Privacy model

What is recorded, what is not, and the layers that keep sensitive data out of the store.

Zanei records what you do on your computer. Because that data is sensitive, the defaults are conservative and each layer below applies without configuration.

Defaults

1. No egress. There is no feature that sends data anywhere. Everything stays in a local SQLite file.
2. No screen recording. No screenshots or screen-capture APIs. Zanei reads OS accessibility and event metadata.
3. No keystroke content by default. Typing is recorded as “typing happened in this kind of field,” not what was typed, unless you opt in.
4. Capture-time filtering. Excluded apps and sites are discarded before they reach the store.
5. Read-only exposure. The MCP server is a read-only view. Agents can read the timeline but cannot change what is recorded or edit filters.

What is recorded with the default configuration

Capturing content is opt-in

Setting capture.text_content = true in the configuration enables recording of typed characters (input.key), text inserted into fields (ui.value.data.text), and clipboard contents. For free-text fields, Zanei captures only the inserted difference authorized by a keystroke or paste from the same app and focused element within 3 seconds; it does not capture the displayed document or the field’s full value. element.value stays null for free-text and unknown elements; only an allow-list of known-safe non-text controls (buttons, checkboxes, sliders) provides it. This is off by default. start and status show the opt-in command; the setting is never enabled automatically. If you opt in:

• Password fields remain excluded; secure fields are dropped at capture time.
• Value changes without a matching keystroke or paste are not recorded.
• Unknown UI elements do not provide element.value.
• input.key.text is null while an input method (IME) is active and when the input-source type is unknown; committed text can be captured only as an authorized ui.value.data.text difference.
• Voice input has no keystroke trigger, so its text is not recorded.
• Redactors scrub recognizable secrets from captured values.

Automatic exclusions

• Password fields — anything macOS marks as a secure text field is dropped at the source.
• Chrome Incognito — Chromium reports the window mode deterministically over AppleScript, so Incognito windows are excluded from URL capture. There is no configuration knob.
• Built-in app exclusions — password managers and credential stores (for example 1Password, Keychain Access) are excluded by a hard-coded layer that cannot be lifted, not even with include_only_apps. It is separate from the editable exclude_apps defaults in config.toml.

Redaction

For values that are captured, redactors scrub recognizable sensitive content: emails, credit-card numbers, tokens (redactors = ["email", "credit_card", "token"]). Every event carries a redaction field recording whether rules were applied.

Limitations

• Window titles from non-Chrome browsers. Safari and Firefox offer no reliable way to detect private windows, so Zanei does not capture URLs from them, but their window titles are still recorded like any other app’s, and a private window’s page title can appear there. To avoid this, exclude the browser: zanei filter exclude-app.
• Window titles from Chrome Incognito windows. Incognito detection lives in the URL-capture path, so Incognito windows produce no browser.navigate events, but their window titles can still be recorded as window.title events through Accessibility. To avoid this, exclude the browser: zanei filter exclude-app.
• After an agent reads your data. The MCP server and CLI do not send anything anywhere, but an agent that reads your timeline will typically send it to its LLM provider. That handoff is governed by the agent. The shipped skill instructs agents to narrow the time range before sending.

Intended use

Zanei records your own activity on your own machine. It is not built for monitoring others, and using it that way may be illegal in your jurisdiction. On an employer-managed device, follow your organization’s policies.