> ## Documentation Index
> Fetch the complete documentation index at: https://docs.screenpipe.com/llms.txt
> Use this file to discover all available pages before exploring further.

# privacy data flow: what screenpipe captures and stores

> What screenpipe captures, where it is stored locally, when data can leave your machine, and the controls that keep screen and audio data private.

{/* https://screenpi.pe */}

screenpipe is local-first. screen, audio, input, browser metadata, meeting transcripts, and connected-app context are stored on your machine unless you explicitly enable a cloud provider, sync/archive path, or external integration.

## data flow

```mermaid theme={null}
flowchart LR
  A["screen, audio, input, browser metadata"] --> B["local capture pipeline"]
  B --> C["local sqlite and media files"]
  C --> D["desktop app timeline and search"]
  C --> E["local API on localhost:3030"]
  E --> F["MCP tools and pipes"]
  F --> G["optional AI provider"]
  F --> H["optional connected app proxy"]
  C --> I["optional archive or sync"]
```

## what leaves the machine?

| feature                    | leaves your machine by default? | when data leaves                                                           |
| -------------------------- | ------------------------------- | -------------------------------------------------------------------------- |
| screen and audio capture   | no                              | never unless another feature sends selected context                        |
| local search and timeline  | no                              | local only                                                                 |
| MCP server                 | no                              | local assistant can read data; remote MCP over HTTP is your responsibility |
| chat with local Ollama     | no                              | local only                                                                 |
| chat with cloud AI         | yes                             | selected context is sent to that AI provider                               |
| pipes with cloud models    | yes                             | pipe context is sent to the selected model                                 |
| connected app proxy        | yes                             | requests go to the connected third-party API                               |
| cloud media analysis       | yes, if enabled                 | media snippets can be sent to the configured enclave/provider              |
| PII filter enclave         | yes, for enclave mode           | text is processed in the confidential enclave                              |
| cloud archive or team sync | yes, if enabled                 | encrypted data is uploaded to the configured archive or storage target     |
| feedback/log bundle        | only when you send it           | diagnostic logs you submit for support                                     |

## local storage

| data            | default location                                                     |
| --------------- | -------------------------------------------------------------------- |
| screenpipe data | `~/.screenpipe/`                                                     |
| recorded media  | `~/.screenpipe/data/`                                                |
| connections     | secure store first, legacy `~/.screenpipe/connections.json` fallback |
| app settings    | app store plus local config files                                    |
| e2e test data   | isolated `.e2e/` directory in the app repo                           |

### changing your storage location

you can move screenpipe data to a different drive or external storage:

1. **quit screenpipe completely** — ensure the app is not running
2. **copy `~/.screenpipe/` to your new location** — e.g., `/Volumes/MyDrive/.screenpipe/`
3. **set the environment variable** `SCREENPIPE_DATA_DIR=/Volumes/MyDrive/.screenpipe` before starting screenpipe
4. **restart screenpipe** — the app will now use the new location

**note:** if pipes still read or write to the default location after changing settings, ensure:

* screenpipe itself (the main app) was fully restarted after the change
* any CLI or scheduled processes use the same `SCREENPIPE_DATA_DIR` value
* if using the desktop app, the settings change is saved and the app was restarted

**for cloud backup or team sync:** use **settings → storage → archive** or **cloud archive** instead of manually moving the directory. this ensures pipes and search continue to work correctly.

## privacy controls

| control                             | where                               |
| ----------------------------------- | ----------------------------------- |
| pause or stop capture               | app controls and settings           |
| included/excluded windows           | settings -> recording               |
| microphone and system audio         | settings -> recording               |
| clipboard capture                   | settings -> recording or CLI flag   |
| API auth                            | settings -> privacy -> API security |
| LAN access                          | settings -> privacy                 |
| cloud media analysis                | settings -> privacy                 |
| AI PII removal                      | settings -> privacy                 |
| retention mode (media / lean / all) | settings -> storage or data APIs    |
| delete range and compact database   | settings -> storage or data APIs    |
| archive / download my archive       | settings -> storage                 |
| team sharing                        | settings -> team                    |

## PII removal modes

| mode                   | what happens                                                                         |
| ---------------------- | ------------------------------------------------------------------------------------ |
| text redaction at rest | detected PII is redacted in stored text columns on-device, not only at AI-query time |
| local text model       | text is redacted locally before selected AI workflows use it                         |
| local image model      | screenshots can be redacted locally when image PII is enabled                        |
| enclave mode           | text is sent to a confidential enclave designed not to persist data                  |
| cloud media toggle off | cloud audio, video, and image analysis is blocked                                    |

the safest setup is local capture, local search, local Ollama, and cloud media analysis off. the most capable setup can include cloud AI, connected apps, archive, sync, and team sharing.

## browser session inheritance

the embedded agent browser can optionally inherit login state from supported real browsers. this is opt-in and uses one-time Keychain consent per browser source.

use it when:

* an agent browser needs authenticated pages
* you want screenpipe to avoid repeated manual sign-in
* you trust the local machine and the agent task

turn it off or decline the prompt when:

* the page contains financial, health, or sensitive personal data
* you do not want agent workflows to access logged-in sessions
* you are on a shared device

## agent and pipe security

local agents and pipes can access your screenpipe data—screen text, OCR, accessibility tree, and transcripts. they cannot steal keyboard input or files, but they can see API keys, passwords, and secrets visible on screen.

secure your setup:

* **exclude sensitive windows** — add your password manager, banking site, or cloud console to **settings → recording → ignored windows**. agents won't see data from ignored apps.
* **use connection proxies** — instead of pasting API keys into prompts, create a screenpipe connection so tokens are managed securely.
* **trust only official pipes** — use pipes from the [official pipe store](https://screenpi.pe/pipe-store) or audit custom pipes before installing.
* **scope tasks narrowly** — a pipe searching only "the last meeting" is lower-risk than one searching "all screen text."
* **review logs** — use `screenpipe pipe logs <name>` to see what data a pipe accessed.

if uncomfortable with agents accessing your screen data, disable the embedded agent browser and use CLI or API only.

## teams and admins

team sharing is encrypted client-side. the server stores membership and encrypted blobs, but not the team encryption key. invite links contain the key, so share them through a trusted channel and treat them as sensitive.

admins should document:

* whether cloud AI is allowed
* which models and presets employees can use
* which integrations are approved
* retention policy
* whether LAN API access is allowed
* how support logs are collected

## irreversible actions

before deleting data:

1. confirm the time range or device ID.
2. export or archive anything needed.
3. run the delete action.
4. verify the timeline and `/search` no longer return that range.

## related pages

* [privacy filter](/privacy-filter)
* [teams](/teams)
* [cloud archive](/cloud-archive)
* [API recipes](/api-recipes)