background system service that runs as an administrator process. The part of SentryScreen that looks at the screen never makes a network request of any kind. Your child's account never makes a network request.

Exactly what is sent

About every six hours, SentryScreen sends one small message containing:

your license key;
a random identifier we generated for this installation the first time it ran (it is a random number, not your Mac's serial number and not anything your Mac already had);
the SentryScreen version and build number;
your macOS version, to the minor version only (for example “15.4”);
the processor family (for example “arm64”);
which update channel this installation follows.

That is the complete list. No screen content, no detection results, no images, no application names, no window titles, no log files, and no diagnostic data are ever sent — not on this request and not on any other. There is no analytics service, no crash reporter and no support upload.

As with any internet request, our server sees the internet address the request came from. We use it only to limit abuse of the licensing service, we do not store it, and we never connect it to your license.

What comes back

A signed statement of your subscription status, and — when one is available — the details of a new version: its version number, its download address, and its SHA-256 checksum.

Sending nothing

Every request from SentryScreen omits the User-Agent header entirely. Most software sends one; it describes your software and system and helps identify you across sites. We do not send one, at all.

Updates

Updates install in the background without asking you. Before installing anything, SentryScreen checks that the package's checksum matches what the server said, that Apple's notarization ticket is valid, and that the package is signed by our Apple Developer ID and no one else's. If any check fails, nothing is installed. After installing, SentryScreen confirms protection came back; if it did not, it puts the previous version back automatically.

If your subscription lapses, or if SentryScreen cannot reach our server at all, it keeps protecting this Mac. Nothing about your subscription can turn protection off.

Companies we use

Stripe handles your payment. We never see or store your card details. Resend delivers our emails to you — your license email, and the renewal reminders if a payment fails. It sees your email address and your license key, nothing else. Cloudflare hosts this website and the SentryScreen download.

The subscription check goes only to our own server, and only carries the six items listed above. When an update is available, the app downloads the package from Cloudflare's network, so Cloudflare sees that download request and the internet address it came from — the same as when you download the installer from this website — and nothing else. Stripe and Resend receive nothing from the app.

If a payment fails

We email you once a day for seven days, and SentryScreen shows a reminder on your Mac once a day for the same seven days. After that the emails and the daily reminders stop, and the app shows a renewal notice until you renew. Protection keeps running the whole time, and updates keep arriving.

Server data

This is everything our server holds, and for how long.

Your email address and the Stripe identifiers for your payments: Kept while you have a subscription, then for seven years. It is the accounting record of a payment, which we are required to keep.
Your license — stored as a one-way hash of the key, never the key itself — with its state and plan: Kept while you have a subscription. Because we store only a hash, a stolen copy of our database contains no usable keys. It is also why support cannot read your key back to you, only send the email again.
The random installation identifier, when it last checked in, and the version and macOS version it reported: Deleted 90 days after the last check-in. It is used for counting how many Macs a subscription is on, and for deciding whether an update applies to that macOS version.
Identifiers of the payment events Stripe sends us: Kept 30 days, so the same event is never processed twice if Stripe sends it twice.
The internet address a request came from: Not stored. It is held in memory only, for the abuse counter, and discarded when that counter's window ends. Nothing in the product needs it.
Anything about detections, screens, logs, application names or window titles: Never received, because it is never sent.

We use no analytics product, and no error-tracking service that would receive the contents of a request. Our application logs stay on the server we run and are not exported anywhere.

Removal

Full removal deletes the application payload and the local diagnostic logs. You choose whether to keep or delete the local protection settings and PIN state. The macOS Screen Recording permission record can remain after removal; the recovery document explains how an administrator clears it.

Questions

Email support@sentry-screen.com.