What stays on your device, what crosses the network, what we collect, and how the trust rails work for AI proxy traffic and GUI automation. This page is the plain-English explainer; the legally binding text lives in the Privacy Policy and Terms.
SuperBased is a desktop-first product. The default for almost everything is "stays on your device until you explicitly do something that crosses the network."
~/.superbased/captures/ (or your custom screenshot folder). They never leave your machine unless you explicitly invoke an AI tool, drag/drop, copy, or share.~/.superbased/superbased.db. Pure-Go WAL mode, never replicated.Three categories of network traffic, all on opt-in or explicit-action paths:
| What | When | Where |
|---|---|---|
| License + version check | App start (after 15s) + every 4h | api.superbased.app |
| AI request (chat / vision) | You explicitly invoke superbased_ai or click the AI button | api.superbased.app → upstream provider |
| Voice transcription | You release the dictation hotkey | api.superbased.app → Whisper / Azure Speech |
| Auto-update check | Every 4h (electron-updater) | S3 latest mirror |
| Anonymized usage events | Batched, on app close | api.superbased.app/api/v1/usage |
That's it. No background screenshot upload. No telemetry on individual captures. No "phone home" pulses while you work. The desktop's per-feature defaults all bias toward local processing — even the dictation pipeline does filler removal, deduplication, and short-phrase normalization locally before any AI cleanup roundtrip.
When you enable auto-redaction (Settings → Privacy), the redaction pipeline runs locally, before any image is copied, sent, or shared. It detects and pixelates regions matching the following categories:
Detection runs over the OCR text layer (which itself is computed locally via Tesseract). Matches get pixelated as image overlays; the original screenshot file on disk is unchanged unless you explicitly save the redacted version. Compressed images via the Token Compression Engine go through the same redaction pipeline — same patterns, same locality.
Honest scoping. Pattern-based detection catches the common cases. It is not a substitute for human review of sensitive screenshots. For maximum security, always inspect a screenshot before sharing it.
The desktop and headless binaries send four kinds of network traffic to api.superbased.app:
/api/v1/version returning {latest, minimum}. Used to gate forced upgrades when a critical issue is fixed.The website (superbased.app) uses no analytics by default. Plausible is being evaluated for consent-gated, cookie-less analytics; until it ships, the website does not track visitors.
Authentication is handled server-side via the Clerk Backend API. The Go backend authenticates email/password and OAuth (Google, GitHub) flows on the server side and issues custom HMAC-SHA256 JWTs containing your Clerk user ID, email, and name. The desktop receives the JWT via a deep link (superbased://auth-callback?token=...) and stores it encrypted via OS-level secure storage (DPAPI on Windows, Keychain on macOS).
The GUI automation surface (the "Agent Hands" capability — see /agents) is the most privileged thing SuperBased exposes. The defaults err toward refusal at every layer:
guiAutomation.enabled defaults to false. The user explicitly opts in. All write tools refuse with a structured error until the toggle flips.actions.safe (read-like operations), actions.write (click / type / hotkey / scroll / drag / hover), actions.destructive (drag_file, launch_app, window_state action='close'). Each independently toggleable.confirm: true unless the user has explicitly disabled the prompt via guiAutomation.requireConfirmFlag = false.SELF_TARGET_REFUSED — agents cannot drive the SuperBased UI itself.superbased_launch_app requires an entry in guiAutomation.launchAllowlist — empty by default (deny-all). Allowlist entries can be substring matches or sha256:<hex> binary-hash pins for sensitive binaries.Ctrl+Shift+Esc (configurable) immediately aborts in-flight automation. Agents cannot suppress it. Registered as a global hotkey via uiohook-napi while guiAutomation.enabled is true.Default-deny, opt-in model. Out of the box, an agent calling superbased_click gets {ok:false, error:"GUI_AUTOMATION_DISABLED"} with a hint to enable the master toggle. The user retains complete control over whether and when their agent can drive the screen.
Every GUI automation action — accepted or refused — is appended to ~/.superbased/audit.log as one NDJSON line. Each entry contains:
superbased_sequence call writes N entries with the same sessionId).superbased_click, superbased_type, etc.).{ok, errorCode?, durationMs}.You own this log. Inspect it any time with cat ~/.superbased/audit.log | jq. Delete it any time. superbased_replay reads it back to reproduce a specific session — useful for debugging an agent that went off the rails, or for stepping through a flow that worked in production for inspection.
Enterprise tier customers get additional surfaces with explicit data ownership:
superbased-captures-production S3 (AES256, versioned). Access via presigned URLs with 15-minute expiry. FTS5-style PostgreSQL search across team workspaces.audit_logs table with actor, action, resource, IP, user agent, timestamp.retention_days per org; a daily background worker deletes ai_daily_usage, usage_events, and audit_logs older than the threshold for org members.Every desktop release is signed and notarized. Verify your install matches a known-good build before running:
shasum -a 256 SuperBased-Setup-x.y.z.exe (Windows: certUtil -hashfile) and compare.If you find a security issue — in the desktop app, the headless CLI, the backend API, the MCP server, the GUI automation surface, or any of the plugin distributions — email contact@marmut.app with the subject line "Security disclosure."
We commit to:
Out of scope: any test that affects production users (DoS, brute-forcing prod credentials, data exfiltration of other customers' content, social engineering of staff).
Bug bounty. We don't currently run a paid bounty program. If you've reported a meaningful issue, we'll credit you publicly (with permission) on the changelog and send a thank-you note.