MycoCap is a Windows screenshot and annotation tool. This page describes exactly what the application stores on your computer and when anything leaves it.
In short: screenshots stay on your computer, there is no telemetry or analytics of any kind, redaction is opt-in and best effort rather than a guarantee, and the only outbound traffic is the signed update check plus the destinations you set up yourself.
| Data | Where | When |
|---|---|---|
| Settings | %AppData%\MyCoCap\MyCoCap.ini |
Always |
| Log file (rotating, 4 × 1 MiB) | %LocalAppData%\MyCoCap\MyCoCap.log* |
Always |
| Capture history (images and index) | %LocalAppData%\MyCoCap\History\ |
Only if you turn it on |
| Temporary working files | %TEMP% |
During a capture; removed afterwards |
| Webhook authorisation header | %AppData%\MyCoCap\MyCoCap.ini, encrypted for your Windows user. If encryption is unavailable it is kept in memory for that session only and never written to disk |
Only if you configure a webhook |
Capture history is off by default in new installations. When it is on, MycoCap keeps up to 100 recent captures (plus any you pin), and the History folder is restricted to your Windows user account.
A screenshot contains every pixel of the window, screen or region you chose, including anything that happened to be visible at that moment. Nothing is transmitted: a capture stays on this computer until you copy it, save it, share it to a destination you set up, or delete it.
The log records application events such as failures and file operations. It may include file paths. It is never transmitted automatically.
A screenshot is read through the Windows capture APIs - Windows.Graphics.Capture where Windows offers it, and the older GDI screen copy where it does not. A window that is protected against screen capture is delivered to those APIs as black; MycoCap captures what Windows gives it and never attempts to bypass content protection.
MyCoCap reads the keyboard only through two narrow, short-lived observers. While the scrolling-capture panel is on screen, a hook reads nothing but the Enter and Esc key presses and releases for that panel's Finish and Cancel. While a capture countdown is on screen, a second hook reads nothing but Esc, so the countdown can be cancelled. Neither stores anything, neither blocks the key from the application in front of you, and each is removed when the window it serves closes. The shortcuts you set are matched by a third hook: it sees key presses only to recognise your own shortcut combinations, blocks a key only when it is one of them, and does not record what you type. MyCoCap sends no synthetic input to any application.
Cover sensitive text in the editor looks for likely sensitive text in the capture you have open. It runs on your computer with the Windows text recogniser and the patterns that ship with MycoCap, and covers every match it finds with an opaque fill in one step that a single Undo removes.
A redaction is a fully opaque solid fill: the covered pixels cannot show through, and MycoCap refuses to make a redaction see-through.
Redaction is best effort, not a guarantee. The scan only reads what text recognition can read, so small, blurred or unusual text can be missed. Check the result before you share it, and use Undo if a cover is in the wrong place.
Nothing is sent unless one of the following happens.
https://mycocap.net/update-feed.json together with its
signature https://mycocap.net/update-feed.sig, then tells you
the result. The request carries no identifier, no cookie and no
user-agent string, so the server sees your IP address and nothing else
that identifies you - unless you have turned on the proxy setting, in
which case that proxy sees the request too. The feed is verified against a
public key built into the application before it is read at all, and
MyCoCap never downloads or runs an installer by itself: it only reports
which version is available and offers to open the download page. If you
would rather it checked on its own, set an interval in days under
Settings; setting the interval to 0 days turns automatic checks off
again.
http(s) image addresses,
MycoCap asks once for the whole paste, naming every distinct host and how
many images will be downloaded. If you decline, nothing is requested and the
rest of the paste is unaffected. Addresses that point at your own machine,
your private network or a cloud metadata service are refused, and the
download connects to the address that was checked.
Destinations are entirely optional. MycoCap has no default upload destination and never uploads a capture as a side effect of another action.
Export diagnostics produces a zip file that you create and choose where to save. It is never sent anywhere by MycoCap. It contains your settings, recent log lines and basic system information, with secrets redacted. You can inspect the zip before sharing it.
Open Settings and choose Privacy & data. That page names the folders used on your computer, shows how many captures are stored and how much disk space they use, and offers Delete all captures, which removes the stored images and the history index after asking you to confirm.
Turning capture history off stops new files from being stored; it does not delete the ones already there. Use Delete all captures for that.
MycoCap is a general-purpose utility and does not knowingly collect information from anyone, including children.
Every released version of this page travels with the source archive for that release, so the wording shipped with a build can always be checked against the code that shipped with it.
Questions or corrections: get in touch through https://mycocap.net.