Privacy Policy
briffy has no server. Your screenshots, recordings, clipboard and files stay on your own computer. Something leaves this machine only when you have configured an AI service or an external connection yourself — and then it goes directly to your own account with that provider, never to us.
Effective 8 September 2026 · Version 1.0 · Covers the briffy desktop app (macOS / Windows) and the briffy browser extension
What the desktop app records
Every item below is written only to the workspace folder on your own computer (by default ~/Library/Application Support/briffy/workspace, changeable in Settings).
- Screenshots
- When you click briffy, press the shortcut, or drag a region
- Text in a screenshot
- Read on this machine by PP-OCRv6 + onnxruntime
- Recordings
- Voice notes you start yourself — or, with “automatic recording” on, whenever somebody speaks (see the next section)
- Transcripts and speakers
- Produced on this machine by Whisper and sherpa-onnx
- Clipboard items
- Text, images and files you copy. Can be turned off in Settings
- What you drop on it
- Files, links, notes you write yourself
- Which window was open
- The app name and window title, so a record can say where it came from
- What a wordless picture holds
- A local image classifier, or macOS’s own recogniser
- Settings and your API keys
- Keys are encrypted with the system keychain (macOS Keychain / Windows DPAPI)
briffy has no account, needs no sign-up, and does not know who you are. Everything above lives on disk only; delete the workspace folder and it is all gone.
Automatic listening, stated plainly
This is the one thing briffy does without being asked, so here it is in full.
It is off by default. Leave it off and the microphone opens only while you are recording a voice note.
With it on (Settings › Recording), briffy holds the microphone and files a recording whenever somebody speaks — no keypress needed. Meetings and calls end up in the workspace whether or not anyone meant them to, other people’s voices included. macOS shows the orange microphone indicator the whole time it runs.
Recordings and their transcripts still never leave your machine. The transcribed text, though, is treated like any other record: with a cloud AI service configured, it is sent off to have a title and summary written.
Whether recording other people is lawful depends on where you are. Some jurisdictions require everyone’s consent. briffy cannot make that judgement for you and does not carry it for you; please check before turning this on.
What leaves this machine
Only features you turn on yourself use the network. Installed and left unconfigured, briffy sends nothing at all beyond fetching the local models it needs.
The AI service (titles, summaries, answers)
You pick one of four in Settings › AI service. From then on, the content of the record being processed is sent there: the screenshot image itself, its OCR text, PDF or web-page text, plus the questions you type in Ask and excerpts of the records it retrieved.
- Claude (Anthropic)
api.anthropic.com, under your own API key or your own signed-in Claude account- OpenRouter
openrouter.ai, which forwards to the model provider you chose- Custom endpoint
- Whatever base URL you enter (LM Studio, vLLM, DeepSeek…)
- Local model (Ollama)
127.0.0.1:11434— never leaves the machine
This is forwarding, not collection on our part. briffy neither stores nor proxies these requests and cannot see them — they go straight from your computer to the provider under your own credentials. Want nothing to leave? Choose Ollama, or configure nothing: titles fall back to filenames, summaries to a list, and Ask still searches locally.
Services you connect yourself
- Notion
- The pages you tick on the authorisation screen, read into your workspace
- Gmail
gmail.readonly— read-only. No sending, no relabelling, no deleting
OAuth runs under your own credentials; tokens are encrypted in the system keychain on your machine, and you can disconnect in Settings.
Downloads (no user data in them)
huggingface.co- Speech-recognition models (or
hf-mirror.com, if you set that) github.com- Speaker-diarisation models
ollama.com- Listing the available local models
api.zeroeval.com- One read a day of a public model leaderboard, to recommend a model
- A link you saved
- You saved a link, so it has to be fetched
These requests carry none of your data — just a user-agent: briffy.
The browser extension
The extension talks only to briffy on the same computer (127.0.0.1:47831). It has no server of its own and sends nothing to any third party.
- Media you tick
- The images, video and audio you select in the panel, handed to briffy locally
- Pages you save
- When you press a site’s own save button, that page and its text are kept in briffy
- Media request URLs
- URLs are observed only, to find streams the page never puts in its markup. Nothing is blocked or rewritten, and no response body is ever read
- The active page’s URL and title
- Off by default. Sent only when briffy explicitly asks, so a saved item knows where it came from
- The active page’s text
- Off by default. Sent only after you turn on briffy’s “no-hands” layer
The last two start switched off: both flags are false when the extension starts, and turn on only if briffy’s reply explicitly asks for them — which means briffy has to be running with a setting you turned on yourself.
The extension does not watch you browse: the save-detection layer sits still and reads the page only after a save gesture has actually happened. It needs no account and stores nothing in any cloud.
The port is configurable in Settings, and the whole local endpoint can be switched off.
What briffy does not do
No telemetry, no analytics, no crash reporting. There is no analytics SDK anywhere in the code; the source is public, so you can grep for it yourself.
There is no briffy server. Every destination above is either a third party or your own machine. None of them is ours.
No advertising, no profiling, no tracking, no selling, no sharing with anyone. And nothing is uploaded for “sync” — briffy does not sync to a cloud.
Permissions
Every one can be revoked at any time in System Settings › Privacy & Security. Refuse one and that feature stays off; the rest works.
- Screen Recording
- Screenshots. There is no background or periodic capture — only the moment you press the shortcut or click briffy
- Microphone
- Voice notes, plus automatic recording if you switch it on
- Automation (Apple events)
- Knowing which window you were looking at, and using macOS’s own recogniser to describe pictures
- Accessibility
- Needed only for scrolling long screenshots
- Desktop / Documents / Downloads
- Copying files you drop on it or choose during a bulk import
Your data is yours
- Read it
- The workspace is an ordinary folder — JSON, PNG, WAV and Markdown. Open it with anything
- Export it
- Copy that folder
- Erase it
- Delete the folder, or a single record inside the app. There is no trash and no second copy
- Move it
- Point Settings at another location
- Uninstall
- Delete briffy.app, then
~/Library/Application Support/briffy/. Keychain entries named briffy can be removed in Keychain Access
The rest
Children
briffy is not directed at children under 13 and does not knowingly collect their information.
Changes
Changes update the version and date at the top of this page and are noted in the release notes. A material change — a new destination that receives data, say — is explained inside the app.