Captorify security

How Captorify is built

Captorify provides free local extension capture and export, plus free public tools for chosen images. The paid cloud service stores synced captures and supplies the editor, hosted sharing and team workflows.

Opening the cloud editor requires a synced capture. Its OCR recognition can run locally while the input remains stored online. Use a local capture and the public tools when the input must stay off cloud storage. Before taking a capture that must remain local, turn off "Sync captures to cloud" in the extension settings, or use your browser’s native screenshot tool. Saving locally does not prevent automatic sync when it is enabled.

Local versus cloud boundary

Free extension captures are processed on your device without upload to Captorify. The extension has no telemetry, analytics or error reporting. Signing in and choosing cloud features are separate networked workflows.

If you only use the free extension, Captorify never receives data about you, your captures, or your browsing. Cloud storage applies only after you opt into Pro or Team sync.

• Free captures are processed locally in your browser.
• No data leaves your device on the free tier.
• Cloud storage applies only to paid sync and sharing.

Encryption at rest

Captures synced on a paid plan are stored in our cloud storage and encrypted at rest with AES-256. This protects stored files on disk.

This is encryption at rest where Captorify holds the keys. Staff with production access, a leaked storage key, or a lawful order could in principle decrypt cloud captures, so anyone who wants stronger guarantees can stay on the local-only free tier.

• Cloud captures are AES-256 encrypted at rest.
• Captorify holds the encryption keys.
• The local-only free tier never reaches our servers.

Access control

Cloud accounts sign in by magic link, and sessions are tracked with hashed tokens rather than stored passwords. Cloud captures are available to authorized account or workspace members according to their roles and sharing settings. Public share links provide a separate access path subject to the link’s saved password and expiry controls.

Each share link can carry an optional password and an optional expiry, and it can be revoked at any time, so access to a shared capture stays in the owner's control.

• Magic-link sign-in with hashed session tokens.
• Share links support optional passwords and expiry.
• Any share link can be revoked at any time.

Data retention

Cloud captures are kept until you delete them or close your account. If a paid subscription lapses, captures stay available to the owner for a 30-day grace window, then become inaccessible and are queued for deletion.

Deleted and expired captures are purged from active storage within 30 days. After the purge window, deleted captures are removed from active storage and not retained.

• Cloud captures are kept until you delete them or close the account.
• A 30-day grace window follows an unpaid lapse.
• Purged from active storage within 30 days of deletion or expiry.

Reporting a concern

If you find a security issue or have a question about how data is handled, contact support and we will look into it. Please include the steps to reproduce and any affected URLs so we can act quickly.

For data export, correction, or deletion requests, the privacy contact on our privacy page is the fastest route.

Free public image tools

The website’s public tools process a PNG, JPG or WebP you choose in the browser. They do not upload your image or extracted text. OCR downloads recognition software and English language data when needed.

These tools do not create an account or a cloud capture. Cloud sync and hosted sharing are separate workflows. Review the exported file before sending it to another service.