Share the file, screenshot or text — not the liability.

Yes. Detection and redaction happen on-device, with no network calls — it works fully offline, even with no internet connection at all. Nothing is sent to Apple, and nothing is sent to us.

Redacted copies, kept encrypted. Your history is sealed on disk with AES-GCM under a key held in your Mac’s Keychain, device-only — originals are never written. While you record, the raw clip sits in a temporary file so it can be redacted, and it’s deleted once you export or close the card. The audit log is sealed too, under its own key. It keeps counts and fingerprints rather than the text that was removed, and alongside those it records the name of the file each entry wrote, which app the content came from and your Mac account name — so an entry can be tied to the work and to the person who did it.

Removes. The copy you export has the underlying content removed and flattened — not a black box drawn on top that can be lifted or copied out. Your original stays untouched. Only the copy you share is redacted. Solid (the default) and gradient discard the covered pixels. Blur and pixelate are opt-in because they can be partially reversed. Flattening a PDF doesn’t cost you the text. The words no box covered are written back invisibly where they were, as real text — you can still search for them, copy them, and a screen reader still picks them up. Each line is marked as a paragraph, so a screen reader reads it as text. The file sets no document language, it claims no accessibility standard, and we have not tested an export with VoiceOver. Anything removed is absent from that text, not hidden in it. Two exceptions. A PDF that was a scan has no text layer to keep, so it comes back as pixels only. And Settings ▸ General ▸ PDF export has a “Keep redacted PDFs searchable” switch, on by default — turn it off and every PDF the app exports comes back as pixels only.

On images, yes. Drag a box over anything else in a screenshot or a PDF page — a corner of a chart, a logo, something the model didn’t flag — and it’s removed with the rest. In plain text you’re working from what the engine found: you review every match and can keep or drop each one before export, but you can’t yet paint over a phrase it missed. What you see is what you get.

Yes. ClipScrub is built HIPAA-first, but it targets the direct identifiers these frameworks define — names, contact details, IDs, faces and more — in text, images and exports. The same on-device redaction applies to any personal data you need to remove. You stay responsible for compliance.

Yes. A deterministic engine — on-device OCR, pattern matching, face and barcode detection — redacts without it. We do recommend turning Apple Intelligence on where you can: Apple’s on-device model catches the context-dependent identifiers that rules miss. Either way it stays on your Mac. The app needs macOS 15 (Sequoia) or later. The on-device model needs macOS 26 (Tahoe) on Apple silicon.

No. A BAA is required when a vendor creates, receives or stores PHI on your behalf. ClipScrub runs entirely on your Mac and never receives your data — there’s nothing for us to sign a BAA over, because we never touch what you redact.

No — no software is. “HIPAA compliant” describes an organisation and its workflow, not an app. ClipScrub helps you find and remove identifiers on your own Mac. Whether your process meets HIPAA is your organisation’s determination to make.

No. Automated detection isn’t exhaustive — it can miss things or over-flag. ClipScrub is built so you review what it caught before you export, and you’re responsible for verifying the result before sharing. It’s an aid, not a guarantee.

macOS asks once whether you’re sure. That’s the standard confirmation for an app downloaded from the internet — click Open and you’re in. The app and the disk image are notarized by Apple and stapled, so your Mac can verify them with no internet connection. ClipScrub sits outside the App Store on purpose: the sandbox rules there forbid shipping the separate clipscrub command-line tool.

Both. Record your screen inside ClipScrub, or open a clip you already have — MP4 and MOV. Drag it onto the window, open it from Finder, or pick it in Capture ▸ Redact Video…. It reads four frames a second by default — you can raise that — and shows only the frames it read, so a box can never sit over a frame nobody checked. Boxes you draw by hand follow their content as the window moves or the page scrolls. What you export is the redacted copy. Your original is untouched.

Yes. That is what ClipScrub is for. ClipScrub is a separate Mac app, not a plugin — it never connects to ChatGPT or Claude, and they never know it ran. You clean the screenshot up first, then paste the clean version yourself. For text you have copied, press ⌥⌘R: your clipboard is replaced with a redacted version straight away, and a panel lists what came out. For a screenshot, press ⇧⌘1 to take it with ClipScrub instead of ⇧⌘4, then copy the redacted version from the card it shows you. ClipScrub does not catch everything, so read the result before you paste it.

Yes. Drag the PNG or JPG onto the ClipScrub window, paste it in, or open it from the file picker — the same as a PDF or a Word file. The window shows you every name, address and number it found, and you export the redacted copy from there. In Finder you can also right-click a PDF, a Word document or an image and pick ClipScrub under Open With. Set your own logo or wording in Settings ▸ General ▸ Your mark on exports and it appears in the bottom-right corner. Both start empty, so nothing is stamped until you choose it, and video and GIF exports are never marked. ⌥⌘R is for text you have copied, not for an image. For a screenshot, use the ClipScrub window, or take the next one with ⇧⌘1 and it is scanned the moment you take it.

Yes. Drop a folder onto the ClipScrub window or pick one from the file panel, and ClipScrub walks that folder and every folder inside it, sweeping the screenshots, PDFs and plain-text data files it finds. Word, RTF, ODT and HTML are turned away with a note pointing at Capture ▸ Redact Document to File…, because those keep their formatting only one at a time. Hidden files and app bundles are left out of the walk. Redacted copies are written to a Redacted folder alongside the originals, up to 1,000 files a run, and no full-size picture is kept once its file is written. Every file the sweep takes on comes back in the report: redacted, listed under Not redacted with the reason, or counted as not started if the run stopped early. Files the walk turned away are listed under Left alone, each with the reason. Nothing it looked at is silently skipped. Cancel partway and the files already written stay where they are; run it again and ClipScrub leaves the finished ones alone. A multi-page PDF comes back under Not redacted — open those one at a time.

No. On-device text recognition asks for English, Spanish, Japanese, Simplified Chinese and Arabic, and reads whichever of those your Mac supports — that set moves with your macOS version, so it is your Mac’s supported languages rather than a fixed list. The rules that match on format — an email address, an IP, a JWT, an SSN-shaped number, a dotted ICD-10 code, a domain — work on any of that text, and so do rules you write yourself. Rules keyed to an English label stay English: reading a language is not the same as translating a label. If your Mac supports none of them, ClipScrub falls back to English and says so in the system log rather than quietly reading less.

Yes. Settings ▸ Rules exports your rules to a .clipscrubrules file. Whoever you send it to double-clicks it, or drags it onto that pane, and ClipScrub reports how many of the rules it imported. Seven starter packs ship with the app — US healthcare, Developer secrets, Contact info, GDPR (EU), CCPA (US), Financial and Infrastructure. Each is a set of formatted-identifier patterns, IBAN and VAT and passport MRZ and licence-number shapes, not a compliance service: importing one adds ordinary rules you can read, edit, switch off one at a time or delete. Import several and they stack.

An offline, Ed25519-signed key — shape CLIP1.<base64url(payload)>.<base64url(sig)> — verified on your Mac against a public key inside the app. No server, no activation.

The clip will look choppier, and it will sound the same. ClipScrub reads four frames a second by default and shows only the frames it read, holding each one until the next arrives. You can trade time for smoothness: ClipScrub asks before your first recording, and Settings ▸ Recording ▸ Redaction detail switches between them afterwards — reading three times as often looks far smoother and takes about three times as long, roughly eight minutes for a one-minute clip against three. The export keeps the original’s length and frame rate, so nothing drifts out of time — but the picture steps rather than flows, and beside the source it looks choppy. That is the price of never showing you a frame no detector looked at. The export is re-encoded to H.264 in a .mov whatever you started with, so a high-quality source loses a generation. The sound is copied across as it is: ClipScrub covers the picture, not the audio, so a name spoken out loud stays in the file you export. A clip you record inside ClipScrub has no sound at all, so there is nothing left to stay in.

Yes — Settings ▸ Redaction ▸ Keep an audit log. It is on when you install ClipScrub, and while it is on every redaction, copy and export in the window writes an entry. Switch it off and nothing further is written. Entries already recorded stay: the Keep for menu does not reach them, because that prunes the redactions kept in your history, so clearing the log in the audit pane is what empties it. Download the log as JSON from the audit pane if you need to keep the record before you empty it. Clearing starts a fresh chain whose first entry says a wipe happened and when — that entry is written even with logging off, because the one event you cannot hide is the one that destroys the record. An entry that wrote a file records that file’s name, and a filename can carry a patient’s name on its own — worth a thought before you name one. The clipscrub command-line tool keeps its own separate log, off until you switch it on.

Email Mario at hello@clipscrub.com. A person reads it.